> Source: [sk104937](https://support.checkpoint.com/results/sk/sk104937)

# sk104937 - In VSX cluster, Virtual Router sends ICMP packets with its cluster private network IP instead of Cluster VIP as Source address

| Property | Value |
|----------|-------|
| Solution ID | sk104937 |
| Date Created | 2015-02-25 |
| Last Modified | 2017-09-25 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * SmartView Tracker logs might show that ICMP packets are dropped by Virtual System:

  ```
  
  Action = Drop
  Information = message_info: Local interface address spoofing
  Source = <Name_of_VSX_Cluster>_<Name_of_Virtual_System> (Internal_IP_Address)
  Protocol = icmp
  Interface = wrpXXX
  ```

* Topology:

  Client --- \[ VS --- VR \] --- Destination Host
  1. Client behind a Virtual System is trying to reach a host (that does not exist / answer) behind a Virtual Router.
  2. The Virtual Router replies with ICMP packets Type 3 "Destination Unreachable"
  3. The Virtual System drops these ICMP Error packets
* Traffic capture shows that Virtual Router sends these ICMP packets "Destination Unreachable" with its Source IP address that belongs to Internal Communication Network (Funny IP).

  *Example* (Funny IP is 192.168.196.18):
  [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk104937/sk104937_VR_ICMP_Funny_IP.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk104937/sk104937_VR_ICMP_Funny_IP.png "Click the image to see it in full size in a new tab/window")
* Issue occurs regardless the status of SecureXL (enabled/disabled) on the involved Virtual System / Virtual Router.

* Kernel debug ('`fw ctl debug -m fw + drop`') might show the following drops:

  * When SecureXL is enabled on VS and VR:  
    `;fw_log_drop_conn: Packet <dir 1, `*Source_IP* `:0 -> `*Dest_IP*`:0 IPP 1>, dropped by do_inbound, Reason: Local interface address spoofing;`  

  * When SecureXL is disabled on VS and VR:  
    `;fw_log_drop_ex: Packet proto=1 `*Source_IP* `:`*XX*` -> `*Dest_IP* `:`*YY*` dropped by fw_local_anti_spoofing Reason: local interface spoof;`

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content