topic Re: Monitoring of Anti-Spoofing traffic in Firewall and Security Management

Monitoring of Anti-Spoofing traffic

JozkoMrkvicka — Sat, 18 Aug 2018 09:52:20 GMT

Hello guys,

Is there any way how to monitor anti-spoofing traffic in R77.30 ? I know that I can choose Alert, Log or None in spoofing properties for specific interface. But does someone know how to send for example syslog event in case gateway recognize spoofing traffic ? Or send mail ...

Searching all logs to found "spoofing" word in Information isnt good approach... There must be something on CLI how to check if interface faced spoofing traffic (as it issue log event towards log server).

Thanks for every suggestion in advance.

Re: Monitoring of Anti-Spoofing traffic

PhoneBoy — Sat, 18 Aug 2018 15:18:49 GMT

One place you can see anti-spoofing drop packets (albeit not on a specific interface) is cpview.

If you want Alerts to run a script, you can set that in Global Properties (but will apply for anything with Log type set to Alert):

Re: Monitoring of Anti-Spoofing traffic

JozkoMrkvicka — Sun, 19 Aug 2018 18:56:20 GMT

Thanks, I will check that.

What is default path of that UserDefined script? Or can I use full path of script, like: /var/tmp/testing.sh ?

Re: Monitoring of Anti-Spoofing traffic

PhoneBoy — Sun, 19 Aug 2018 23:35:25 GMT

You can use full path.

Offhand I am not sure what the default path is for this screen.

Re: Monitoring of Anti-Spoofing traffic

JozkoMrkvicka — Mon, 20 Aug 2018 21:03:06 GMT

I was not managed to get it work

First, I want to test it via specific rule, so I have created new rule with Track: "Alert". My understanding is that the script located in /var/log/test.sh should be executed every time this specific rule is matched.

My settings in Global Properties:

According logs, the specific traffic is matched and I also see Alert in logs. The only problem is that it didnt activate the script.

I also tried to set Track as "UserDefined" and with this setup, the script was executed.

Is there any way how to do the same just for Alert (as in Anti-spoofing in R77.30 there are only following options available):

Re: Monitoring of Anti-Spoofing traffic

JozkoMrkvicka — Mon, 20 Aug 2018 21:23:48 GMT

Isnt some stats included in $FWDIR/state/local/FW1/local.set ? How cpview (SecureXL) knows how many packets were dropped because of anti-spoofing ?

Re: Monitoring of Anti-Spoofing traffic

PhoneBoy — Tue, 21 Aug 2018 02:00:58 GMT

As far as I know both of these things should operate exactly the same.

I would open a TAC case.

Re: Monitoring of Anti-Spoofing traffic

_Val_ — Tue, 21 Aug 2018 08:22:03 GMT

Look into sk56701, there are some ideas how to make it work. The fact script is not working means there is something wrong with it. Most probably variables.

Re: Monitoring of Anti-Spoofing traffic

JozkoMrkvicka — Tue, 21 Aug 2018 20:05:16 GMT

Hi Valeri,

The script is working in case I choose "UserDefined" in Track option for the particular rule.

In case I want to do the same for "Alert", it will not work.

My script looks like:

My rule looks like (it will not execute script):

This rule will execute the script:

And my Alert settings looks like:

Re: Monitoring of Anti-Spoofing traffic

JozkoMrkvicka — Tue, 21 Aug 2018 20:23:10 GMT

Dameon Welch Abernathy‌ Valeri Loukine‌ issue solved with following configuration of Alerts in Global Properties:

So now my final question is:

How can I simulate Address Spoofing for interface eth1.50 with subnet 10.20.30.0/24 to see if this is really working in case I will select Alert in Anti-Spoofing Tracking option ?

NOTE: I am running internal LAB in VMware, so I can do (almost) everything

Re: Monitoring of Anti-Spoofing traffic

PhoneBoy — Tue, 21 Aug 2018 22:40:54 GMT

Create a VM with the desired address and try to ping "through" the firewall?

You'll probably have to muck with the routing/ARP tables to make it work right.

Re: Monitoring of Anti-Spoofing traffic

_Val_ — Wed, 22 Aug 2018 08:44:14 GMT

easy, configure anti-spoofing manually and exclude some parts of your network attached to this interface. Link, instead of /24 do less than that.

Re: Monitoring of Anti-Spoofing traffic

_Val_ — Fri, 24 Aug 2018 08:22:27 GMT

That must be true. "Run popup alert script" means the binary is under $FWDIR/bin. If it is not, it is qualified as a "User defined alert"

Re: Monitoring of Anti-Spoofing traffic

Rohit_Gandas — Thu, 06 Dec 2018 21:06:23 GMT

Hello Jozko,

Was you able to perform this. Even I want to perform anti spoofing lab in vmware. Don't know howto do it.

Re: Monitoring of Anti-Spoofing traffic

JozkoMrkvicka — Fri, 07 Dec 2018 17:08:00 GMT

No, I was not able to simulate antispoofing traffic 😕

Re: Monitoring of Anti-Spoofing traffic

Rohit_Gandas — Fri, 07 Dec 2018 17:37:08 GMT

I was able to.

Have a loom at this article i made on anti spoofing.