strange address spoofing on standby firewall

[prisciltetchou1]

Hello, 

Please I need an explanation to a behavior noticed when we are having address spoofing. 

We have a cluster of 2 firewalls in HA mode (active/standby). 

There is a traffic that is dropped because of address spoofing, the strange think is that the spoofed traffic is passing through the standby firewall instead of the active one. 

Is it normal? If yes, why is it not the active firewall that should drop a spoofed traffic? 

Thanks in advance for your help. 

[PhoneBoy]

If whatever is sending the spoofed traffic is using the MAC address of the backup gateway, then the backup will drop and log the traffic.
You’d have to take some packet captures on the gateway to determine if this is happening.

[the_rock]

Phoneboy is correct. Do some packet captures and figure out why this might be happening...is HA status if you run cphaprob state showing correct state on both members? Can you attach screenshots showing the actual drop and how thats configured in topology in dashboard (you can blur out the IP addresses).

[Timothy_Hall]

Specifically use the -e option for tcpdump or -D option for cppcap which will show you the Layer 2 MAC addresses; these options are covered in my Max Capture course.  You will need to look at the source MAC address to see where the spoofed packet is coming from, and may need to trace it back through your switching/routing infrastructure to see where it is actually originating.