topic Re: Secondary IP address on a network inteface - SMB in Spark Firewall (SMB)

Secondary IP address on a network inteface - SMB

Daniel_Pukas — Mon, 26 Nov 2018 20:34:46 GMT

Is it possible to configure a secondary IP address on a network interface on a SMB? Under the 'Supported and Unsupported Features' section in sk105380 article 'Alias / Secondary IP address' states that it is supported for both Centrally and Locally managed SMBs, but I can not find the syntax to configure in CLI or by using the Web GUI.

Re: Secondary IP address on a network inteface - SMB

PhoneBoy — Tue, 27 Nov 2018 03:55:21 GMT

What's the specific use case here?

Re: Secondary IP address on a network inteface - SMB

G_W_Albrecht — Tue, 27 Nov 2018 09:21:45 GMT

According to sk89980: Support for Sub-interfaces / Alias IP address / Secondary IP address in Check Point products, support of Alias / Secondary IP is very limited in GAiA:

Gaia OS supports the configuration of Secondary IP addresses only on single Security Gateways. In all other releases/configurations (e.g., ClusterXL, Dynamic Routing), the use of Secondary IP addresses is not officially supported. If the physical machine does not have enough physical interfaces, then VLAN interfaces should be configured.

So i do not think that this is supported on GAiA Embedded without these limitations - if supported at all, maybe the sk105380 is rather speaking of VLANs...

Re: Secondary IP address on a network inteface - SMB

Daniel_Pukas — Tue, 27 Nov 2018 21:09:58 GMT

The client would like to move the layer 3 interface which contains 3 subnets from a switch to the newly installed gateway

Re: Secondary IP address on a network inteface - SMB

Daniel_Pukas — Tue, 27 Nov 2018 21:12:29 GMT

I suspect it is not supported in GAiA embedded, I have a TAC case raised to confirm, currently with R&D

Re: Secondary IP address on a network inteface - SMB

PhoneBoy — Wed, 28 Nov 2018 05:08:40 GMT

The SK says this is NOT supported for ALL appliances (including SMB)

If you need to support multiple subnets, you need to one of:

Create a virtual switch for each subnet and assign a LAN port to that switch
Create a VLAN trunk on one LAN port and trunk it with a switch port with the same configuration

Re: Secondary IP address on a network inteface - SMB

Daniel_Pukas — Wed, 28 Nov 2018 05:42:42 GMT

Update from SR 3-0641449281

"The feature requested is not possible and we have edited sk105380 as not supported."

Re: Secondary IP address on a network inteface - SMB

G_W_Albrecht — Fri, 07 Dec 2018 08:49:58 GMT

Thank you for having that confirmed !

Re: Secondary IP address on a network inteface - SMB

Steffen_Appel — Wed, 07 Apr 2021 12:23:59 GMT

It is supported on the new SMB device (1500, 1600, 1800): https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk159772&partition=Basic&product=Quantum , to be found under LAN -> New -> Alias.

Re: Secondary IP address on a network inteface - SMB

Jimmyktran — Thu, 09 Sep 2021 20:22:01 GMT

I have the new SMB 1500m1600 and 1800. I'm not sure if this is an option for trunking multiple VLAN to one interface. We need this function, and the past gateway was able to do this. If this is an option, there is nothing to tell us how to do this. Please help, we just purchase a lot of this gateway, but if the feature is not there, then there will be an issue.

Re: Secondary IP address on a network inteface - SMB

PhoneBoy — Thu, 09 Sep 2021 20:59:34 GMT

Yes, this is supported.
In my lab, I have multiple VLANs trunked to my DMZ interface.
You have to create each one and assign the relevant networks/settings to it.
https://sc1.checkpoint.com/documents/SMB_R80.20.30/AdminGuides/Locally_Managed/EN/Topics/Configuring-Local-Network.htm?Highlight=Vlan

Re: Secondary IP address on a network inteface - SMB

Steffen_Appel — Fri, 24 Sep 2021 14:06:53 GMT

Yes we have used VLAN-trunking on the SMB devices.