Simple fw topology script

the_rock — Sun, 18 Jan 2026 20:02:42 GMT

Hey boys and girls,

Happy weekend!

Here is super simple anti-spoofind/topology script and output from my lab.

[Expert@CP-GW:0]#
[Expert@CP-GW:0]# ./cp_topology_suggestion.sh
Device "erspan0@NONE" does not exist.
Check Point Topology Recommendation (read-only)
Host: CP-GW
Date: Sun Jan 18 14:58:40 EST 2026
Default route: eth0 via 172.16.10.1

Guiding principles used:
• Default-route interface => usually 'External (Internet)' in topology. (Common practice) [3](https://community.checkpoint.com/t5/General-Topics/Gateway-Topolgy-Internal-External-or-DMZ/td-p/178349)
• Internal interfaces:
- One directly-connected subnet only => 'Network defined by interface IP and Net Mask' [2](https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/ZvkmnUK_XluBBIIAw1mF3A2.htm)
- Multiple routed subnets behind => 'Network defined by routes' (dynamic topology) [2](https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/ZvkmnUK_XluBBIIAw1mF3A2.htm)[4](https://community.checkpoint.com/t5/Security-Gateways/Network-Defined-by-Routes-Anti-Spoofing/td-p/154653)
• Anti-Spoofing enforcement uses interface topology, so wrong topology can cause drops. [1](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Preventing-IP-Spoofing.htm)
----------------------------------------------------------------------------------------------------
Interface State IPv4 Role Recommended 'Leads To' option
----------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------
Next steps (SmartConsole):
1) Gateway > Network Management > Interface > Topology > Modify
2) Apply the recommended 'Leads To' option per interface.
3) Ensure Anti-Spoofing is aligned, because it is enforced based on interface topology. [1](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Preventing-IP-Spoofing.htm)

Reminder:
- 'Network defined by routes' dynamically calculates topology behind the interface (reduces manual updates). [2](https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/ZvkmnUK_XluBBIIAw1mF3A2.htm)[4](https://community.checkpoint.com/t5/Security-Gateways/Network-Defined-by-Routes-Anti-Spoofing/td-p/154653)
- External is typically the interface used to reach the Internet (default route). [3](https://community.checkpoint.com/t5/General-Topics/Gateway-Topolgy-Internal-External-or-DMZ/td-p/178349)
[Expert@CP-GW:0]#

topic Simple fw topology script in General Topics

Simple fw topology script