> Source: [sk106425](https://support.checkpoint.com/results/sk/sk106425)

# sk106425 - Connections through cluster to physical IP address of ClusterXL Standby member / VRRP Backup member are dropped by Anti-Spoofing

| Property | Value |
|----------|-------|
| Solution ID | sk106425 |
| Date Created | 2015-06-10 |
| Last Modified | 2021-05-05 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Windows, Gaia |

## Symptoms

- * Connections through cluster to physical IP address of ClusterXL Standby member / VRRP Backup member are dropped by Anti-Spoofing:

  A host is located on one side of the cluster.  

  This host initiates traffic to the physical IP address of the ClusterXL Standby / VRRP Backup member on the other side of the cluster (i.e., this traffic passes through the cluster).
  This traffic fails.
* Example Topology:

  Host (192.168.20.100/24), (DG 192.168.20.1) --- (VIP 192.168.20.1/24; Active/Master 192.168.20.2/24, Standby/Backup 192.168.20.3/24) \[CLUSTER, Sync 10.10.10.X/24\] (VIP 172.16.55.1/24; Active/Master 172.16.55.2/24, Standby/Backup 172.16.55.3/24)
  * Ping from Host to VIP 192.168.20.1 works
  * Ping from Host to each member 192.168.20.2/192.168.20.3 works
  * Ping from Host to VIP 172.16.55.1 works
  * Ping from Host to Active/Master member 172.16.55.2 works
  * Ping from Host to Standby/Backup member 172.16.55.3 fails
* Kernel debug (fw ctl debug -m fw + drop) on Standby/Backup member shows that it drops the traffic due to Anti-Spoofing protection on the involved interface:

  `;fw_log_drop_conn: Packet <dir 1, 192.168.20.100:1 -> 172.16.55.3:0 IPP 1>, dropped by do_inbound, Reason: Address` spoofing;
* Disabling the "Anti-Spoofing" on the VIP interface on the other side of the cluster (172.16.55.1) resolves the issue.

* Status of SecureXL is not relevant (enabled / disabled).

## Cause

The system is functioning as designed.

Traffic flow in ClusterXL HA cluster / VRRP cluster:

1. Host sends its traffic destined to the "other side" of the cluster.
2. Since the destination IP address (physical IP address of the ClusterXL Standby / VRRP Backup member) is not on the directly connected subnet, this traffic is sent to Default Gateway (cluster Virtual IP 192.168.20.1/24).
3. Traffic is processed by the ClusterXL Active / VRRP Master member (192.168.20.2/24).
4. Since this traffic is destined to the physical IP address of the ClusterXL Standby / VRRP Backup member (192.168.20.3/24), the ClusterXL Active / VRRP Master member forwards this traffic to Standby / Backup member over the *Synchronization* network (10.10.10.X/24).
5. ClusterXL Standby / VRRP Backup member detects traffic that is destined to its interface on one network (192.168.20.X/24), but is received on another network (Synchronization, 10.10.10.X/24).  
   This should not occur in normal situation, therefore it triggers the Anti-Spoofing protection.
6. Anti-Spoofing protection on ClusterXL Standby / VRRP Backup member drops this traffic.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content