2

So we have a firewall that allow only Akamai and Cloudflare servers based on ASN, I was wondering if an attacker can spoof ASN or bypass the firewall and how can it be done ?

  • Eh, what's ASN? – Bryan Field Nov 16 '16 at 14:07
  • @GeorgeBailey Autonomous System Number, I think. – Reid Rankin Nov 17 '16 at 4:41
2

IP packets do not contain a ASN value. So what this firewall does, is actually lookup which IP ranges are linked to a specific ASN, and then build firewall rules based on these IP ranges.

If this can be spoofed all depends on which resources the firewall uses to lookup the IP ranges. You didn't mention the brand (and I'm not familiair with any firewall doing ASN based filtering), but the answer to your question really depends on the way it's implemented. Some public registries are less strict in which data can be entered than others, so if one of these less strict ones is used by the firewall it may be possible to make the firewall think a specific IP range is associated with a specific ASN.

Another thing to keep in mind is that sometimes IP ranges get transferred from one ASN to another, especially since there's a shortage of IPv4 addresses nowadays. If old database entries which link the IP and ASN are not removed after a transfer, your firewall could be allowing IP addresses which are not linked to the ASN you allowed anymore.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.