Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
prisciltetchou1
Explorer

strange address spoofing on standby firewall

Hello, 

Please I need an explanation to a behavior noticed when we are having address spoofing. 

We have a cluster of 2 firewalls in HA mode (active/standby). 

There is a traffic that is dropped because of address spoofing, the strange think is that the spoofed traffic is passing through the standby firewall instead of the active one. 

Is it normal? If yes, why is it not the active firewall that should drop a spoofed traffic? 

Thanks in advance for your help. 

0 Kudos
3 Replies
PhoneBoy
Admin
Admin

If whatever is sending the spoofed traffic is using the MAC address of the backup gateway, then the backup will drop and log the traffic.
You’d have to take some packet captures on the gateway to determine if this is happening.

0 Kudos
the_rock
Legend
Legend

Phoneboy is correct. Do some packet captures and figure out why this might be happening...is HA status if you run cphaprob state showing correct state on both members? Can you attach screenshots showing the actual drop and how thats configured in topology in dashboard (you can blur out the IP addresses).

0 Kudos
Timothy_Hall
Legend Legend
Legend

Specifically use the -e option for tcpdump or -D option for cppcap which will show you the Layer 2 MAC addresses; these options are covered in my Max Capture course.  You will need to look at the source MAC address to see where the spoofed packet is coming from, and may need to trace it back through your switching/routing infrastructure to see where it is actually originating.  

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events