L3 mode and bridge mode in ha configuration?

TAEKBOM_Kim — Thu, 27 Sep 2018 02:35:18 GMT

Hi mates~!

The check point can operate L3 mode and bridge mode in HA configuration?

I know It can operate L3 mode and bridge mode in standalone mode.

But I think it is impossible in HA.

Please give me your advice.

Re: L3 mode and bridge mode in ha configuration?

darrenkohcc — Wed, 31 Jul 2019 06:05:53 GMT

i got the same question, any answer for this?

Re: L3 mode and bridge mode in ha configuration?

Norbert_Bohusch — Thu, 01 Aug 2019 08:37:15 GMT

sk101371 - Bridge Mode on Gaia OS and SecurePlatform OS

This sk lists everything related to bridge mode.

Example:

Bridge mode is fully supported (unless stated otherwise) on Gaia / SecurePlatform OS by the following blades for single Security Gateway deployment, for cluster with one switch in Active/Active and Active/Standby deployment, and for cluster with four switches:

Or:

Limitations

Only two interfaces can be connected by a single Bridge interface. These two interfaces can then be thought of as a two-ports switch. Each port can be a Physical, a VLAN, or a Bond device.

These features, Software Blades and deployments are not supported in Bridge Mode:

IPSec VPN Software Blade
Mobile Access Software Blade
"Full High Availability" deployment (where both ClusterXL members are also configured in Management HA)
NAT rules on Security Gateways (specifically, the traffic will be displayed as accepted by the FireWall kernel in logs, but will not actually depart on the other side, which may give the false impression that it is working).
Refer to sk106146 - Configuration required on routers to allow NATed traffic to pass through Security Gateway in Bridge mode.
Access to Portals from bridged networks, if the bridge does not have an assigned IP address
Anti-Virus in Traditional Mode
Identity Awareness authentication other than AD Query (AD Query is the only supported authentication)
Assigning an IP address on Bridge interface in ClusterXL (any version)
ClusterXL in R75.40 and lower / R75.45 / R75.46 / R75.47
Asymmetric traffic inspection on Layer 2 Active/Active cluster deployment is not supported (asymmetric traffic inspection is any situation, where the Client-to-Server packet is inspected by one cluster member, while the Server-to-Client packet is inspected by the other member. In such scenarios several security features will not work)

topic Re: L3 mode and bridge mode in ha configuration? in Firewall and Security Management

L3 mode and bridge mode in ha configuration?

Re: L3 mode and bridge mode in ha configuration?

Re: L3 mode and bridge mode in ha configuration?