topic Re: Internal firewall anti-spoofing in General Topics

Internal firewall anti-spoofing

Jessie_Rich — Fri, 16 Aug 2019 16:49:32 GMT

I have 2 networks separated by a firewall and then a internet facing firewall. I am getting anti-spoofing alerts on traffic passing through my internal firewall from the internet.

Topology looks something like this

Network-A >>> InternalFW >>>> Network-B >>>>> internetFW >>>>>> Internet

On the Network-B facing interfaces on both firewalls I have only my Network-B networks defined in the topology. I assume on the InternalFW I need to add the internet to the topology on the interface connected to Network-B?

To not mess up anti-spoofing on the internetFW I assume I would create separate network groups for my topology on the internal and internet firewalls?

Thank you for any advice you can give.

Re: Internal firewall anti-spoofing

PhoneBoy — Fri, 16 Aug 2019 20:22:03 GMT

You are correct, topology for InternalFW's interface on Network-B should be Internet.
For InternetFW, the topology for the interface on Network-B should also include Network-A.

Re: Internal firewall anti-spoofing

Jessie_Rich — Fri, 16 Aug 2019 20:35:58 GMT

So before I make any changes the topology would look like ...

InternalFW Network-B side, (Network-B nets, Internet)

InternetFW Network-B side, (Network-A nets, Network-B nets)

Thank you,

Re: Internal firewall anti-spoofing

PhoneBoy — Sat, 17 Aug 2019 20:04:51 GMT

"Internet" means "anything not defined on the other interfaces" so you do not need to include Network-B nets there.

Re: Internal firewall anti-spoofing

Kevin_Orrison — Thu, 19 Sep 2019 20:20:48 GMT

So does that mean the interface on the internal FW going to network B is essentially an internal and external interface? In this circumstance, is there even a need for a dedicated external interface?

Re: Internal firewall anti-spoofing

PhoneBoy — Fri, 20 Sep 2019 14:54:19 GMT

Even if not directly connected to the Internet, if the Internet can potentially be reached through an interface, it should be marked as external.