topic Re: Antispoofing with dynamic routing in Firewall and Security Management

Antispoofing with dynamic routing

cem82 — Wed, 19 Jan 2022 01:47:23 GMT

For antispoofing config (on R80.30 and R81.10), is it fine to be internal > defined by routes on the OSPF/BGP interfaces? Do routing changes take effect immediately in terms of the antispoofing checks or does it recalculate every X amount of time etc? Any gotcha that we should be aware of?

Thanks

Re: Antispoofing with dynamic routing

the_rock — Wed, 19 Jan 2022 03:10:06 GMT

That is exactly how you should have it. I did that for 2 customers and works fine for more than a year now, no issues. For your reference, below is from Smart console doc and this applies literally to any R80+ version:

Network defined by routes - The gateway dynamically calculates the topology behind this interface. If the network changes, there is no need to click "Get Interfaces" and install a policy.

R80.20 smart console guide

Re: Antispoofing with dynamic routing

Timothy_Hall — Wed, 19 Jan 2022 13:02:45 GMT

Yes network defined by routes will work fine, the routing table is checked for updates every 1 second and the topology updated accordingly based on this setting:

Re: Antispoofing with dynamic routing

Tobias_Moritz — Mon, 24 Jan 2022 14:43:27 GMT

If you have overlapping routes, you should read my post here:
https://community.checkpoint.com/t5/Security-Gateways/Security-Flaw-in-Dynamic-Anti-Spoofing-R80-20-and-above/m-p/89035#M11057

Summary: Check Points implementation of "Antispoofing defined by routes" does not follow the RfC or the normal routing logic (most specific route is taken). It will not block anything needed, but allows more than needed.