forefront tmg spoofed IP Address

[sacrej]

Got an issue on our desktops where they can't see any computers in network places, but can connect by typing the direct address in, eg \\IT-45\c$

The only machines we can see are the ones that haven't got the firewall client installed. in the Forefront logs I am getting many Netbios denied messages as it is saying my ip is spoofed.

 

details from the log:

 

a packet was dropped because forefront tmg determined that the source IP address is spoofed.

 

source ip: 172.16.0.113:137 (internal)

destination ip: 172.16.255.255:137 (internal)

-------------------------------------------------------------

 

seems to have started happening since we deployed the client (we think) but this isnt the only protocol this happens with.

 

if anyone has any idea as to what the issue is, I would be most thankful!

[JakeHendy]

Something that springs to mind is that it's pinging 255 and if memory serves me correctly, probably not, but if it pings 255 doesn't that mean it pings the whole subnet?

 

HTH

[ianh64]

TMG reports a spoofed IP addresses if the source IP address on an (TMG) adaptor is either not within the defined IP address for that adaptor or is not reachable through that adaptor as defined by the routing table.

 

Is the multicast addresses and subnet mask correctly defined for the adaptor that has the destination subnet?