стоит ASA , логи пишет на syslog сервер .
с недавнего времени появились такие логи , с логами все ясно описание прочел тут http://www.cisco.com/en/US/docs/security/a...tml#wpxref10506
, но их дикое количество ( за сутки пару Gb набегает)
и самое главное как c этим бороться ?

Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny IP spoof from (127.0.0.1) to 172.16.33.54 on interface inside
Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny IP spoof from (127.0.0.1) to 172.16.99.181 on interface inside
Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny IP spoof from (127.0.0.1) to 172.16.164.181 on interface inside
Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny IP spoof from (127.0.0.1) to 172.16.229.53 on interface inside
Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny IP spoof from (127.0.0.1) to 172.16.39.181 on interface inside
Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny IP spoof from (127.0.0.1) to 172.16.105.181 on interface inside

• ASA too many logs ,svshow, 10:01 , 19-Сен-07
• ASA too many logs ,Azazelo, 11:19 , 23-Сен-07

>и самое главное как c этим бороться ?

Action  Determine if an external user is trying to compromise the protected network. Check for misconfigured clients.

http://www.cisco.com/en/US/docs/security/pix/pix53/system/me...

>[оверквотинг удален]
>Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny
>IP spoof from (127.0.0.1) to 172.16.99.181 on interface inside
>Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny
>IP spoof from (127.0.0.1) to 172.16.164.181 on interface inside
>Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny
>IP spoof from (127.0.0.1) to 172.16.229.53 on interface inside
>Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny
>IP spoof from (127.0.0.1) to 172.16.39.181 on interface inside
>Sep 18 20:35:45 ASA Sep 18 2007 20:29:24 ASA : %ASA-2-106016: Deny
>IP spoof from (127.0.0.1) to 172.16.105.181 on interface inside

подсказали

http://certification.ru/cgi-bin/forum.cgi?action=thread&id=2...

no logging message 106016