topic Re: How to check the target of source ip / destiantion ip if it is dropped due to AntiSpoofing? in Firewall and Security Management

How to check the target of source ip / destiantion ip if it is dropped due to AntiSpoofing?

BlueGrass — Sat, 23 Jul 2022 06:59:28 GMT

Dear All,

Just find a question here.

We are using the Checkpoint Gateway as Second tier Firewall.

Every time we get "Network Topology" from the Gateway objects, the Anti Spoofing will enable again.

And then the internet traffic is dropped due to the Anti-Spoofing.

but if we check out the traffic log, seems we just got the "allow" message but not "Drop due to Spoofing..."

Please advise.

BTW, how can we disable the Anti-Spoofing forever?

Re: How to check the target of source ip / destiantion ip if it is dropped due to AntiSpoofing?

Chris_Atkinson — Sat, 23 Jul 2022 10:11:49 GMT

Enabling logging for "Implied Rules" in global properties.

Which topology option do you currently use, "defined by routes" or other ?

Re: How to check the target of source ip / destiantion ip if it is dropped due to AntiSpoofing?

Timothy_Hall — Sat, 23 Jul 2022 21:18:26 GMT

The logging for antispoofing is located on the Topology screen for each interface here, it is set enabled by default so should be logging anti-spoofing drops unless someone changed it (the state of this checkbox should not be affected by a Get Topology operation):

There is a useful one-liner that can give you a very concise look at your anti-spoofing configuration:Show Address Spoofing Networks via CLI

If you really want to disable anti-spoofing permanently (not recommended) you will need to set these two kernel variables to a value of 0 and make the change permanent in fwkern.conf (first variable) and simkern.conf (second variable):

fw_antispoofing_enabled

sim_anti_spoofing_enabled

Re: How to check the target of source ip / destiantion ip if it is dropped due to AntiSpoofing?

cuiko78 — Sun, 24 Jul 2022 18:41:35 GMT

Here's a question you might be interested in.

A Checkpoint Gateway is used as Second tier Firewall. Every time we get "Network Topology" data from a Gateway object, Anti Spoofing again becomes active.

Re: How to check the target of source ip / destiantion ip if it is dropped due to AntiSpoofing?

_Val_ — Mon, 25 Jul 2022 09:29:37 GMT

This is by design. It is the best practice to use antispoofing