My guess would be that you are doing NATing and have not included the
external IP address on your internal interface's topology (hence spoofing).
Look at the topology settings for your firewall and make sure you are
including all addresses you are NATing.
Steve
"Schroeer, Waldemar"
<[EMAIL PROTECTED]> To: [EMAIL PROTECTED]
Sent by: Mailing list for cc:
discussion of Firewall-1 Subject: [FW-1]
<[EMAIL PROTECTED]
KPOINT.COM>
05/07/2004 09:19 AM
Please respond to Mailing list
for discussion of Firewall-1
Hi All,
in the last 2 weeks i encounter a rising number of icmp packets hitting my
firewall, which results in the following errors. the first icmp packet is
coming to qfe0, the external nic of firewall, and is accepted by a
corresponding rule. at the same time a icmp packet, with exactly same
destination and source as the previous icmp packet, is coming to hme1, the
internal nic of firewall, and gets dropped. can someone explain what is
happening. the following are the two log entries.
the firewall is Sparc based and running Solaris 9/64bit with CP NG R55.
Number: 351248
Date: 7May2004
Time: 14:23:36
Product: VPN-1 & FireWall-1
Interface: qfe0
Origin: eukey004 (10.128.11.2)
Source: L0626P05.dipool.highway.telekom.at (62.46.142.37)
Destination: ZZ__extIP_xx.xx.88.190 (xx.xx.88.190)
Protocol: icmp
Action: Accept
Type: Log
Rule: 1
Information: ICMP: Echo Request
ICMP Type: 8
ICMP Code: 0
Number: 351249
Date: 7May2004
Time: 14:23:36
Product: VPN-1 & FireWall-1
Interface: hme1
Origin: eukey004 (10.128.11.2)
Source: L0626P05.dipool.highway.telekom.at (62.46.142.37)
Destination: ZZ__extIP_xx.xx.88.190 (xx.xx.88.190)
Protocol: icmp
Action: Drop
Type: Log
Rule:
Information: ICMP: Echo Request
ICMP Type: 8
ICMP Code: 0
message_info: Address spoofing
regards
waldemar
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
