RE: Anti-spoofing Problem

In your example you have very sensibly replaced the address with x.x.


So I'm stabbing in the dark here but

If (for example) these addresses are :

10.2.0.1

And 

10.250.0.10

And you have defined your internal network as 10.0.0.0 255.0.0.0 then
checkpoint will think that return traffic from the router is being
spoofed because it sees as 10. addresses as being internal.

Hope this makes sense.

Andy

-----Original Message-----
From: NAVTEJ KOHLI [mailto:tonavtejkohli@hotmail.com] 
Sent: 10 September 2004 22:23
To: firewalls@securityfocus.com
Subject: Anti-spoofing Problem

Hello Friends,

I'm running FP3 on solaris . My Network is like this :

Internal Networks <--> Firewall <--> Router <--> Internet

Now the Problem Part:-
When I try to access router from Internal Network , it never connect,
Even 
from the firewall ..same problem. The packets drop from the firewall.
In the firewall log, I found these message :

Internal Net   Action     Service    Source    Destination   Info
eth0            drop       telnet     x .x.0.10  x.x.0.1    message_info

address
spoofing

In Topology for Eth0 on the firewall is defined as External (leads out
to
the internet), with "Perform Anti-Spoofing based on interface topology"
checked.

Thanks in advance,

NAVTEJ KOHLI

_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail