I am using Meraki MX80 for NAT. There are a bunch of internal subnets, and the NAT works as expected. A colleague raised the question, what happens if a packet spoofs its source IP to something that's not in those internal subnets. Will such packets be dropped?

  • Depending on how you have the device configured, the traffic not matching an address range for NAT could be routed normally. You will need to provide the configuration (sanitize any public addresses). – Ron Maupin Feb 24 '16 at 6:07

Agree with Ron Maupin. More details would need to be provided.

With that being said, the default behavior would be to drop the packet if it doesn't hold the route for the IP address. Your packets would send out but the firewall wouldn't be able to return the ingress packets over the same session, thus your route would break. If your device that was spoofing the IP was also configured to respond to the same spoofed IP, then it may work. Of course, none of the spoofed traffic would work if your Meraki wasn't set to NAT the said spoofed subnet/IP in the first place.

Not the answer you're looking for? Browse other questions tagged or ask your own question.