anti-spoof problem

[davek23]

Hi,

I have a situation where the management console address has been removed from the topology list of allowed networks on one of our NG firewalls. This happened when the network object was edited for a problem on a different firewall. Now, when I try to install the policy, the install is rejected with the anti-spoof error.

Is there a way to fix this? I have full access to the Nokia Voyager and command line.

Thanks,

Dave

[abusharif]

management modules doesnt happen to be windows/solaris so you can connect from it instead and make change? Maybe go for fw unloadlocal, edit internal interface anti-spoofing configuration, disable anti-spoof checking, add net, install policy, connect again and enable anti-spoof.

[davek23]

Hi,

Thanks for the reply. Just to clarify a bit - this is a Nokia IP firewall running NG. The problem I have is that it is based in Hong Kong, and I am in London. As I understand it fw unloadlocal will also disable routing on the Nokia. Is this correct? I believe I need to:-

1. disable external interface
2. enable routing (how? - "ipsofwd on admin" ?)
3. fw unloadlocal
4. push the policy from the management console with the topology corrected

What I am most worried about is losing connectivity to the Nokia, or getting to a point where I cannot load a policy.

BTW, the firewall has now also stopped logging!

any advice would be greatly appreciated

[RayPesek]

You really don't want to do that. When you push a policy, even if the SmartCenter is behind the firewall, the connection is to the EXTERNAL interface, through the firewall if need be. If you disable the external interface, you're probably hosed.

"fw unloadlocal" is not totally benign because it leaves the enforcement module unable to protect itself. On a Nokia, that's not necessarily bad. On a Windows enforcement module, it's not so good. :-)

Stopped logging? Can you SSH to it and make sure it's not out of disk space? When it can't contact the SmartCenter, it will begin to log locally.

I presume your SmartCenter is behind this firewall?

Ray