topic Re: A simple question on Anti-spoofing ? in General Topics

A simple question on Anti-spoofing ?

Firewall_Head — Sun, 09 Mar 2025 16:54:00 GMT

Hi Checkmates,

First, please have a look at the snap of my topology.
1> When I try to take SSH of the interface eth2 from PC1, why am I not denied the access by anti-spoofing, because I come with a different IP (10.10.10.10) to eth2 interface.

2> Will my request get internally routed within the Check Point GW and get accepted ?

Can somebody help me with my simple question.

Thanks in advance !

======

WR,

Re: A simple question on Anti-spoofing ?

Alex- — Sun, 09 Mar 2025 17:19:39 GMT

You come from eth1 with subnet 10.10.10.0/24 with an IP in that range, so anti-spoofing won't block you there.

The access control policy could allow or block you.

Anti-spoofing, depending how it's configured, will check the validity of the source IP incoming on any given interface, to put it simply.

Eth2 would perform anti-spoofing if you came in with 10.10.10.10 as source on that interface if you choose to match interface IP and range for instance.

Re: A simple question on Anti-spoofing ?

Firewall_Head — Sun, 09 Mar 2025 17:38:23 GMT

Thanks for the reply @Alex- ,

So how many times is the traffic inspected at the firewall, won't it check the SRC IP is 10.10.10.10 and the DST is 20.20.20.0/24 and block it.

Can you put this step by step please ?

====

WR,

Re: A simple question on Anti-spoofing ?

Timothy_Hall — Sun, 09 Mar 2025 17:41:48 GMT

See here:

A Primer on Anti-spoofing

Re: A simple question on Anti-spoofing ?

the_rock — Mon, 10 Mar 2025 01:33:03 GMT

Hey brother,

@Alex- is 100% right. Btw, check below, I find its basic, but an EXCELLENT reference.

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Preventing-IP-Spoofing.htm