topic Re: Active/Standby Bridge Topology Table in Firewall and Security Management

Active/Standby Bridge Topology Table

prashanth — Mon, 25 Sep 2023 13:25:42 GMT

I'm setting up an Active/Standby Bridge with two bridge groups.

Bridge Group 1: Eth1 <> Eth2

Bridge Group 2: Eth3 <> Eth4

I can see the bridge interfaces when I create the gateway at SmartConsole. But when creating the cluster bridge interfaces aren't discovered.

First and foremost is this behaviour is normal?

How can I achieve segregated policy packages per bridge group?

Since the bridge interfaces are not available in the topology table, we can’t protect them against Anti-spoofing. Is there any method to achieve this?

Re: Active/Standby Bridge Topology Table

PhoneBoy — Mon, 25 Sep 2023 17:59:04 GMT

This is normal and documented: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Installation_and_Upgrade_Guide/Topics-IUG/Configuring-ClusterXL-in-Bridge-Mode-Active-Standby-with-Two-Switches.htm

Make sure the Bridge interface and Bridge subordinate interfaces are not in the Topology.
You cannot define the Topology of the Bridge interface. It is External by default.

To have a different policy for each bridge, you will need to use VSX (putting each bridge in a separate VS).
See also (for various limitations): https://support.checkpoint.com/results/sk/sk101371

Re: Active/Standby Bridge Topology Table

prashanth — Thu, 05 Oct 2023 01:54:25 GMT

Thank you @PhoneBoy

Once we have converted the cluster into an Active/Standby bridge mode is it recommended to use other interface types such as Bond/L3 along with the bridge interfaces?

Re: Active/Standby Bridge Topology Table

PhoneBoy — Fri, 06 Oct 2023 16:08:40 GMT

You can use bonded interfaces with bridge mode, yes.
You can also have L3 interfaces, but note the limitation around Double Inspection: https://support.checkpoint.com/results/sk/sk172204
Specifically, make sure that traffic does not traverse both an L2 and an L3 interface.
Management traffic can do so with a configuration change: https://support.checkpoint.com/results/sk/sk105899