topic Re: I need to be able to detect packets dropped by Juniper SSG firewalls due to the firewalls' anti-spoofing in Getting Data In

I need to be able to detect packets dropped by Juniper SSG firewalls due to the firewalls' anti-spoofing

btb2018 — Tue, 26 Feb 2019 12:16:30 GMT

How can I use SPLUNK to detect packets dropped by the Juniper ScreenOS because of anti-spoofing configuration on the firewall.?

Any help would be received,

Brian

Re: I need to be able to detect packets dropped by Juniper SSG firewalls due to the firewalls' anti-spoofing

lakshman239 — Tue, 26 Feb 2019 15:00:06 GMT

Does the Juniper f/w logs log these events? If yes, can you see them in the syslogs received from them? If we can identify these events with the help of Juniper f/w admins, you will be able to create a search.

Re: I need to be able to detect packets dropped by Juniper SSG firewalls due to the firewalls' anti-spoofing

btb2018 — Wed, 27 Feb 2019 09:33:28 GMT

Firewall logs are sent to SPLUNK.
I go through these having set the index i.e. index=juniper-syslog.
However I do not know how to search for packets dropped by anti-spoofing.
Any suggestions on which search options I should select?

Re: I need to be able to detect packets dropped by Juniper SSG firewalls due to the firewalls' anti-spoofing

lakshman239 — Wed, 27 Feb 2019 10:09:10 GMT

unfortunately, i don't have juniper logs to test, but if you show the events from your above search to Juniper f/w engineer and ask them to show you the events specific to packets drop, you can then create a search OR post back those samples.

You may also want to look at https://kb.juniper.net/InfoCenter/index?page=content&id=KB6991&cat=SCREENOS&actp=LIST

Re: I need to be able to detect packets dropped by Juniper SSG firewalls due to the firewalls' anti-spoofing

btb2018 — Wed, 27 Feb 2019 14:12:34 GMT

The difficulty is that I'm trying to enable the anti-spoofing function, so I can't work backwards based on what I can currently see.
In other words I don't know if Juniper is aware of anti-spoofing on ScreenOS, "notes" that packets don't match the routing table but takes no action until anti-spoofing is enabled, or does it have no awareness of the concept of anti-spoofing until it is enabled?
Obviously I want to know what to expect to see if I experience problems related to anti-spoofing before I enable it on my client's equipment, hence the challenge.
I also administrate the firewalls but the difficulty still applies.

Thanks for replying.

Re: I need to be able to detect packets dropped by Juniper SSG firewalls due to the firewalls' anti-spoofing

nsommars — Thu, 28 Feb 2019 11:35:37 GMT

We have kind of the same problem.
However, this is no Splunk issue...Netscreen firewall logs does not contain those packets because they are dropped before they hit the firewall functionality in ScreenOS.