topic Re: RE: Checkpoint trunk ports in General Topics

RE: Checkpoint trunk ports

nflnetwork29 — Wed, 01 Feb 2023 18:41:37 GMT

Having some issues with the checkpoints and getting them to talk to A-Side partner over Datacenter fabric ports.

Essentially, I have configured physical interface eth3 on the 6200’s with two vlan 401 and 403. My understanding is that these would be treated as a traditional trunk port. (802.1q encapsulation)

IS there any *special * configuration on checkpoint side to get this working? The other end is a FortiGate and they are telling me they cannot see my side.

Re: RE: Checkpoint trunk ports

Bob_Zimmerman — Wed, 01 Feb 2023 20:32:27 GMT

Yes, subinterfaces on Check Point (and Linux in general) are normal 802.1q VLAN trunks. No, there's no special configuration needed. You have to apply the configuration in a different place on a Check Point box than on a generic Linux box, but it's the same basic configuration.

How exactly did you configure the VLANs? What commands?

Re: RE: Checkpoint trunk ports

the_rock — Wed, 01 Feb 2023 21:44:44 GMT

Did you follow below?

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/VLAN-Interfaces.htm

I dont think they are considered traditional trunk port the way you described it.

Re: RE: Checkpoint trunk ports

nflnetwork29 — Thu, 02 Feb 2023 14:52:43 GMT

@Bob_Zimmerman

I configured thru the gaia web ui . interfaces > add new interface > vlan > choose parent interface eth3 > create vlan id.

Re: RE: Checkpoint trunk ports

Bob_Zimmerman — Thu, 02 Feb 2023 15:04:48 GMT

With that config, eth3 handles 802.1q-tagged traffic for VLANs 401 and 403. Since eth3 doesn't have an IP address, it isn't handling untagged traffic, but you didn't mention anything about untagged, so I assume that's fine.

I guess the question now is what is a "Datacenter fabric port"? If it's switch infrastructure managed by someone who isn't you, maybe it isn't allowing tagged traffic?

Re: RE: Checkpoint trunk ports

Vladimir — Thu, 02 Feb 2023 16:10:33 GMT

Please be a little bit more specific in your description of interconnects:

1. Make and model of the switch you are connecting to

2. Switch trunk port (that CP unit is connected to) config

The fabric issue should be irrelevant, as you are not connecting to a fabric port, those should be used for switches interconnects, but otherwise pass all traffic.

If those are not a true fabric ports, but trunk interconnects, make sure that your VLANs are enabled on them as well.

Re: RE: Checkpoint trunk ports

nflnetwork29 — Thu, 02 Feb 2023 16:17:19 GMT

we got it working . the issue was non related to checkpoint - thanks,

Re: RE: Checkpoint trunk ports

_Val_ — Fri, 03 Feb 2023 09:30:41 GMT

Please share the cause and resolution anyway, thanks