topic Re: About Checkpoint's Bridge Mode Constraints in General Topics

About Checkpoint's Bridge Mode Constraints

TSOL — Wed, 06 Dec 2023 08:14:24 GMT

Hello Team,

We're thinking of a IPS configuration for monitering IoT communication and PC communication.

If Quantum is installed between L3SW and L2Sw as an IPS, is it possible to configure it as follows?

I would like to run Quantum in bridge mode (L2), but since the URL below says "Important - Only two interfaces can be connected by one Bridge interface", I don't think it can meet the requirements in bridge mode, am I right?

If you know of any best practices or proven methods using checkpoints, please let me know.

Thank you in advance.

Re: About Checkpoint's Bridge Mode Constraints

Chris_Atkinson — Wed, 06 Dec 2023 08:57:31 GMT

In general it means a given bridge e.g. br1 is comprised of two interfaces "1A" and "1B"

To help could you please clarify your diagram some...

Is there only one subnet between the Layer-3 switch and the routers shown or is each on it's own subnet / VLAN?

Re: About Checkpoint's Bridge Mode Constraints

TSOL — Wed, 06 Dec 2023 09:40:35 GMT

Thank you for the reply.

Our environment aggregates routing to L3SW. Therefore, the router, L3SW, IOT devices and computers at the headquarters belong to the same network. Of course, branches have different networks.　

The diagram is shown below.

Re: About Checkpoint's Bridge Mode Constraints

Chris_Atkinson — Wed, 06 Dec 2023 11:00:34 GMT

We have to be wary of double inspecting any traffic flows, so with this in mind the only potential solution that comes to mind involves additional cabling and running the firewall as VSX to partition the segments.

Suggest engaging your local SE to help you validate possible options and engage with solution center if needed.

By contrast implementing the links to the routers via an intermediate switch helps from a plumbing perspective but creates a visibility issue.