Private IP showing up on external interface

[cdooer]

Hey folks. Our SecOps team noticed some irregular log entries on our gateways coming from what appears to be a private IP (10.10.x.x), and after some investigation, the traffic is only showing up on our Internet facing external interfaces. The traffic is blocked, so it isn't a security concern really, but our SecOps team thinks we should open a TAC case to figure out how it's happening. Anyone ever seen something like this before? I obviously know about IP spoofing, just wondering how a spoofed private IP makes it all the way to our gateways.

[the_rock]

Some things to check:

-on Gaia OS level, can you confirm external interface is configured properly?

-what do you see when running ifconfig -a from ssh?

-in topology in dashboard, what does that interface show?

If you could send screenshots of this (obviously, you can blur out the IP itself), might be helpful.

[Wolfgang]

@cdooer 

I think IP spoofing is the right idea. As I understand you can see packets blocked on your external interface with private IP as source. It‘s possible to send a packet to your gateways external public IP with an private IP as source. All ISPs should not route packets with private IPs as destination, but with private IPs as source this is possible. Some ISPs allow this some not.

It‘s too possible a device in front of your external connection does create these traffic.

Wolfgang