topic Re: Dynamic Routing Anti Spoofing in Firewall and Security Management

Dynamic Routing Anti Spoofing

Dor_Marcovitch — Tue, 19 Dec 2017 11:18:11 GMT

hey

1) how can you enforce AntiSpoofing on interfaces that learn routes from dynamic protocol (OSPF / RIP )?

2) i also have one network which is directlry connected to the FW and in a DR scenario someone will shut the interface and this network will failover to the DR so i need the FW to be updated acordingly with the anti-spoofing configuration

FW Version is R77.30

Re: Dynamic Routing Anti Spoofing

PhoneBoy — Wed, 20 Dec 2017 00:17:33 GMT

Antispoofing based on dynamic routing configuration is something that is planned for a later release.

Any updates to the anti-spoofing configuration could be scripted (with the R80.10 API or even with dbedit) but a policy installation is required for it to take effect.

Re: Dynamic Routing Anti Spoofing

scottikon — Fri, 07 Jun 2019 08:42:07 GMT

Is there any more update on this topic? I am struggling to find much information.

Thanks

Re: Dynamic Routing Anti Spoofing

Bryce_Myers — Fri, 07 Jun 2019 21:17:36 GMT

If you are running 80.20 gateway and management you should be able to select "Network Defined by Routes". I haven't tested this in my environment dynamic routing.

Re: Dynamic Routing Anti Spoofing

scottikon — Sat, 08 Jun 2019 11:29:29 GMT

Thank you,

That is an option we can look to test for one of the interfaces. The other interface is defined as external so I don't have that option.

Re: Dynamic Routing Anti Spoofing

scottikon — Sat, 08 Jun 2019 12:19:16 GMT

Thank you.

This is something we can try on one of our interfaces that is used for BGP.

The second interface we have is configured as External topology so we don't have the option to select "networks defined by routes".

We will just have to create a group and manually update that when we know of new subnets that are to be advertised to us.

Thanks

Re: Dynamic Routing Anti Spoofing

Maarten_Sjouw — Sat, 08 Jun 2019 18:10:25 GMT

I think you should ask yourself the question here, why are you using External on that interface if you still need to Anti-Spoofing?
In fact an interface set to external with enabled Anti-Spoofing will just use a scheme that says: anything is allowed that is not defined by all other (non External) interfaces.

Re: Dynamic Routing Anti Spoofing

Bryce_Myers — Sun, 09 Jun 2019 14:04:12 GMT

I would agree with Maarten -- You really shouldn't have to define a custom group if you are defining it as an external interface.