So we have a firewall that allow only Akamai and Cloudflare servers based on ASN, I was wondering if an attacker can spoof ASN or bypass the firewall and how can it be done ?
2
-
Eh, what's ASN?– 700 SoftwareNov 16, 2016 at 14:07
-
@GeorgeBailey Autonomous System Number, I think.– Reid RankinNov 17, 2016 at 4:41
Add a comment
|
1 Answer
IP packets do not contain a ASN value. So what this firewall does, is actually lookup which IP ranges are linked to a specific ASN, and then build firewall rules based on these IP ranges.
If this can be spoofed all depends on which resources the firewall uses to lookup the IP ranges. You didn't mention the brand (and I'm not familiair with any firewall doing ASN based filtering), but the answer to your question really depends on the way it's implemented. Some public registries are less strict in which data can be entered than others, so if one of these less strict ones is used by the firewall it may be possible to make the firewall think a specific IP range is associated with a specific ASN.
Another thing to keep in mind is that sometimes IP ranges get transferred from one ASN to another, especially since there's a shortage of IPv4 addresses nowadays. If old database entries which link the IP and ASN are not removed after a transfer, your firewall could be allowing IP addresses which are not linked to the ASN you allowed anymore.
answered Nov 16, 2016 at 12:53
