If you have multiple ISP routers connected to a SonicWall and have machines with IP addresses in a secondary ISP scheme, when accessing a machine behind SonicWall on its primary WAN IP from this secondary subnet,you may get an "IP Spoof Detected" or "SYN Flood Protection" error message in the log. Consider the scenario shown below:
X1 and X2 are two WAN interfaces. X1 connected to ISP 1 router is Primary WAN interface. X2 is connected via a network switch to ISP 2 router. To this switch there are two PC's connected as well which get public IP from secondary ISP scheme. The configurations are as follows: X1 IP - 22.214.171.124 X1 Gateway IP - 126.96.36.199 X2 IP - 188.8.131.52 X2 Gateway - 184.108.40.206 PC1 IP - 220.127.116.11 PC1 IP - 18.104.22.168 The gateway of the PC's is the ISP 2 router interface of 22.214.171.124.
Consider a port forwarding done for a LAN machine with the public IP set to X1 IP. When accessing that machine on X1 IP from PC1 or PC2, the traffic would ingress the SonicWall on X1 interface as it would be normal internet traffic. However SonicWall would expect the traffic coming from PC1 or PC2 to ingress on X2 interface as they are part of the X2 addressing scheme. Thus SonicWall would drop the packet as either "IP spoof" or "SYN Flood Protection".
Step 1: We need to tell the SonicWall to consider the traffic received from PC1 and PC2 as normal internet traffic received on X1. This is facilitated by means of a static route.
Step 2: Create an address object for the PC IP's as shown below:
Step 3: Create a Static route to tell SonicWall to reach secondary ISP range via X1 gateway:
How to Test:
Should be able to access the local machine on X1 IP from either PC1 or PC2 now.