Firewall Security

Anti-spoofing configuration in Cisco routers and firewalls.

To configure Cisco router and firewalls for anti-spoofing we need to enable IP Unicast Reverse-path Forwaring(RPF) on the interface.

RPF feature when enabled will cause the router to check the source of the incoming packet against its routing table to determine if the packet is expected on that particular interface.  If a packet with source belonging to the internal network is received on the outside interface for example, the packet will be dropped.

command syntax:

ip verify unicast reverse-path

The  output of command ”sh ip traffic” will display packets dropped by anti-spoofing if this is enabled.

Related posts:

1. Use SCP with Cisco routers and PIX/ASA firewalls to transfer files.
2. Configuring Authentication Proxy on Cisco Routers.
3. Firewall packet inspection and decision making process
4. Cisco firewall error “No translation Group Found”
5. Top 10 general firewall best practice guidelines.

© 2009 Information Security Tips.