Hello Nick, guess I did not understand what source IP is allowed with "allow-self-ping". I just tried out with that setup:
Attacking server somewhere in 1.0.0.0/24 connected to Sup2T with 1.0.0.1 and 1.0.0.2 (hard-coded + HSRP). Target is 2.0.0.123 (connected somewhere else). No matter if allow-self-ping is set or not, packets with those sources are dropped: 1.0.0.1 1.0.0.2 1.0.0.255 2.0.0.123 Only source=1.0.0.3-254 works, that looks like correct behaviour to me. What additional spoofed IP(s) could be used in that case with allow-self-ping set ? kind regards Rolf > On 08/05/2013 15:06, "Rolf Hanßen" wrote: >> R2(config-if)#ip verify unicast source reachable-via rx ? >> ... >> allow-self-ping Allow router to ping itself (opens vulnerability in >> verification) >> l2-src Check packets arrive with correct L2 source address >> >> What kind of vulnerability is that ? Just for my interest, I do not need >> to ping myself usually. ;) > > In order to ping an interface address, the packet needs to go through the > normal packet forwarding process. This includes a urpf check. As the > ping > packet does not come from the interface itself, it will fail a urpf check > and the packet will be dropped unless "allow-self-ping" is enabled. If > you > enable "allow-self-ping", the vulnerability is that you can also send > packets to the router with srcip=dstip and they will pass the urpf check. > > Nick > > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
