topic Re: How to check if Anti-Spoofing is enabled and set to Prevent mode for each interface on CLI? in API / CLI Discussion

How to check if Anti-Spoofing is enabled and set to Prevent mode for each interface on CLI?

Danny — Thu, 11 Apr 2019 13:14:44 GMT

Which CLI command will let me know if each interface has Anti-Spoofing enabled and set to Prevent mode?
This command is not specific enough:

fw ctl get int fw_antispoofing_enabled

Re: How to check if Anti-Spoofing is enabled and set to Prevent mode for each interface on CLI?

Timothy_Hall — Thu, 11 Apr 2019 13:52:16 GMT

I don't believe there is a way to pull this information directly out of the running kernel, but the cached policy INSPECT files on the gateway can be queried for this info using this tool:

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/Show-Address-Spoofing-Networks-via-CLI/m-p/38776

Re: How to check if Anti-Spoofing is enabled and set to Prevent mode for each interface on CLI?

PhoneBoy — Fri, 12 Apr 2019 01:28:49 GMT

That kernel variable just tells you that it's been disabled in the kernel. You need to query the actual installed policy to see if it's really enabled or not.

Re: How to check if Anti-Spoofing is enabled and set to Prevent mode for each interface on CLI?

Danny — Wed, 17 Apr 2019 17:21:27 GMT

Thanks. This command will easily show if there is at least one interface not running in Prevent mode:

grep ":monitor_only (true)" $FWDIR/state/local/FW1/local.set

and this command shows if there is at least one interface that has Anti-Spoofing disabled:

grep ":has_addr_info (false)" $FWDIR/state/local/FW1/local.set

I also added these checks to our ccc script.