https://live.paloaltonetworks.com/t5/general-topics/spoof/m-p/134579#M47364 <P>Hi,</P><P>How palo alto blocks if ip address is spoofed .<BR />Why does it not work in vwire mode<BR />Thanks</P> Mon, 26 Dec 2016 07:17:01 GMT sib2017 2016-12-26T07:17:01Z https://live.paloaltonetworks.com/t5/general-topics/spoof/m-p/134579#M47364 <P>Hi,</P><P>How palo alto blocks if ip address is spoofed .<BR />Why does it not work in vwire mode<BR />Thanks</P> Mon, 26 Dec 2016 07:17:01 GMT https://live.paloaltonetworks.com/t5/general-topics/spoof/m-p/134579#M47364 sib2017 2016-12-26T07:17:01Z https://live.paloaltonetworks.com/t5/general-topics/spoof/m-p/134611#M47368 <P>The Palo Alto uses the routing table to help determine if the address is spoofed.</P><P>&nbsp;</P><P><A href="https://live.paloaltonetworks.com/t5/Featured-Articles/Zone-protection-profiles/ta-p/70687" target="_blank">https://live.paloaltonetworks.com/t5/Featured-Articles/Zone-protection-profiles/ta-p/70687</A></P><P>Quote:</P><P><SPAN>Select the check box to enable protection against </SPAN><SPAN class="lia-search-match-lithium">IP</SPAN> <SPAN class="lia-search-match-lithium">address</SPAN> <SPAN class="lia-search-match-lithium">spoofing</SPAN><SPAN>. PAN-OS uses the routing table on the device to verify if the source </SPAN><SPAN class="lia-search-match-lithium">IP</SPAN><SPAN> of the traffic is arriving on the appropriate interface. If this is not the case the packet will be discarded.</SPAN></P><P>&nbsp;</P><P><SPAN>Thus this is not applicable in v-wire mode that has no routing table and is just a virtual wire connecting two devices.</SPAN></P> Mon, 26 Dec 2016 13:07:59 GMT https://live.paloaltonetworks.com/t5/general-topics/spoof/m-p/134611#M47368 pulukas 2016-12-26T13:07:59Z