topic Re: VSX anti-spoofing DETECT behavior question in Firewall and Security Management

VSX anti-spoofing DETECT behavior question

Balint_Elteto — Wed, 06 Mar 2019 11:33:15 GMT

Hello Everyone!

I'm wondering, is there someone, who already face the following issue with r77.30 VSX:

I set an interface anti-spoofing of a VS to DETECT, because I had many drops and have no time to set all the routings.

However the traffic is still not went through the firewall as it should be, but in the tracker, I saw the detect events.

So I had to completely turned off the ants-spoofing protection on that interface, then all is good.

What do you think, this is a bug, an undocumented feature or just I missed something in the official documentation?

Thx for the answers!

Balint

Re: VSX anti-spoofing DETECT behavior question

Kaspars_Zibarts — Wed, 06 Mar 2019 14:44:35 GMT

Is it possible that traffic passed multiple VSes and/or interfaces so it was dropped somewhere else by spoofing? And when you disabled spoofing completely it covered missing interfaces?

In any case - instead of trying to fix this detect issue I would rather spend time to fix routing and spoofing

You know that you can use automatic spoofing calculation based on existing routing?

Re: VSX anti-spoofing DETECT behavior question

Balint_Elteto — Thu, 07 Mar 2019 12:11:00 GMT

Thanks for the answer!

No other vs/interface involved. Also I see the traffic with DETECT action in the tracker.

Just not arrives to the destination.

Of course, my plan is to correct the routing for sure. But it was a strange behavior which surprised me and cause some uncomfortable hours.

I'm using the auto cal on every VS with prevent settings. But there were lot of routes missing and the "set to detect" was the fastest solution to my problem.

btw, the interface is a wrp to a virtual switch. Maybe that had something do with this.

Re: VSX anti-spoofing DETECT behavior question

Kaspars_Zibarts — Thu, 07 Mar 2019 21:08:39 GMT

Probably silly question but I assume that pushed both topology and policy after you set spoofing to detect mode? I'm still confused how it failed to work correctly when you have tooiloto set to automatic. Sounds really strange.

Re: VSX anti-spoofing DETECT behavior question

Balint_Elteto — Fri, 08 Mar 2019 07:17:16 GMT

I pushed the policy.

Anyway, when I'll have more time to play, I'll set up a test VS on this vsx cluster and do some test/troubleshoot.

Maybe this was some mysterious event, which will never come up again.

Thx for your notes