IP Spoofing

Hi
The question and the issue is strange... why does a request on the same subnet be processed by the firewall? It should be internal traffic on a switch. Or not?

Bye

Salvatore

the User Authentification is processed by the Sophos. I think the Client PC is tring to access the web so the sophos firewall is trieng to auth through DC or RADIUS or not?

maybe i have a thinking error in the contruct? but why there are ip spoofing when everything is deactivated?

cheers

Strange... Anyway are you sure you are not doing asymmetric traffic ? In your printscreen all the request start from the same IP but there is no response and they are not only LDAP or Radius requests.

Could it be that you put some ports on promiscous mode also? Those servers and client are virtual VM ?

Did you try to open a ticket? Usually support helps me and solve my issues in short time.

Regards,
Salvatore

Strange... Anyway are you sure you are not doing asymmetric traffic ? In your printscreen all the request start from the same IP but there is no response and they are not only LDAP or Radius requests.

Could it be that you put some ports on promiscous mode also? Those servers and client are virtual VM ?

Did you try to open a ticket? Usually support helps me and solve my issues in short time.

Regards,
Salvatore

Yes really strange the DC (192.168.12.18) is Windows 2008 R2 VM and runs on a ESXi host. Clients are physical.

Case 7851367 is open but no reaction since 1 week. so i tried to ask the community.

Answer:

We have an IPSec Tunnel with the route for the 192.168.0.0/16 so the Sophos overrides access from the XG to the local network to 192.168.12.0 + 192.168.13.0 and is stored as an IP spoof. Therefore, you also drop the Seperate Zone package to the APs.

With the command console> system route_precedence set policy route static vpn you can change the routing order

Informations here: community.sophos.com/.../123610