> Source: [sk184391](https://support.checkpoint.com/results/sk/sk184391)

# sk184391 - ICMP unreachable packets dropped due to anti-spoofing on external port

| Property | Value |
|----------|-------|
| Solution ID | sk184391 |
| Date Created | 2025-12-08 |
| Last Modified | 2025-12-15 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20 |
| OS | Gaia |
| Platform | 7000 |

## Symptoms

- * The Security Gateway drops ICMP unreachable messages on the external port (bondX) due to address spoofing. Example log output:  

  ````
  
     ```
     Action: Drop 
     Reason: Address spoofing 
     Protocol: ICMP 
     Source: 1.1.1.1 
     Destination:2.2.2.2 
     Interface: bondX 
     ```
  ````

  <br />

* Log entries show ICMP traffic with internal server IP addresses as the destination, even though these IP addresses are not defined as internal in the Security Gateway's topology.

* Internal server addresses are not accessible from the external environment, but drops still occur.

## Cause

The Security Gateway checks for spoofing on both the outer IP header and the original (encapsulated) IP header inside ICMP unreachable messages. When an ICMP unreachable message arrives at the Security Gateway, it contains the original packet's IP header (for example, an internal server's IP address). If this internal IP address is not included in the anti-spoofing range defined for the port, the Security Gateway drops the packet as spoofed.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content