topic exclude anti-spoofing for communication from specific IP addresses in Firewall and Security Management

exclude anti-spoofing for communication from specific IP addresses

tepeeeeei — Tue, 18 Apr 2023 03:14:19 GMT

Dear Team,

In the given network environment, is there a way to configure the anti-spoofing settings to exclude communications from specific IP addresses only? The environment is as follows:

Check Point 6200
OS: R81.10
Anti-spoofing enabled on "external" and "internal" interfaces
Topology "external" : External
Topology "internal" : 10.10.0.0/16

The internal topology is set to 10.10.0.0/16,

but communication from 10.10.254.240/28 comes through the external interface.

Is there a good way to exclude this?

Re: exclude anti-spoofing for communication from specific IP addresses

Timothy_Hall — Tue, 18 Apr 2023 11:46:57 GMT

Yes, select the "Don't check packets from" option on the External interface:

Re: exclude anti-spoofing for communication from specific IP addresses

tepeeeeei — Tue, 18 Apr 2023 23:35:36 GMT

I can't believe it was such a simple solution!
I feel a bit embarrassed for asking, but thank you for your help.

Just to confirm, with this setting, it will behave as follows, right?

This setting only disables the spoofing check for packets with the specified IP addresses coming from the external interface.
If a packet with the specified IP address as its source comes from the internal side, it won't be considered spoofing either, because the internal topology is set to 10.10.0.0/16.

Thanks again for your assistance, and have a great day!

Re: exclude anti-spoofing for communication from specific IP addresses

the_rock — Wed, 19 Apr 2023 02:39:01 GMT

Not exactly. That setting lets you exempt whatever IP ranges you do NOT want checked for anti spoofing that hit external interface. Be careful though...usually, people may have external peer IPs there, as it may happen there are VPN issues until you place the peer ip address in there. Just my experience, but every case is different. Btw, that setting ONLY works with external or VTI interface, as vti is technically considered "extension" of external interface.

For packets coming from internal side, its got nothing to do with that setting, as it would hit internal interface, not external.

Re: exclude anti-spoofing for communication from specific IP addresses

konrado_91 — Mon, 09 Dec 2024 10:36:52 GMT

Hey Tim,

Thank You for pointing out solution to this problem as we run into the same predicament last week. Follow up question on this topic:

Do we need to disable button "Calculate topology automatically based on routing information" for Your solution to work? or we can keep it enabled(as we prefer keep it that way)?

Re: exclude anti-spoofing for communication from specific IP addresses

Timothy_Hall — Mon, 09 Dec 2024 19:18:23 GMT

You shouldn't need to disable that option to my knowledge, the override should still work.