Cisco ASA 5505 Configuration Manual page 1115

Using Protection Tools
This chapter describes some of the many tools available to protect your network and includes the
following sections:
•
•
•
•
Preventing IP Spoofing
This section lets you enable Unicast Reverse Path Forwarding on an interface. Unicast RPF guards
against IP spoofing (a packet uses an incorrect source IP address to obscure its true source) by ensuring
that all packets have a source IP address that matches the correct source interface according to the
routing table.
Normally, the adaptive security appliance only looks at the destination address when determining where
to forward the packet. Unicast RPF instructs the adaptive security appliance to also look at the source
address; this is why it is called Reverse Path Forwarding. For any traffic that you want to allow through
the adaptive security appliance, the adaptive security appliance routing table must include a route back
to the source address. See RFC 2267 for more information.
For outside traffic, for example, the adaptive security appliance can use the default route to satisfy the
Unicast RPF protection. If traffic enters from an outside interface, and the source address is not known
to the routing table, the adaptive security appliance uses the default route to correctly identify the outside
interface as the source interface.
If traffic enters the outside interface from an address that is known to the routing table, but is associated
with the inside interface, then the adaptive security appliance drops the packet. Similarly, if traffic enters
the inside interface from an unknown source address, the adaptive security appliance drops the packet
because the matching route (the default route) indicates the outside interface.
Unicast RPF is implemented as follows:
•
•
OL-20339-01
Preventing IP Spoofing, page 52-1
Configuring the Fragment Size, page 52-2
Configuring TCP Options, page 52-3
Configuring IP Audit for Basic IPS Support, page 52-5
ICMP packets have no session, so each packet is checked.
UDP and TCP have sessions, so the initial packet requires a reverse route lookup. Subsequent
packets arriving during the session are checked using an existing state maintained as part of the
session. Non-initial packets are checked to ensure they arrived on the same interface used by the
initial packet.
C H A P T E R
Cisco ASA 5500 Series Configuration Guide using ASDM
52
52-1