Spoofed PAT IP?

Question

Hey everyone,
Recently I applied an ACL to the WAN interface of one of our routers.  One of the entries, which is also log-enabled, blocks access to the inside global PAT address, basically denying access to any traffic that originates from the PAT address.  Soon after applying the ACL upon reviewing the logs, I discovered that periodic access from the inside global to the inside global is being blocked on UDP 6881.  In other words, it appears that the PAT address is attempting to access itself to and from UDP 6881.  So some service or someone is attempting to gain access back into the network using UDP 6881.  So I applied another ACL to the inside interface and found the machine that was generating the traffic.  After doing a little research I found out that Bit Torrent uses that port for its peer-to-peer connections.  Unfortunately I don't have access to the machine generating that traffic but I need to know whether or not to escalate the issue.  To me, it looks like the PAT address is being spoofed by an outside party to access something on the inside that's making requests to it.  I am very interested to know your opinions on this.

Answer 1

Hi,
Do notice that when a user loads a web page it doesnt form only one TCP connection. Not all of the content are loaded from a single server so multiple TCP connections will be formed to load the complete page.
With regards to the Dynamic PAT,
It was my understanding originally that the ASA would use up the ports on the first PAT IP address configured and then the second PAT IP address. Judging by the output you have shared it would seem that the ASA does Round Robin with the 2 PAT IP addresses.
In the new ASA software levels configuring Dynamic PAT is a lot clearer as you are actually given clear options to choose how the Dynamic PAT or PAT pool behaves.
Here is a quote from a older Cisco ASA document about Dynamic NAT and PAT which to my eye seems that the first PAT IP address should be used first.
You can enter multiple global commands for one interface using the same NAT ID; the security appliance uses the dynamic NAT global commands first, in the order they are in the configuration, and then uses the PAT global commands in order. You might want to enter both a dynamic NAT global command and a PAT global command  if you need to use dynamic NAT for a particular application, but want  to have a backup PAT statement in case all the dynamic NAT addresses are  depleted. Similarly, you might enter two PAT statements if you need  more than the approximately 64,000 PAT sessions that a single PAT mapped  statement supports
I marked the section in RED which seems to me to indicate that the Dynamic PAT address should be used in order.
- Jouni