topic Re: Anti-Spoofing option "Don't check packets from" is greyed out in General Topics

Anti-Spoofing option "Don't check packets from" is greyed out

L3on — Fri, 07 Feb 2025 10:28:46 GMT

Hello mates,

Does anybody have any idea about why the AntiSpoofing option "Don't check packets from" is greyed out?

How can I enable this option? It is selectable only in External interfaces, but not in the Internal ones.

Screenshot included taken from a cluster object interface...

* Quantum Security Gateways version: R81.20 JHF Take 89

Re: Anti-Spoofing option "Don't check packets from" is greyed out

G_W_Albrecht — Fri, 07 Feb 2025 13:41:51 GMT

This is only possible when Internet (External) is chosen as interface. Makes sense.

Re: Anti-Spoofing option "Don't check packets from" is greyed out

AkosBakos — Fri, 07 Feb 2025 12:29:44 GMT

Hi @L3on

If you uncheck the "Specify Security Zone", then you will be able to select "Don't check packet from:"?

Hm, same here, intereting:

Akos

Re: Anti-Spoofing option "Don't check packets from" is greyed out

Lesley — Fri, 07 Feb 2025 13:28:04 GMT

This option is only for external interfaces:

Don't check packets from - Select this option to make sure anti-spoofing does not take place for traffic from internal networks that reaches the external interface. Define a network object that represents those internal networks with valid addresses, and from the drop-down list, select that network object. The anti-spoofing enforcement mechanism disregards objects selected in the Don't check packets from drop-down menu.

Re: Anti-Spoofing option "Don't check packets from" is greyed out

AkosBakos — Fri, 07 Feb 2025 13:39:14 GMT

Ohh, I think you want to do this. I misleaded myself 🙂

Tipical transit LAN settigs...

Akos

Re: Anti-Spoofing option "Don't check packets from" is greyed out

AkosBakos — Fri, 07 Feb 2025 13:42:30 GMT

@L3on do you want to create transit LAN?

Re: Anti-Spoofing option "Don't check packets from" is greyed out

L3on — Fri, 07 Feb 2025 14:24:05 GMT

Actually, the CheckPoint firewall is at the edge of the topology, through which several networks access the internet.
Those networks are behind another (internal) firewall and are NATed by this CheckPoint firewall.