AnsweredAssumed Answered

Monitoring of Anti-Spoofing traffic

Question asked by Jozko Mrkvicka on Aug 18, 2018
Latest reply on Aug 24, 2018 by Valeri Loukine

Like • Show 3 Likes3
Comment • 12

Hello guys,

Is there any way how to monitor anti-spoofing traffic in R77.30 ? I know that I can choose Alert, Log or None in spoofing properties for specific interface. But does someone know how to send for example syslog event in case gateway recognize spoofing traffic ? Or send mail ...

Searching all logs to found "spoofing" word in Information isnt good approach... There must be something on CLI how to check if interface faced spoofing traffic (as it issue log event towards log server).

Thanks for every suggestion in advance.

No one else has this question

Outcomes

12 Replies

Dameon Welch Abernathy Aug 18, 2018 8:18 AM
Mark Correct
Correct Answer
One place you can see anti-spoofing drop packets (albeit not on a specific interface) is cpview.

If you want Alerts to run a script, you can set that in Global Properties (but will apply for anything with Log type set to Alert):

1 person found this helpful
Like • Show 2 Likes2
Actions
- Jozko Mrkvicka @ Dameon Welch Abernathy on Aug 19, 2018 11:56 AM
  Mark Correct
  Correct Answer
  Thanks, I will check that.
  What is default path of that UserDefined script? Or can I use full path of script, like: /var/tmp/testing.sh ?
  Like • Show 0 Likes0
  Actions
  - Dameon Welch Abernathy @ Jozko Mrkvicka on Aug 19, 2018 4:35 PM
    Mark Correct
    Correct Answer
    You can use full path.
    Offhand I am not sure what the default path is for this screen.
    Like • Show 0 Likes0
    Actions
- Jozko Mrkvicka @ Dameon Welch Abernathy on Aug 20, 2018 2:03 PM
  Mark Correct
  Correct Answer
  I was not managed to get it work
  First, I want to test it via specific rule, so I have created new rule with Track: "Alert". My understanding is that the script located in /var/log/test.sh should be executed every time this specific rule is matched.
  
  My settings in Global Properties:
  
  According logs, the specific traffic is matched and I also see Alert in logs. The only problem is that it didnt activate the script.
  
  I also tried to set Track as "UserDefined" and with this setup, the script was executed.
  Is there any way how to do the same just for Alert (as in Anti-spoofing in R77.30 there are only following options available):
  Like • Show 0 Likes0
  Actions
  - Dameon Welch Abernathy @ Jozko Mrkvicka on Aug 20, 2018 7:00 PM
    Mark Correct
    Correct Answer
    As far as I know both of these things should operate exactly the same.
    I would open a TAC case.
    Like • Show 0 Likes0
    Actions
Jozko Mrkvicka Aug 20, 2018 2:23 PM
Mark Correct
Correct Answer
Isnt some stats included in $FWDIR/state/local/FW1/local.set ? How cpview (SecureXL) knows how many packets were dropped because of anti-spoofing ?
Like • Show 0 Likes0
Actions
Valeri Loukine Aug 21, 2018 1:22 AM
Mark Correct
Correct Answer
Look into sk56701, there are some ideas how to make it work. The fact script is not working means there is something wrong with it. Most probably variables.
Like • Show 0 Likes0
Actions
- Jozko Mrkvicka @ Valeri Loukine on Aug 21, 2018 1:05 PM
  Mark Correct
  Correct Answer
  Hi Valeri,
  
  The script is working in case I choose "UserDefined" in Track option for the particular rule.
  In case I want to do the same for "Alert", it will not work.
  
  My script looks like:
  
  My rule looks like (it will not execute script):
  
  This rule will execute the script:
  
  And my Alert settings looks like:
  Like • Show 0 Likes0
  Actions
  - Valeri Loukine @ Jozko Mrkvicka on Aug 24, 2018 1:22 AM
    Mark Correct
    Correct Answer
    That must be true. "Run popup alert script" means the binary is under $FWDIR/bin. If it is not, it is qualified as a "User defined alert"
    Like • Show 0 Likes0
    Actions
Jozko Mrkvicka Aug 21, 2018 1:40 PM
Mark Correct
Correct Answer
Dameon Welch Abernathy Valeri Loukine issue solved with following configuration of Alerts in Global Properties:

So now my final question is:
How can I simulate Address Spoofing for interface eth1.50 with subnet 10.20.30.0/24 to see if this is really working in case I will select Alert in Anti-Spoofing Tracking option ?

NOTE: I am running internal LAB in VMware, so I can do (almost) everything
1 person found this helpful
Like • Show 0 Likes0
Actions
- Dameon Welch Abernathy @ Jozko Mrkvicka on Aug 21, 2018 3:40 PM
  Mark Correct
  Correct Answer
  Create a VM with the desired address and try to ping "through" the firewall?
  You'll probably have to muck with the routing/ARP tables to make it work right.
  Like • Show 1 Like1
  Actions
- Valeri Loukine @ Jozko Mrkvicka on Aug 22, 2018 1:44 AM
  Mark Correct
  Correct Answer
  easy, configure anti-spoofing manually and exclude some parts of your network attached to this interface. Link, instead of /24 do less than that.
  Like • Show 0 Likes0
  Actions

Monitoring of Anti-Spoofing traffic

Outcomes

Related Content

Recommended Content