Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
khodgson_bts
Contributor

Anti-spoofing set to "detect" on internal interface recommendation.

Afternoon all.

I've just come off a call with a Check Point TAC support person related to a ticket raised for odd behaviour of anti-spoofing. The TAC person spent a good portion of the call trying to convince me that it is Check Point recommended best practice to have anti-spoofing on internal interfaces set to "detect" instead of "prevent", although when challenged they couldn't point me to any official documentation to that effect.

I've been working with Check Point products since 2006 and this is first time I'm hearing this claim. Anyone else heard this before?

0 Kudos
2 Replies
Lesley
Leader Leader
Leader

Prevent is the correct way. Detect is noted in documentation as following (R81)

  • Anti-Spoofing action is set to - Select this option to define if packets will be rejected (the Prevent option) or whether the packets will be monitored (the Detect option). The Detect option is used for monitoring purposes and should be used in conjunction with one of the tracking options. It serves as a tool for learning the topology of a network without actually preventing packets from passing.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

 

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
Chris_Atkinson
Employee Employee
Employee

Prevent is both common & best practice.

There are exceptions and without further context of the issue / circumstances involved it's difficult to comment further.

CCSM R77/R80/ELITE
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events