Security

Ask something
Discussion Locked

IP Spoofing issue

0 helpful
2 replies

by iplogic

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I run a 2004 ISA server. When 2 of my VPN clients connect to the LAN via PPTP, their IP addresses generates a whole lot of IP spoofing attack logs.
Can anyone tell me wheter these are False positives or ???????

Thanks for your help
Cheers

2 replies

by bfilmfan

Do those clients have hard coded IP addresses which should be inside your local network? If so, that condition would generate an IP-Spoofing alert since the ISA server believes that someone is spoofing internal addresses in an external network.

You can overlook IP Spoofing here:

http://www.securityfocus.com/infocus/1674

To disable the IP Spoofing detection in ISA 2004, then check the registry key:

HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/FwEng/Parameters

DWord: SpoofDetection
Value: 0 (Decimal)

Tom Shinder has a pretty good blog on ISA 2004:
http://msmvps.com/shinder/

by iplogic

IP address are assigned to VPN clients as they connect, and they are Internal LAN adresses . However is their own static address assign to them by their ISP that shows as spoof.
Thanks again

This discussion is closed to new replies.