How do I define Anti-Spoofing for an Enforcement Module with one interface?

[BarryStiefel]

How do I define Anti-Spoofing for an Enforcement Module with one interface?



We have here a sun solaris server installed with a firewall NG module. This server is a proxy and the module is installed on it to give it more protection. Since this machine has only one interface i suppose that i have to choose the External option.

The mgmt station has a complete different ip address but my fear is that if i configure the anti-spoofing with the external option, will i still be able to contact the machine? I would be in bad shape when the machine would refuse any connection after configuring the anti-spoofing. Is there any fall back procedure if this doesn't work?



Answer In regard to fixing a policy configuration mistake, the answer is simple: unload the policy and repush one that works. Repeat as necessary.



To do this, use the command "fw unloadlocal." Then, reconfigure the policy and push it. Voila!

You shouldn't even have this under the above circumstances because: "In general, you can communicate to a firewall module via any one of its interfaces provided the connection would be allowed by the global properties or rulebase as well as the topology settings. Since antispoofing is basically "anything" in the case of a single interface, it should work."

To get back to the real question at hand, how to configure Anti-Spoofing on a module with one interface...this setup is actually pathological. Phoneboy explains in below: "Antispoofing on a single-interfaced platform seems kind of silly because except in the case where there isn't a default route, any IP address coming into that interface could potentially be valid." So, you really don't need to have Anti-Spoofing set.

However, the original author of the question was interested in getting rid of the bothersome warnings at every policy push. To do this, convert the host from a gateway to a node. In the FW-1 GUI, highlight the enforcement point object of the proxy, right-click and select "Convert to Host" option.



-- RobertGraham - 02 Feb 2004

FAQForm FAQs.Class: RemoteManagementFAQs, TroubleshootingFAQs FAQs.OS: FAQs.Version: