Anti-spoofing set to "detect" on internal interface recommendation.

[khodgson_bts]

Afternoon all.

I've just come off a call with a Check Point TAC support person related to a ticket raised for odd behaviour of anti-spoofing. The TAC person spent a good portion of the call trying to convince me that it is Check Point recommended best practice to have anti-spoofing on internal interfaces set to "detect" instead of "prevent", although when challenged they couldn't point me to any official documentation to that effect.

I've been working with Check Point products since 2006 and this is first time I'm hearing this claim. Anyone else heard this before?

[Lesley]

Prevent is the correct way. Detect is noted in documentation as following (R81)

• Anti-Spoofing action is set to - Select this option to define if packets will be rejected (the Prevent option) or whether the packets will be monitored (the Detect option). The Detect option is used for monitoring purposes and should be used in conjunction with one of the tracking options. It serves as a tool for learning the topology of a network without actually preventing packets from passing.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

[Chris_Atkinson]

Prevent is both common & best practice.

There are exceptions and without further context of the issue / circumstances involved it's difficult to comment further.