topic Re: Bypass Address Spoofing for a Specific Protocol in Firewall and Security Management

Bypass Address Spoofing for a Specific Protocol

Solkah — Wed, 21 May 2025 15:04:27 GMT

Hi all,

I am receiving a lot of detect logs in the firewall caused by the bootp protocol. The problem is that the APs ask for an IP address for the clients using the same interface in which they ask for their own IP address (although they are different networks).

I know I can disable address spoofing for specific networks in the "Gateways and Servers" section but I can´t find anything similar for protocols. I also have thought about using fast_accel but I am not sure if this would work since address spoofing is checked before firewall rules are applied.

So, all in all, Is there any way to bypass the address spoofing check for the bootp protocol?

Thank you!

Re: Bypass Address Spoofing for a Specific Protocol

_Val_ — Wed, 21 May 2025 15:29:26 GMT

Firstly, why do you need to do that in the first place?

Also, I don't believe it is possible to bypass antispoofing for some of the traffic but not all the rest.

Finally, please see if you can find your case and resolution in this SK: https://support.checkpoint.com/results/sk/sk104114

Re: Bypass Address Spoofing for a Specific Protocol

Lesley — Wed, 21 May 2025 16:55:02 GMT

bootp is a legacy service so i suspect you configured dhcp incorrectly. Also bypass anti-spoofing with only a service like bootp is not possible. AS is based on IP's / networks. What port is used is not relevant for this feature

Re: Bypass Address Spoofing for a Specific Protocol

Wolfgang — Wed, 21 May 2025 20:22:13 GMT

@Solkah if both networks, the APs network and the clients network are behind the same interface of your gateway you have to configure both networks for this interface in the AntiSpoofing settings.

Re: Bypass Address Spoofing for a Specific Protocol

the_rock — Wed, 21 May 2025 21:29:30 GMT

Interesting question...personally, never heard of such a thing being feasable, but maybe you can verify with TAC.

Andy

Re: Bypass Address Spoofing for a Specific Protocol

Timothy_Hall — Thu, 22 May 2025 12:17:35 GMT

Pretty sure this is not possible, and using fact_accel will not help since SecureXL/sim enforces antispoofing directly on SND's.