I do not have Checkpoint experience, but here is info from Checkpoint's website: Logs shows that traffic is dropped with "message_info: Address spoofing" in the "Information" field. These logs appear for inbound packets on the external interface of Security Gateway, although these packets were received from the network that belongs to the same external interface. Search for the action in the messages that match above ... View more