Defining a 10.0.0.0/8 Internal Network

[RichUK]

Hi all,

I'm still relatively new to the management of our firewalls so please excuse the basic question, plus the original staff who set it up do not work for us anymore.

Prior to the lockdown, our firewalls were setup with an internal and external bond, with a couple of DMZ's trunked in the internal bond. Our internal network uses an 10x address space, DMZ's 192.168.x etc. There is a static route on the firewall for all 10 addresses to go to our core internal router. The internal interface was setup with a  'Defined By Routes' topology.

For lockdown we needed a VPN solution (our Cisco ASA's were only licences for 750 users) and checkpoint was seen as the quickest way to implement a solution for 3000 users.

The office mode IP range setup with an available subnet in our 10x address space. 

For the VPN clients to work (and also a couple of site-to-sites that also use a 10.x address), I needed to bypass Anti-Spoofing on the external interface using an exclude group with a list of vpn subnets.

In a lab, I have found that the anti-spoofing only detects a spoofed address if there (in our case) is a static route that covers the incoming IP address. For example, I setup a site-to-site to a 172.16.0.0 network on the firewall and there was no need to put an Anti-Spoof bypass with the remote side using a 10 address. I then put a static route on the firewall for that same 172.16 subnet and then my site-to-site was blocked by Anti-Spoofing.

My question is, have we got the interface for our 10.x/8 defined correctly and using the Anti-Spoof disable option correctly for the VPN clients?

Many thanks.

Rich

[Chris_Atkinson]

How did you exclude the office mode range from anti-spoofing since that is the basis for your question ...

[RichUK]

Hi @Chris_Atkinson 

We setup an exclude group and only added the VPN subnets in the exclude site, this was then set in the Anti-Spoofing option for our external interface.

[RichUK]

Sorry, it isn't an exclude group, just a standard group.

[Chris_Atkinson]

Ok thanks, just wanted to check that there wasn't any confusion with the following option.

[RichUK]

hi @Chris_Atkinson 

I have checked the gateway > VPN Clients > Office Mode and Anti-Spoofing is also enabled. Looking at the help it says that if the addresses are allocated from DHCP to add the range here. Therefore, is it best to select the VPN Office Mode IP range in this option and remove the Office Mode range from the external interface? I take it I would still need the networks for the site-to-site's in the external interface Anti-Spoof exclude group.