Hey boys and girls,
Happy weekend!
Here is super simple anti-spoofind/topology script and output from my lab.
[Expert@CP-GW:0]#
[Expert@CP-GW:0]# ./cp_topology_suggestion.sh
Device "erspan0@NONE" does not exist.
Check Point Topology Recommendation (read-only)
Host: CP-GW
Date: Sun Jan 18 14:58:40 EST 2026
Default route: eth0 via 172.16.10.1
Guiding principles used:
• Default-route interface => usually 'External (Internet)' in topology. (Common practice) [3](https://community.checkpoint.com/t5/General-Topics/Gateway-Topolgy-Internal-External-or-DMZ/td-p/178...)
• Internal interfaces:
- One directly-connected subnet only => 'Network defined by interface IP and Net Mask' [2](https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/ZvkmnUK_XluBBIIAw1mF3A2.htm)
- Multiple routed subnets behind => 'Network defined by routes' (dynamic topology) [2](https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/ZvkmnUK_XluBBIIAw1mF3A2.htm)[4](http...)
• Anti-Spoofing enforcement uses interface topology, so wrong topology can cause drops. [1](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...)
----------------------------------------------------------------------------------------------------
Interface State IPv4 Role Recommended 'Leads To' option
----------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------
Next steps (SmartConsole):
1) Gateway > Network Management > Interface > Topology > Modify
2) Apply the recommended 'Leads To' option per interface.
3) Ensure Anti-Spoofing is aligned, because it is enforced based on interface topology. [1](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...)
Reminder:
- 'Network defined by routes' dynamically calculates topology behind the interface (reduces manual updates). [2](https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/ZvkmnUK_XluBBIIAw1mF3A2.htm)[4](http...)
- External is typically the interface used to reach the Internet (default route). [3](https://community.checkpoint.com/t5/General-Topics/Gateway-Topolgy-Internal-External-or-DMZ/td-p/178...)
[Expert@CP-GW:0]#
Best,
Andy
