Local interface address spoofing

[b1tbuck3t]

Hello, I am receiving a drop on http request coming back from www.gotomypc.com . The information tab on the error from the tracker states( : Local interface address spoofing ) I am kind of confused why it is triggering on this website/network, all other www. request are normal? Its a nokia running r55, Any ideas

[RobertGraham]

Maybe you could post some info on your config for that interface and the log entry. I'll be glad to post a response on that when I have more information.

[kva.kva]

Ensure that all network interfaces are up and running. Which HFA do you use?

[b1tbuck3t]

The current config on this box is a two interface fw. 1 public and 1 private address. The anti spoofing drop message is being flagged on the inside address/interface (192.x.x.x). For logs I am just using the smart tracker tool, it is accressed through an NT smart management station and triggering/filtering on the destination (www.gotomypc.com) http request.

I was looking at the Topology tab on the local interface and the antispoofing feature is checked and it is set as (internal leads to the local network) and (the specific address is selected (192.x.x.x)). Logging box is also checked.

I also tried specifying a network range for this web address in the rule base to see if I could get the return http traffic from being blocked as spoofing. It kept getting dropped as spoofed traffic.

HFA in checkpoint is that the hot fix info you are looking for? Can I find that throughthe smartdashboard set of tools or where is the info located on the nokia linux box?

What exact logs are you referring to?

Thanks

[Lackie]

You shouldn't see the return traffic showing up in the tracker especially on the internal interface. Looking at the drop in tracker, what direction is the arrow pointing in the interface column? What is the source and destination IP's in that drop?

[melipla]

Make sure your SmartDefense isn't enabled for this website:

SmartDefense -> Application Intelligence -> Remote Control Applications -> Block GoToMyPC

HTH