Antispoofing

[vadi_ag]

Hi All ,
In our environment i can see a group defined for antispoofing and i keep on adding hosts and subntes to this group so that packets from these shud not get dropped however the issue is when i open topology and check i dont find any antispoofing defined under interfaces we are using provider-1 R60 i have a doubt of access level is this possible to setup access like this so that only preveliged users can see/view the details under topology section.
i have come accross many situations where in if i forget to add any host/subnet in antispoofing group then these will get dropped

pls help me in understanding how this is setup i have tired to check in help topics but i cud not find one

regards
vadi

[mcnallym]

There is no permissions profile that would allow you to read the objects database but not see the topology for the gateway. You wouldn't even be able to view the gateway to see that the anti-spoofing is not configured.

If you can access the objects and make changes you should be able to see the topology that is configured upon the check point gateway, as you would need read write access to the objects database to do this, and this would allow you to make changes to the interface information.

I believe from your description that there is a group called anti-spoofing but that the group is not actually defined on the gateway as being used with the interface

I would guess that anti-spoofing has been turned off on your check point gateway.

If you have network routing correctly configured correctly on your gateway then you should be able to do a Get Interfaces with Topology within the gateway object and that will correctly read the routing table to implement anti-spoofing based on your routing table.

[vadi_ag]

thnx a lot for ur reply
however we have TAACAS enabled for authentication with RSA tokens is there any possibilities for setting up this type of permissions on TACACS ?

If antispoofing is turned off on the gateway then why the packets are getting dropped if i dont add those in antispoofing group ?

Regards
Vadi

[mcnallym]

It could be then that anti-spoofing is enabled but just that the group is not associated with any of the interfaces. I reckon your best bet is to do a get interfaces with topology and then look at the groups associated with the interfaces on the gateway.

[MarioL]

Also check what rule they are being dropped by, Anti-spoofing is listed as rule 0.

Anyway, you REALLY should have the anti-spoofing configured. Just do as mcnallym says, get topology and then configure the interfaces, etc.

Remember you must push the policy for the changes to apply.

[light]

hi,

You have to enable antispoofing on the interface and thats typically applied on the standalone art.

thanks and regards

[vadi_ag]

Hi All ,
thnx a lot for ur responses i got the details of antispoofing thnx again

I was not checking under the details under cluster members

so now i got it