Anti-Spoofing option "Don't check packets from" is greyed out

[L3on]

Hello mates, 

Does anybody have any idea about why the AntiSpoofing option "Don't check packets from" is greyed out? 

How can I enable this option? It is selectable only in External interfaces, but not in the Internal ones. 

Screenshot included taken from a cluster object interface... 

* Quantum Security Gateways version: R81.20 JHF Take 89 

[G_W_Albrecht · Accepted solution]

This is only possible when Internet (External) is chosen as interface. Makes sense.

[AkosBakos]

Hi @L3on 

If you uncheck the  "Specify Security Zone", then you will be able to select "Don't check packet from:"?

Hm, same here, intereting:

Akos

[Lesley · Accepted solution]

This option is only for external interfaces:

• Don't check packets from - Select this option to make sure anti-spoofing does not take place for traffic from internal networks that reaches the external interface. Define a network object that represents those internal networks with valid addresses, and from the drop-down list, select that network object. The anti-spoofing enforcement mechanism disregards objects selected in the Don't check packets from drop-down menu.

[AkosBakos]

Ohh, I think you want to do this. I misleaded myself 🙂 

Tipical transit LAN settigs...

Akos

[AkosBakos]

@L3on do you want to create transit LAN?

[L3on]

Actually, the CheckPoint firewall is at the edge of the topology, through which several networks access the internet. 
Those networks are behind another (internal) firewall and are NATed by this CheckPoint firewall.