ASA 5505 Deny IP spoof from valid address

I am getting an error when a machine tryis to get to a website externally

Deny IP spoof from (10.29.2.2) to 10.3.114.187 on interface WestCovina

The clients machine is at 10.29.1.123
The server is at 10.3.114.187

The partial config is below

!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.29.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 10.1.9.60 255.255.255.0
!
interface Vlan3
 nameif WestCovina
 security-level 50
 ip address 10.29.2.2 255.255.255.0
!
interface Vlan4
 nameif MercedCounty
 security-level 25
 ip address 10.5.60.12 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
 switchport access vlan 4
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport mode trunk
!
ftp mode passive
dns domain-lookup WestCovina
dns server-group DefaultDNS
 domain-name dppd.org
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list WCSG_access_in extended permit ip any any log
access-list WCSG_access_in extended permit icmp any any log
access-list WCSG_access_in extended deny ip any any log
access-list WCSG_nat0_outbound extended permit ip 10.29.4.0 255.255.255.0 10.29.1.0 255.255.255.0
access-list WCSG_nat0_outbound extended permit ip 10.29.2.0 255.255.255.0 10.29.1.0 255.255.255.0
access-list MercedCounty_nat0_outbound extended permit ip 10.5.60.0 255.255.255.0 10.29.1.0 255.255.255.128
access-list MercedCounty_nat0_outbound extended permit ip 10.2.15.0 255.255.255.0 10.29.1.0 255.255.255.0
access-list MercedCounty_access_in extended permit icmp any any log
access-list MercedCounty_access_in extended permit ip any any log
access-list MercedCounty_access_in extended deny ip any any log
access-list inside_access_in extended permit ip any any log
access-list inside_access_in extended permit icmp any any log
access-list inside_access_in extended deny ip any any log
access-list Inside_access_MercedCounty extended permit ip 10.29.1.0 255.255.255.0 10.2.15.0 255.255.255.0
pager lines 24
logging enable
logging console debugging
logging monitor debugging
logging buffered debugging
logging trap emergencies
logging asdm debugging
mtu inside 1500
mtu outside 1500
mtu WestCovina 1500
mtu MercedCounty 1500
no failover
monitor-interface inside
monitor-interface outside
monitor-interface WestCovina
monitor-interface MercedCounty
icmp unreachable rate-limit 1 burst-size 1
icmp permit any WestCovina
icmp permit any MercedCounty
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (WestCovina) 2 interface
global (MercedCounty) 3 interface
nat (inside) 0 access-list Inside_access_MercedCounty
nat (inside) 1 0.0.0.0 0.0.0.0
nat (WestCovina) 0 access-list WCSG_nat0_outbound
nat (WestCovina) 2 10.29.1.0 255.255.255.0
nat (MercedCounty) 0 access-list MercedCounty_nat0_outbound
nat (MercedCounty) 2 10.29.1.0 255.255.255.0
static (inside,WestCovina) 10.29.1.0 10.29.1.0 netmask 255.255.255.0
static (inside,MercedCounty) 10.29.1.0 10.29.1.0 netmask 255.255.255.0
access-group inside_access_in in interface inside
access-group WCSG_access_in in interface WestCovina
access-group MercedCounty_access_in in interface MercedCounty
route outside 0.0.0.0 0.0.0.0 10.1.9.1 1
route WestCovina 10.50.0.0 255.255.0.0 10.29.2.1 1
route WestCovina 10.30.2.1 255.255.255.255 10.29.2.1 1
route WestCovina 10.29.4.0 255.255.254.0 10.29.2.1 1
route WestCovina 10.2.15.3 255.255.255.255 10.29.2.1 1
route WestCovina 10.2.15.2 255.255.255.255 10.29.2.1 1
route WestCovina 167.10.0.0 255.255.0.0 10.29.2.1 1
route WestCovina 10.1.133.0 255.255.255.0 10.29.2.1 1
route WestCovina 10.1.132.0 255.255.255.0 10.29.2.1 1
route WestCovina 10.1.2.0 255.255.255.0 10.29.2.1 1
route WestCovina 10.3.110.175 255.255.255.255 10.29.2.1 1
route WestCovina 10.3.114.187 255.255.255.255 10.29.2.1 1
route WestCovina 10.3.114.197 255.255.255.255 10.29.2.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 10.29.1.0 255.255.255.0 inside
http 10.29.2.0 255.255.255.0 WestCovina
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 10.29.1.0 255.255.255.0 inside
telnet 10.29.2.0 255.255.255.0 WestCovina
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcpd auto_config outside
!
dhcpd address 10.29.1.100-10.29.1.150 inside
dhcpd dns 10.29.1.199 interface inside
dhcpd enable inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp




drcrash1Asked:
Who is Participating?
 
DonbooConnect With a Mentor Commented:
The most likely issue is this.


Client 10.29.1.123 dst. for 10.3.114.187 enters interface VLAN 1 gets Nat´ed to 10.29.2.2 (VLAN 3 IP of the ASA) gets routed to 10.29.2.1 (a layer 3 device of some kind) out of VLAN 3 but the layer 3 device dosnt have a route containing the IP 10.3.114.187 using its default route to route it to 10.29.2.2 (the ASA) who checks for spoofing and finds that packets for 10.3.114.187 shouldn´t come in on this interface and discards the packet and logs it with "Deny IP spoof from (10.29.2.2) to 10.3.114.187 on interface WestCovina"

Check the routing to 10.3.114.187 on you layer 3 device 10.29.2.1.



0
 
mediavisiondsCommented:
If the clients machine is at 10.29.1.123 then it should be entering the firewall at interface VLAN 1 "inside" and not VLAN3 "WestCovina".   From the log message it looks like the firewall is receiving the packet on the wrong interface and therefore thinks it is spoofed.  Is the client machine on the right vlan, vlan 3?
0
 
drcrash1Author Commented:
yes it is on the right interface.
0
 
drcrash1Author Commented:
I will check that thanks
0
 
drcrash1Author Commented:
resolved
0
All Courses

From novice to tech pro — start learning today.