Weird anti-spoofing issue

[Gremlin]

Hi all,

I ran into some strange problem involving anti-spoofing. For some reason packets with the same SOURCE IP ADRRESS are coming from TWO DIFFERENT INTERFACES.

Initially, packets coming on the “wrong” interface were subject to anti-spoofing and got drooped (simply because this network WASN’T DEFINED as a network behind this interface). So, while the customer is trying to figure out why those packets got to the wrong interface in the first place, I simply ADDED THIS NETWORK to a topology (i.e. “behind this interface”). So long, so good BUT those packets are still got dropped?! For some odd reason the gateway is still considering those packets as spoofed although this network is a part of the group representing networks behind this interface. So, how can it be?

My best guess is one of those two:
I. Not only this network is defined as a network behind the RIGHT interface, BUT it is DEFINED ON THE INTERFACE (i.e. the network is 192.168.3.0/24 and the interface has 192.168.3.245). So, the gateway maybe considers this network as a directly connected and it’s impossible for those packets to appear on any other interface.
II. Because the packets appear on one interface just after they appeared on another the gateway has an ARP record which allows him to know on which interface this network is located.

Anyway, what do you think guys? Packets are still being dropped although the network was defined behind both interfaces.

Any suggestion would be appreciated,
Alex.

[melipla]

Can you ensure that the netmasks are correctly defined for the network on the gateway and the host with the IP assigned?

Can you ensure the network path is exactly the same going to and coming from the host?

[Gremlin]

Unfortunately I cannot verify those two because the LAN is administrated by customer itself (and the CP by my workplace :) but packets from this network should arrive only on one interface. So while they're arriving on both they always got dropped on the second one (the "wrong" interface) although this network defined behind both interfaces. For some reason the gateway (R61, Provider-1 environment) considers those packets as spoofed.

[MarioL]

If the same packets are coming up on 2 different interfaces you must solve the cause, not work around it, IMHO.

Get the customer to check the switching, etc and find where the "loop" is.

[rugby1725]

Also, you may want to verify that you have the route correct on the gateway.

It could be that there is a routing loop issue between you and the switch on one of the interfaces (i.e. you send it to him and he sends it right back)

[tdvit]

make sure the arp tables are in order and check for duplicate mac addresses