Sonicwall E5500 and IP Spoofing

[chieftan]

Hopefully this will be a relatively simple question for someone to answer as it is not a technical or config question, merely if I am understanidng something correctly:-

Yesterday evening I was configuring the E5500 for Global VPN connectivity and it was all working fine. I made a simple IP Address change and lost GUI connectivity to the device. I could still SSH, so I ssh'd in and made relevant changes. Went back to the WebGUI but still could get no access. I could do anything via CLI but nothing via WebGUI. In the end I left it.

I came into work this morning and tested and Voila, with no changes I can, again, access the system via the WebGUI.

Upon checking the log files, I noticed that just before I lost the GUI access I had an event stating "IP Spoof detected - dropped".

So, here is the question:- On the Sonicwall devices, or for that matter any firewall, if an IP Spoof is detected does the firewall automatically stop HTTP connectivity to itself for a given period of time?

 

[cajuntank]

Sounds like it took a while for the ARP table to update. So there are devices on your network (routers, switches, firewalls, etc...) that will track MAC addresses associated with IP addresses. It sounds like when you changed the IP address on the Sonicwall, some ARP entries did not update in it or some other piece of equipment, more than likely a switch.