How to keep an internal node from spoofing an internal server's IP and thereby getting the server blocked by active defenses?

Question

In an internal network, all machines are firewalled from each other. The firewall has port scan detection and blocking mechanism (say, psd module of iptables).

Question: What are the ways I can block internal port scans while avoiding DoS threat? Say, an internal attacker might impersonate/spoof the domain server's IP address while port scanning the network and get the domain server's IP blocked on the firewall. How do I avoid that?

I know that IP spoofing attacks from outside trying to impersonate internal address (and vice-versa) can be prevented via ingress/egress filtering. But what about only internal addresses?

Another way to prevent this is TCP packet numbering (same Wikipedia link). But what about non-TCP scans?

What other strategies are available?

Answer 1

At a network level, you could try implementing Dynamic ARP inspection and DHCP snooping to prevent hosts from spoofing the IP address of legitimate hosts. This will create a database on your switch of what IP addresses were handed out on which port and to which host, if another host tries to spoof that IP it can be blocked and the spoofed traffic will not make it through.