How does anti-spoofing work when there is no default route configured and when policy based forwarding is enabled

[T_SystemsSouthAfrica]

Good day,

Please advise, how does the PANOS handle antispoofing when there is no default route configured in a VR, only the policy based forwarding is enabled within that VR.

Does the policy based forwarding entry update the routing table entries.

Regards

Sarish

[kprakash]

Hi Sarish,

The PANFW would still perform route lookup for the traffic coming in from the source zone/ source interface. If the PANFW detects that the traffic ingressing the traffic comes on the incorrect interface, it drops them as spoofed packets or with "no-arp-found" message. It cannot check the same for the destination address because, we are forcing the firewall to route the traffic out via another interface. After the traffic matches a PBF rule, the traffic is subjected to a security rule match, and a session would be setup for the traffic  ( client to source and return traffic-source to client). Both the client to server and the server to client traffic is again subjected to other security checks.

Let me know if that helps.

BR,

Karthik RP