topic Re: Traffic drop due to antispoofing- R80.10 in Firewall and Security Management

Traffic drop due to antispoofing- R80.10

jamal_shah — Sun, 10 Apr 2022 20:33:22 GMT

Traffic drop due to antispoofing- R80.10

I need urgent help please.

I have attached interface antispoof configuration setting on which I am getting antispoof drops in tracker.
All traffic is dropped from 2 specific servers on this interface.

All other traffic on this gateway is fine.

Re: Traffic drop due to antispoofing- R80.10

the_rock — Sun, 10 Apr 2022 21:17:26 GMT

As a workaround, set anti spoofing to either detect or disable it temporarily. Here is what I suggest as best practise...select "defined by routes", because otherwise, you always have to make sure 100% that subnets behind the interface are correct. With routes option, as long as routes are right, no need to worry. Now, since yours is for external, you can actually check option "dont check packets from" and add whatever is dropped there.

Andy

Re: Traffic drop due to antispoofing- R80.10

jamal_shah — Mon, 11 Apr 2022 04:21:55 GMT

Hi Andy,

Thanks for your response.

For the don't check packets from option

A.do I need to perform any other action ?

B.will it effect my existing other traffic?

Thanks

Re: Traffic drop due to antispoofing- R80.10

PhoneBoy — Mon, 11 Apr 2022 06:48:29 GMT

The option to define anti-spoofing by the routing table is only present from R80.20 and above.
The “don’t check packets from” option is the right one to use in this case.
It only disables the anti-spoof check for the specific hosts in question.