Firewall Antispoofing

[Vanesa_Benito_O]

Hello!!

I find a problem deploying a new gateway in R81.20 (open server), and i hope someone could help me. 

The management and the firewall are in different subnets. I have permormed a fw unloadlocal in the gateway before the SIC initialization process, but I have notice every traffic from remote networks are dropped by antispoofing even when the routes are well configured and I have dissabled the policy in the firewall. 

Anybody knows if there is any way to disable this antispoofing protection?

 Best regards!

[the_rock]

Yes, but dont do that, UNLESS its Check Point in Azure, then it has to be disabled. This is where you modify it, make sure its set per route setting, as that automatically updates it, OR as long as group defined is correct.

Best,

Andy

 

[Tal_Paz-Fridman]

To disable Anti-Spoofing either completely or partly just edit the relevant interface in SmartConsole:

1. In SmartConsole, from the left navigation panel, click Gateways & Servers.
2. Open the Security Gateway / Cluster object.
3. From the left, click Network Management.
4. Right-click on the interface and click Edit.
5. From the left, click the General page.
6. In the Topology section, click Modify.

[the_rock]

Good reference

Interface - Topology Settings (checkpoint.com)

Understanding Topology

An interface can be defined as being External (leading to the Internet) or Internal (leading to the LAN).

The type of network that the interface Leads To:

• Internet (External) or This Network (Internal) - This is the default setting. It is automatically calculated from the topology of the gateway. To update the topology of an internal network after changes to static routes, click Network Management > Get Interfaces in the General Properties window of the gateway.

• Override - Override the default setting.

If you Override the default setting:

• Internet (External) - All external/Internet addresses

• This Network (Internal) -

  • Not Defined - All IP addresses behind this interface are considered a part of the internal network that connects to this interface

  • Network defined by the interface IP and Net Mask - Only the network that directly connects to this internal interface

  • Network defined by routes - The gateway dynamically calculates the topology behind this interface. If the network changes, there is no need to click "Get Interfaces" and install a policy.

  • Specific - A specific network object (a network, a host, an address range, or a network group) behind this internal interface

  • Interface leads to DMZ - The DMZ that directly connects to this internal interface

[AmirArama]

If your issue is that you can't initiate SIC or install the policy because of Anti spoofing drop and you can't change your antispoofing configuration and push policy because of that, and you want to disable it on the fly from cli temporaty 

Try: 

fw ctl set int fw_antispoofing_enabled 0

[the_rock]

EXCELLENT idea!

Best,

Andy

[Vanesa_Benito_O]

This is exactly my issue! But I tried to do that follow the sk117618, But it didnt works! 

The version metioned in these SK is from R77.20 to R80.40. Maybe this is the issue. I dont know in the newest version there is another way to perform this action.

[AmirArama]

So you ran: fw ctl set int sim_anti_spoofing_enabled 0 -a

And turn off and on fwaccel As well?

If you reset SIC in the Gw side after the cprestart do you still have drops?

[Vanesa_Benito_O]

I try to execute this command, but it dont work

I havent reset the sic because i didnt perform the SIC in the first place. I dont know if the antispoofing is something configured in smartconsole why is affected the traffic if the firewall hasnt policy installed...

[AmirArama]

Yes its configured in gw object in smart dashboard. Are you saying it's fresh installed gw that never had sic or policy installed before, and still drop traffic on anti spoofing?

[Vanesa_Benito_O]

mm not really. I need to change the interface configuration of this firewall. So I perform the following steps

1. Clear the trust between Management and firewall (Because the new trust will be initialized in other interface)

2. cpconfig and restablish SIC password in the gateway.

3. Change the network interface and routing configuration. (An new router is added between Management and firewall)

4. I perform a fw unloadlocal (In this point I think i dont have to be worried about antispoofing) But for any not understandeble reason, it still affected traffic.

5. Try to ininitalize again the SIC. 

[AmirArama · Accepted solution]

Yes, i double checked it on my R81.20 GW now, 

try the following commands by this order:

 fwaccel off
 fw ctl set int fw_antispoofing_enabled 0
 fwaccel on

verify it set to 0 by:

 fw ctl get int fw_antispoofing_enabled

try to initiate SIC now

P.s fw unloadlocal don't unload the antispoofing configuration

[Vanesa_Benito_O]

Thanks!! Maybe I didnt perform the commands in the correct order! 😄

[the_rock]

Technically, turning off securexl would not have anything to do with anti-spoofing. I would double check you have it set correctly if its in production.

Best,

Andy