Description

This article explains what IP spoofing is, how it works in Junos OS, and how to prevent SRX from IP spoofing attacks.

Symptoms

IP spoofing attacks generally occur when SRX receives a packet with a false source address in the packet header, making the packet appear to come from a trusted source.

Solution

On SRX, the mechanism to detect IP spoofing relies on route table entries. Let's consider the following example:

A packet with a source IP address of 172.16.0.2 arrives at interface ge-0/0/1, but Junos OS has a route to 172.16.0.0/24 through ge-0/0/0.
A check for IP spoofing reveals that this address arrived at an invalid interface, as defined in the route table. A valid packet from 172.16.0.2 can only arrive via ge-0/0/0, not ge-0/0/1. Therefore, Junos OS concludes that the packet has a spoofed source IP address and discards it.

NOTE:
Junos OS can detect and drop both IPv4 and IPv6 spoofed packets.
Here is an example of configuring IP spoofing on SRX:
user@host# set security screen ids-option <screen-name> ip spoofing
user@host# set security zone security-zone <zone-name> screen <screen-name>

 

Modification History

2023-09-06: Initial release