Does anti-spoofing heed policy-based routing on R80.40, topology defined by routes?

Toolmaker — Mon, 18 Jan 2021 09:30:34 GMT

Hi,

we have a customer firewall running R80.40 using anti-spoofing with topology defined by routes - we receive some routes via OSPF.

Certain internal traffic must take a secondary WAN route - it is a matter of who pays for bandwidth. This is accomplished via policy-based routing - if source matches network A and destination is in network B, then use the table pointing to the secondary WAN router.

Other traffic to B should use the primary WAN link; its return packets will also come in via the primary WAN link.

The PBR setup works, packets get sent out as expected.

However, anti-spoofing denies incoming connections from B to A via the secondary WAN interface.

I would assume that "topology defined by routes" only heeds static and dynamic routes, but not PBR.

Is there a way to solve this while keeping anti-spoofing?

Best regards,
Bernhard

Re: Does anti-spoofing heed policy-based routing on R80.40, topology defined by routes?

_Val_ — Mon, 18 Jan 2021 11:28:01 GMT

Your assumption is correct. I would recommend manual anti-spoofing in this case.

Re: Does anti-spoofing heed policy-based routing on R80.40, topology defined by routes?

Toolmaker — Wed, 20 Jan 2021 08:24:23 GMT

Thanks... guess I will have to forgo the comfort of routing-based anti-spoofing then.

topic Re: Does anti-spoofing heed policy-based routing on R80.40, topology defined by routes? in Firewall and Security Management

Does anti-spoofing heed policy-based routing on R80.40, topology defined by routes?

Re: Does anti-spoofing heed policy-based routing on R80.40, topology defined by routes?

Re: Does anti-spoofing heed policy-based routing on R80.40, topology defined by routes?