> Source: [sk41360](https://support.checkpoint.com/results/sk/sk41360)

# sk41360 - How to prevent multicast packets from being dropped by VPN-1/FireWall-1 anti-spoofing rules?

| Property | Value |
|----------|-------|
| Solution ID | sk41360 |
| Date Created | 2009-04-19 |
| Last Modified | 2017-01-22 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Solution

In pre-NGX versions of VPN-1, multicast packets are not handled in any special way by FireWall-1. A multicast packet is simply an IP packet with a class D destination address (range of 224.0.0.0 through 239.255.255.255.) To prevent the FireWall-1 anti-spoofing mechanism from dropping multicast packets, define a (multicast) network object with the following information:

<br />

* IP Address: 224.0.0.0

* Net Mask: 240.0.0.0

<br />

Add the multicast network to all interfaces through which multicast packets may be sent. This is necessary because the Anti-spoofing mechanism in VPN-1/FireWall-1 NG examines the source IP address for incoming packets (entering the gateway) as well as outgoing packets and determines whether the IP addresses are valid for that interface.

In NGX and above, multicast is permtited by default unless it is explicitly disabled in Gateway Properties \> Topology \> Interface Properties \> Multicast Restrictions.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content