Frank,<br><br>I checked and ingress ACL is the 1st feature evaluated, so it makes sense.<br><br>For logging, I think the feature is there.<br>Take a look in the command reference for uRPF:<br><a href="http://www.cisco.com/en/US/docs/ios/ipswitch/command/reference/isw_i1.html#wp1013117">http://www.cisco.com/en/US/docs/ios/ipswitch/command/reference/isw_i1.html#wp1013117</a><br>
<br>It has this text:<br><span class="content">Unicast RPF events can be logged by specifying
the logging option for the ACL entries used by the Unicast Reverse Path
Forwarding command. Log information can be used to gather information
about the attack, such as source address, time, and so on.
<br><br>So you should specify an ACL on the uRPF config with the log entry for any relevant entries. Anything you permit on the ACL will be an exception to uRPF. Anything denied would be dropped if uRPF fails (and only then).<br>
<br>Arie<br></span><br><div class="gmail_quote">On Tue, Feb 3, 2009 at 9:31 AM, Frank Bulk <span dir="ltr"><<a href="mailto:frnkblk@iname.com">frnkblk@iname.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">Arie:</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">I did some hunting around and the only stuff I did see showed
that uRPF is processed before ACLs, so I'm a bit confused in that
regard. If you can verify, that would be appreciated.</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">Using some debug commands I did identify a PPPoA connection that
was spoofing traffic. I removed off the inbound ACL on the
Virtual-Template and I see that the strict uRPF is working:</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">Router#sh
ip interface Vi1.1120 | inc verif</span></p><div class="Ih2E3d">
<p><span style="font-size: 10pt; font-family: Consolas;">
IP verify source reachable-via RX</span></p>
</div><p><span style="font-size: 10pt; font-family: Consolas;">
214 verification drops</span></p><div class="Ih2E3d">
<p><span style="font-size: 10pt; font-family: Consolas;">
0 suppressed verification drops</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">
0 verification drop-rate</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
</div><p><span style="font-size: 10pt; color: rgb(31, 73, 125);">Today I tried adding logging to uRPF:</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">interface
Virtual-Template1</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;"> mtu
1492</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;"> ip
unnumbered Loopback11</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;"> ip
verify unicast source reachable-via rx 126</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;"> ip
mtu 1492</span></p><div class="Ih2E3d">
<p><span style="font-size: 10pt; font-family: Consolas;"> ip
tcp adjust-mss 1452</span></p>
</div><p><span style="font-size: 10pt; font-family: Consolas;"> no
logging event link-status</span></p><div class="Ih2E3d">
<p><span style="font-size: 10pt; font-family: Consolas;"> peer
default ip address dhcp</span></p>
</div><p><span style="font-size: 10pt; font-family: Consolas;"> ppp
mtu adaptive</span></p><div class="Ih2E3d">
<p><span style="font-size: 10pt; font-family: Consolas;"> ppp
authentication pap</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;"> ppp
ipcp dns a.b.c.d e.f.g.h</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">end</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;"> </span></p>
</div><p><span style="font-size: 10pt; font-family: Consolas;">access-list
126 deny ip any any log</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">Unfortunately, it does not appear to be logging anything. There's
no 126 lines, and I know that there's spoofed traffic coming through.
I re-applied my inbound ACL on the Virtual-Template, and I immediately saw
this:</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">Feb
3 01:27:45.326 CST: %SEC-6-IPACCESSLOGP: list 125 denied tcp 10.0.0.2(53070)
-> 189.92.5.249(16016), 1 packet</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">Feb
3 01:27:46.482 CST: %SEC-6-IPACCESSLOGP: list 125 denied tcp 10.0.0.2(52461)
-> 24.82.113.224(22019), 1 packet </span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">It's strange.</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">In regards to how I would like ACL-based logs to be documented;
here's a typical log entry:</span></p><div class="Ih2E3d">
<p><span style="font-size: 10pt; font-family: Consolas;">Jan 31
15:23:21 a.b.c.d 38279: Jan 31 15:23:20.964 CST: %SEC-6-IPACCESSLOGP: list 125
denied udp 80.212.149.228(55190) -> 192.168.0.0(19427), 1 packet</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">Jan 31
15:23:32 a.b.c.d 38287: Jan 31 15:23:31.476 CST: %SEC-6-IPACCESSLOGP: list 125
denied tcp 222.172.244.3(2047) -> 192.168.0.0(19427), 1 packet</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">Jan 31
15:23:33 a.b.c.d 38288: Jan 31 15:23:32.784 CST: %SEC-6-IPACCESSLOGP: list 125
denied udp 151.48.173.200(25235) -> 192.168.0.0(19427), 1 packet</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">Jan 31
15:23:36 a.b.c.d 38290: Jan 31 15:23:34.884 CST: %SEC-6-IPACCESSLOGP: list 125
denied udp 58.108.93.71(13502) -> 192.168.0.0(19427), 1 packet</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
</div><p><span style="font-size: 10pt; color: rgb(31, 73, 125);">The feature request would be to log the interfaces, something
like this:</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">Jan 31
15:23:21 a.b.c.d 38279: Jan 31 15:23:20.964 CST: %SEC-6-IPACCESSLOGP: list 125
denied udp 80.212.149.228(55190) [ATM4/0.100 1/405 Vi1.1120] ->
192.168.0.0(19427) [Fa0/1], 1 packet</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;">Jan 31
15:23:21 e.f.g.g 38281: Jan 31 15:23:21.123 CST: %SEC-6-IPACCESSLOGP: list 125
denied udp 199.120.70.3(55190) [Fa0/1] -> 192.168.0.0(19427) [ATM4/0.100
1/899 Vi1.923], 1 packet</span></p>
<p><span style="font-size: 10pt; font-family: Consolas;"> </span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">Regards,</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">Frank</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
<div style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0in 0in;">
<p><b><span style="font-size: 10pt;">From:</span></b><span style="font-size: 10pt;"> Arie Vayner
[mailto:<a href="mailto:arievayner@gmail.com" target="_blank">arievayner@gmail.com</a>] <br>
<b>Sent:</b> Sunday, February 01, 2009 1:19 AM<div><div></div><div class="Wj3C7c"><br>
<b>To:</b> Frank Bulk<br>
<b>Cc:</b> <a href="mailto:cisco-bba@puck.nether.net" target="_blank">cisco-bba@puck.nether.net</a><br>
<b>Subject:</b> Re: [cisco-bba] ACLs on Virtual-Access templates</div></div></span></p>
</div><div><div></div><div class="Wj3C7c">
<p> </p>
<div>
<p style="margin-bottom: 12pt;">Frank,<br>
<br>
So, just to be sure - if you remove the ACL, does uRPF work as it should?<br>
I would assume (I don't have the time right now to make sure) that the ACL is
evaluated before as it is part of the ingress packet processing, while uRPF is
done later (close to the time when you also do a route lookup). Therefore, it
would make sense for the ACL to take precedence.<br>
<br>
With regards to the log message, can you show me some example of what you
actually get? I can then try and see if we can file an enhancement request.<br>
<br>
Thanks<br>
Arie</p>
<div>
<p>On Sun, Feb 1, 2009 at 6:58 AM, Frank Bulk <<a href="mailto:frnkblk@iname.com" target="_blank">frnkblk@iname.com</a>> wrote:</p>
<div>
<div>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">Just to add to that, is there a
way that the Virtual-interface that's doing the spoofing can be
identified? The log entries for the ACL hits don't show anything but the
spoofed IP, but I don't know which connection is doing it. Perhaps it's
one PPPoA/E connection that's generating those spoofed packets…</span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);">Frank</span></p>
<div>
<p><span style="font-size: 10pt; color: rgb(31, 73, 125);"> </span></p>
<div style="border-style: solid none none; border-color: -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0in 0in;">
<p><b><span style="font-size: 10pt;">From:</span></b><span style="font-size: 10pt;"> Arie Vayner [mailto:<a href="mailto:arievayner@gmail.com" target="_blank">arievayner@gmail.com</a>] <br>
<b>Sent:</b> Saturday, January 31, 2009 3:49 PM<br>
<b>To:</b> Frank Bulk<br>
<b>Cc:</b> <a href="mailto:cisco-bba@puck.nether.net" target="_blank">cisco-bba@puck.nether.net</a><br>
<b>Subject:</b> Re: [cisco-bba] ACLs on Virtual-Access templates</span></p>
</div>
<p> </p>
</div>
<div>
<p style="margin-bottom: 12pt;">Frank,</p>
<div>
<div>
<p><br>
<br>
uRFP should be the right way to block packets from the client as a source...<br>
After you connect, do you see the uRPF feature enabled on the Virtual-Access
(show run interface and show ip interface)?<br>
<br>
Arie</p>
</div>
</div>
<div>
<div>
<div>
<p>On Sat, Jan 31, 2009 at 11:35 PM, Frank Bulk <<a href="mailto:frnkblk@iname.com" target="_blank">frnkblk@iname.com</a>>
wrote:</p>
<p>Is there a way to build an ACL on a Virtual-Access template such that the<br>
connection can only use the IP address given to it by IPCP?<br>
<br>
I applied strict uRPF to the Virtual-Access template, but that didn't stop<br>
this kind of traffic:<br>
<br>
Jan 31 15:23:21 a.b.c.d 38279: Jan 31 15:23:20.964 CST: %SEC-6-IPACCESSLOGP:<br>
list 125 denied udp 80.212.149.228(55190) -> 192.168.0.0(19427), 1 packet<br>
Jan 31 15:23:32 a.b.c.d 38287: Jan 31 15:23:31.476 CST: %SEC-6-IPACCESSLOGP:<br>
list 125 denied tcp 222.172.244.3(2047) -> 192.168.0.0(19427), 1 packet<br>
Jan 31 15:23:33 a.b.c.d 38288: Jan 31 15:23:32.784 CST: %SEC-6-IPACCESSLOGP:<br>
list 125 denied udp 151.48.173.200(25235) -> 192.168.0.0(19427), 1 packet<br>
Jan 31 15:23:36 a.b.c.d 38290: Jan 31 15:23:34.884 CST: %SEC-6-IPACCESSLOGP:<br>
list 125 denied udp 58.108.93.71(13502) -> 192.168.0.0(19427), 1 packet<br>
<br>
Those source IPs aren't mine, and are targeting an RFC1918 address. I'm<br>
blocking traffic originating from my PPPoA/E customers that use a source IP<br>
address outside my netblock or are targeting an RFC198 address using an<br>
inbound ACL on the Virtual-Access template, but it doesn't stop a a customer<br>
from spoofing their neighbor's IP address.<br>
<br>
I've had a basic ACL in place on our internet-facing Ethernet port (Cisco<br>
7206VXR with NPE-400) for a long time, but I didn't having anything in place<br>
to block RFC 1918 addresses. I could have applied the rules to the ACL on<br>
the Ethernet interface, but I've been told to apply an ACL as close as<br>
possible to the source of the traffic.<br>
<br>
To further complicate matters, I also use this router to route RFC 1918<br>
space for corporate needs. I keep that "separate" by using
source-based<br>
routing, but that didn't prevent PPPoA/E customers from sending a packet to<br>
the RFC 1918 space, even if the return packet never got back to them.<br>
Perhaps I should use a VRF for handling corporate, traffic, except that I've<br>
never done that before and I would need to spend some time learning.<br>
<br>
Frank<br>
<br>
_______________________________________________<br>
cisco-bba mailing list<br>
<a href="mailto:cisco-bba@puck.nether.net" target="_blank">cisco-bba@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-bba" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-bba</a></p>
</div>
<p> </p>
</div>
</div>
</div>
</div>
</div>
</div>
<p> </p>
</div>
</div></div></div>
</div>
</blockquote></div><br>