Antispoofing Detect Bypassing ACL Policy
I have a Checkpoint Cluster in AWS whose external interface topology is defined as
eth0: defined by routes
Antispoofing - Detect
This is due to the fact that some Private IPs are also hitting eth0 for communication hence Antispoofing is set to Dectect.
There is a requirement where i need to allow access to internal web server from a sepcific group of Public IPs only.. the problem is even after restricting it from ACL .. traffic is getting allowed from all over the Internet and the logs for that access is under Action - "Detect" .. some how its not hitting ACL .. is this the expected behaviour ? why is the traffic not hitting ACL when the Anti spoofing is set to Detect..
What precise rules have you configured?
Need a network diagram of the relevant resources and a snapshot of the relevant rules.
The log entries should also tell you precisely what rules are being hit.
The log entries show the source and destination and the action as "Detect" but no acl rule number in these entries.
One thing i would like to point out is that the webserver is natted with the firewall interface ip.. can this be an issue ?
The more precise details you can provide, the more likely we can help.
If you don’t want to share the details publicly, I suggest working with the TAC or your local Check Point SE.