topic Re: strange address spoofing on standby firewall in Firewall and Security Management

strange address spoofing on standby firewall

prisciltetchou1 — Mon, 19 Jul 2021 14:03:41 GMT

Hello,

Please I need an explanation to a behavior noticed when we are having address spoofing.

We have a cluster of 2 firewalls in HA mode (active/standby).

There is a traffic that is dropped because of address spoofing, the strange think is that the spoofed traffic is passing through the standby firewall instead of the active one.

Is it normal? If yes, why is it not the active firewall that should drop a spoofed traffic?

Thanks in advance for your help.

Re: strange address spoofing on standby firewall

PhoneBoy — Mon, 19 Jul 2021 19:58:11 GMT

If whatever is sending the spoofed traffic is using the MAC address of the backup gateway, then the backup will drop and log the traffic.
You’d have to take some packet captures on the gateway to determine if this is happening.

Re: strange address spoofing on standby firewall

the_rock — Tue, 20 Jul 2021 02:05:33 GMT

Phoneboy is correct. Do some packet captures and figure out why this might be happening...is HA status if you run cphaprob state showing correct state on both members? Can you attach screenshots showing the actual drop and how thats configured in topology in dashboard (you can blur out the IP addresses).

Re: strange address spoofing on standby firewall

Timothy_Hall — Tue, 20 Jul 2021 13:51:46 GMT

Specifically use the -e option for tcpdump or -D option for cppcap which will show you the Layer 2 MAC addresses; these options are covered in my Max Capture course. You will need to look at the source MAC address to see where the spoofed packet is coming from, and may need to trace it back through your switching/routing infrastructure to see where it is actually originating.