topic Re: Check Point Firewall: Configuring a Layer 2 Bridge (Transparent Firewall) in General Topics

Check Point Firewall: Configuring a Layer 2 Bridge (Transparent Firewall)

Moudar — Mon, 05 Jan 2026 12:38:05 GMT

In today’s video, we configure a Check Point Gaia R82 Security Gateway to operate as a Layer 2 Bridge. This setup allows the firewall to inspect traffic transparently between two switches without changing a single IP address in the network.

Re: Check Point Firewall: Configuring a Layer 2 Bridge (Transparent Firewall)

the_rock — Mon, 05 Jan 2026 13:49:22 GMT

Excellent!

Re: Check Point Firewall: Configuring a Layer 2 Bridge (Transparent Firewall)

cyberserge — Wed, 07 Jan 2026 13:15:07 GMT

Thank you! I was looking for L2 transparent firewall setup before. Wish this great gem was released earlier!
Although I'm still puzzled why bridge interface still need an assigned IP address.
Do we just assign any random not-is-use IP address?

Re: Check Point Firewall: Configuring a Layer 2 Bridge (Transparent Firewall)

PhoneBoy — Wed, 07 Jan 2026 23:01:37 GMT

Worth noting that while you can have multiple bridges, only have one bridge with an IP: https://support.checkpoint.com/results/sk/sk180302
Which means it's not strictly necessary, though the gateway will likely need Internet access through a different interface.

Re: Check Point Firewall: Configuring a Layer 2 Bridge (Transparent Firewall)

cyberserge — Thu, 08 Jan 2026 01:53:39 GMT

A follow up question: does it need L2 device before and after the bridge? Can it be L3 device?
An example would be: inserting Check Point gateway in L2 Bridge mode between edge firewall and router

Re: Check Point Firewall: Configuring a Layer 2 Bridge (Transparent Firewall)

Moudar — Thu, 08 Jan 2026 08:37:58 GMT

Yes, I think you can. It’s worth testing it in a lab.

You can insert a Check Point bridge between two Layer 3 devices (like an edge firewall and a router).

The bridge acts as a "transparent wire." The edge firewall and the router stay in the same IP subnet and talk to each other directly.

You get security inspection, without having to change any IP addresses or routing tables on your existing equipment.

Both L3 devices must be on the same broadcast domain (same subnet) so they can "see" each other via ARP through the bridge.