How to check if Anti-Spoofing is enabled and set to Prevent mode for each interface on CLI?

[Danny]

Which CLI command will let me know if each interface has Anti-Spoofing enabled and set to Prevent mode?
This command is not specific enough:

fw ctl get int fw_antispoofing_enabled

[Timothy_Hall]

I don't believe there is a way to pull this information directly out of the running kernel, but the cached policy INSPECT files on the gateway can be queried for this info using this tool:

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/Show-Address-Spoofing-Networks-vi...

[PhoneBoy]

That kernel variable just tells you that it's been disabled in the kernel. You need to query the actual installed policy to see if it's really enabled or not.

[Danny]

Thanks. This command will easily show if there is at least one interface not running in Prevent mode:

grep ":monitor_only (true)" $FWDIR/state/local/FW1/local.set

and this command shows if there is at least one interface that has Anti-Spoofing disabled:

grep ":has_addr_info (false)" $FWDIR/state/local/FW1/local.set

I also added these checks to our ccc script.