topic Traffic Tagged in Firewall and Security Management

Traffic Tagged

Matlu — Sat, 05 Apr 2025 23:45:33 GMT

Hi, Mates.

Do Check Point devices support MPLS labeled traffic?

I have a need to be able to perform filtering on some network segments, but the detail is that these segments are labeled as they are part of an L3 VPN MPLS environment.

Our box is in an MPLS network, specifically in the middle of 2 Routers part of an MPLS network (1 P, and 1PE), and the traffic that is intended to be filtered for example segments like 110.130.x.x/24, are segments that are labeled in the network.

Our box is in the middle of the Routers working as if it were a SW (Mode Bridge), with the objective of performing access control to applications and websites.

Is it possible for CP to control MPLS labeled traffic?

Thanks for your comments.

Re: Traffic Tagged

Chris_Atkinson — Sun, 06 Apr 2025 00:23:43 GMT

Check Point does not support MPLS tagged traffic.

You'd need to break out the traffic for inspection.

Re: Traffic Tagged

Matlu — Sun, 06 Apr 2025 00:29:37 GMT

Is there any official documentation that talks about this?

Re: Traffic Tagged

Chris_Atkinson — Sun, 06 Apr 2025 01:57:18 GMT

MPLS is not listed on the datasheet if that's what you are asking.

Otherwise its a case of needing the traffic to arrive to and traverse the Firewall in a manner / format we can inspect.

Re: Traffic Tagged

the_rock — Sun, 06 Apr 2025 13:42:16 GMT

Hey bro,

I could not find any official doc about it, but below is what AI Copilot gave me.

Andy

Yes, Check Point supports MPLS tagged traffic. In some network topologies, a clear-text MPLS link (encryption is not required) is deployed in addition to an encrypted Internet link between Check Point VPN Gateways. Customers can configure certain services to be routed through the MPLS link in clear-text, while other services are forwarded encrypted through the Internet link.

For more detailed information, you can refer to the article on how to create a redundant, service-based MPLS/Encrypted Link VPN here.

Learn more:

Re: Traffic Tagged

Chris_Atkinson — Sun, 06 Apr 2025 22:01:46 GMT

This is not correct in the stated context.

MPLS as a telco would operate over their backbone is different than the end carriage service consumers might commonly refer to as MPLS.

Re: Traffic Tagged

the_rock — Sun, 06 Apr 2025 22:16:42 GMT

Thats fair Chris!

Andy