Traffic drop due to antispoofing- R80.10

[Lijo_mathai]

Hi, due to some reason the traffic to one of my remote site is being dropped by checkpoint gateway which is R80.10. Checking the logs shows traffic dropped due to anti spoofing. Checking the interface  config i can see the destination traffic IP is no where in the interface config on the gateways. What is causing this?

Also when i try to ping that IP from my internal host i get a TTL expired response from the checkpoint interface. Is this a known issue or am i missing anything

[Danny]

One-Liner for Address Spoofing Troubleshooting

One-liner to show VPN topology on gateways

[Claudiu3]

  I got a similar issue, it was a routing issue. I had a routing loop. On checkpoint, the return route to your my source ip is not on the same interface the packets arrived. I say, either get rid of the routing loop or use the anti spoofing exception list on the interface.