IP Spoof Detected on SonicWALL
05-23-2020 07:57 AM
We are encountering an issue where our SonicWALL NSA 2600 sometimes detects traffic as being spoofed.
5/23/2020 08:20:15 - 23 - Security Services - Alert - local IP, 58244, X0:VAccessPoint- remote IP, 53, 0x300002ff - udp - IP spoof dropped
In this alert example, I have removed the actual local IP/remote IP and VLAN ID.
We are running SonicOS Enhanced 126.96.36.199-6n.
We are running Aruba model 315 on version:188.8.131.52.
We have separate VLANs for our wireless networks and access points. The access points are on VLAN "AccessPoint" and the "local IP" is on a separate VLAN.
We have run a packet capture on the SonicWALL and confirmed that traffic is coming in on VAccessPoint. Traffic should be coming through on VLANlocalIP.
We have verified our network switches, etc. are setup correctly.
This problem just started. We have had the Aruba APs installed for approximately 9 months. No changes in our network in the past several months.
This issue is intermittent. We have not detected any issues with the wireless clients. Wireless client connectivity is stable and does not appear to be impacted by the "IP spoof detection."
Any idea how to troubleshoot/fix this issue?