Solved

Dell Sonicwall - IP Spoof Detection

Posted on 2014-11-17
1
906 Views
Last Modified: 2016-11-23
The Setup:
Sonicwall NSA 4500
X0 LAN
X1 ISP#1
X2 ISP#2
X3 SAN network
X4 ISP #3
x5 ISP #5

X1-2 are actually the same ISP, but just have a disjoint subnet with static IP's in compeltely different ranges.  These two interfaces connect to a small switch and up to the ISP (radio based)

x5 ISP #4 is business class cable for browsing the internet.  No static IPs.

X4 ISP #3 - New ISP via fiber with a ton of static IP's.  

Here's my issue.   Only on the new X4 (ISP #3) - Any time I setup a NAT (either 1-2-1 or port based) and my firewall rules, nothing works.  Went as far as directly attaching a laptop to the carrier's handoff and assigning a static IP and it works.  

After some looking around, I am getting
Intrusion prevention    IP Spoof Dropped   <source> <destiantion>  mac: <MAC of the carriers router>


I can resolve this by turning off IP spoof detection on the "hidden" daiag page - but I'd really a)Not like to have to do that b) Have this work as planned.  

Thoughts?
0
Comment
Question by:JamesonJendreas
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 25

Accepted Solution

by:
Diverse IT earned 500 total points
ID: 40480147
Hi JamesonJendreas,

Exclude the MAC addresses in IPS under Configure IPS Settings.

1. Create Address Objects

First create an Address Objects for each MAC address of the carriers router.

2. Create Address Object Group

Then create an Address Object Group named e.g. IPS Exclusion List and add the Address Objects to that group.

3. Configure IPS Services

Next go to Security Services > IPS and click Configure IPS Settings. Check Enable IPS Exclusion List and select Use Address Objects. Finally, select the newly created Address Object Group named e.g. IPS Exclusion List and click OK to save.
Let me know if you have any questions!
0

Featured Post

10 Questions to Ask when Buying Backup Software

Choosing the right backup solution for your organization can be a daunting task. To make the selection process easier, ask solution providers these 10 key questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Examines three attack vectors, specifically, the different types of malware used in malicious attacks, web application attacks, and finally, network based attacks.  Concludes by examining the means of securing and protecting critical systems and inf…
A 2007 NCSA Cyber Security survey revealed that a mere 4% of the population has a full understanding of firewalls. As business owner, you should be part of that 4% that has a full understanding.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question