topic Re: Bonding of physical interfaces in General Topics

Bonding of physical interfaces

Manoj_Pallapoth — Fri, 03 Jan 2020 05:33:35 GMT

Dear Mates,

Is bonding of interfaces suggestible in CP firewall when it is transparent mode.

Re: Bonding of physical interfaces

Wolfgang — Fri, 03 Jan 2020 07:12:45 GMT

Manoj,

you find the answer in your companies guide for bridge mode.

Bridge Mode on Gaia OS and SecurePlatform OS

"Only two interfaces can be connected by a single Bridge interface. These two interfaces can then be thought of as a two-ports switch. Each port can be a Physical, a VLAN, or a Bond device."

Wolfgang

Re: Bonding of physical interfaces

_Val_ — Fri, 03 Jan 2020 08:18:06 GMT

@Wolfgang is saying, yes, it is possible 🙂 Two bond interfaces can be a bridge. Each bond can have multiple physical interfaces.

Re: Bonding of physical interfaces

Manoj_Pallapoth — Fri, 03 Jan 2020 08:55:01 GMT

Hi,
My scenario is like this : Customer using Check Point in transparent mode to filter traffic. But few packets are missing out due to high bandwidth of traffic from the network. The interface we are using in CP for connectivity is 1 Gig. Now they wants to use 3 to 4 interfaces to as a bond to increase the pipe. Is it suggestible as I am new to Transparent mode scenarios.

Re: Bonding of physical interfaces

Maarten_Sjouw — Fri, 03 Jan 2020 09:15:50 GMT

That indeed is a good reason to use bonding, high bandwidth is one of the reasons to use it. Do keep in mind that a single stream will always stick to a physical interface, LACP would be the way to go here as it will make sure that load sharing will be used on the interfaces.

Re: Bonding of physical interfaces

Bob_Zimmerman — Fri, 03 Jan 2020 15:33:22 GMT

LACP's transmit link selection method can result in wildly asymmetric loading. In extreme cases, all of your traffic may end up sent out a single link. For example, cluster sync on a bonded interface will only ever go out one link if you're using LACP.

Default transmit link selection is based on the layer 2 source and destination. If the firewall is being inserted into a link between two routers, you will only see two source-destination MAC pairs, so load balancing will be bad. Switching to layer 3+4 hashing may help, but can still result in weird behavior.

Other bonding styles—such as round-robin—may be more appropriate for distributing load.