Anti-spoofing disrupting inside to dmz traffic

[JMCraig]

Hi Folks,

I've got the basic 5505 license (so boxes on the dmz interface cannot initiate connections to boxes on the inside interface--traditional dmz setup). But, with anti-spoofing enabled on the outside interface, I also can't initiate traffic from a box on the inside interface to a dmz box. (And that should be possible, shouldn't it?)

Do I just need a static route from inside to dmz or what?

Thanks much!

John Craig
Alpha-G Consulting, LLC

http://www.alphagconsulting.com

 

[PScottC]

With the basic license you can't pass any traffic between the DMZ and inside interfaces.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[Supergrrover]

PScottC,
That's not entirely true. You cannot initiate traffic to the inside from the DMZ, but it will respond to traffic initiated from the inside.

JMCraig,
If you turn off the anti-spoof, does it work as you want? You can do all the anti-spoof by setting up proper ACL's and nat-control properly.



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[PScottC]

Thanks for the clarification, Supergrrover. How does that affect UDP traffic, like tftp where there may be some responses? Is it based on the application inspection policies?

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[JMCraig]

Yes, with the anti-spoofing disabled, I can get from inside boxes to the services hosted on the dmz boxes. But I'm not clear on how ACLs and NAT control can compensate for anti-spoofing being disabled. (But maybe I'm not very clear on the whole issue.) In the docs on Anit-Spoofing, it says "For any traffice that you want to allow through the security appliance, the security appliance routing table must include a route back to the source address. See RFC 2267 for more information"--right, like that standard is going to help me get it set up.... So, it seems like I just need to have a static NAT entry of the appropriate type--but I'm not clear on what that would be.

I only turned on anti-spoofing on the outside interface, but when I have that enabled, traffic originating on the inside interface gets blocked on the way to the dmz interface--huh?

John

John Craig
Alpha-G Consulting, LLC

http://www.alphagconsulting.com

 

[Supergrrover]

ok, I'll call strange. Can you post a scrubbed config?


Brent
Systems Engineer / Consultant
CCNP, CCSP