topic Re: Exclude all Traffic inspection on certain port/vlan in Spark Firewall (SMB)

Exclude all Traffic inspection on certain port/vlan

mmitic — Thu, 02 Jul 2020 09:43:44 GMT

Hello everyone,

I plan to install SMB 1530 and I would like to exclude all traffic from a certain port or vlan. Is this possible?

I am already using SMB 750 and I couldn't find a solution for this.

You probably wonder why should someone do that? 🙂

I am evaluating some decentralized storage and there are huge numbers of simultaneus connections which are also consuming high bandwidth so I don't want to overkill my SMB 🙂

With vlans, I would like to isolate this traffic in my local network and also to protect all other traffic. 🙂

Thanks in advance.

Regards

Re: Exclude all Traffic inspection on certain port/vlan

PhoneBoy — Sun, 05 Jul 2020 21:56:36 GMT

Define precisely what you mean by "exclude all traffic from a certain port."
You can certainly allow all traffic to/from a certain VLAN.
What is the precise nature of the traffic?
Also, is this SMB appliance managed locally or remotely?

Re: Exclude all Traffic inspection on certain port/vlan

mmitic — Tue, 07 Jul 2020 20:50:37 GMT

By exclude all traffic from a certain port or vlan I mean all traffic which goes through eth_1 (example) shouldn't be examined/filtered/whatever, so that my CheckPoint SMB won't be overloaded because as I already wrote, I will be using decentralized storage which use hundreds of simultaneus connections. Those connections are also consuming high bandwidth and by all means I am not interested in securing them.

Maybe the most precise description would be: I would like to have some DMZ service but without interfering with my local network.

My SMB 1530 would be managed locally (I don't have management server, if that's your question).

Thank you for your answer.

Regards

Re: Exclude all Traffic inspection on certain port/vlan

PhoneBoy — Tue, 07 Jul 2020 23:38:30 GMT

Technically, it is not possible to disable ALL inspection.
The best you can do is something like the "fast acceleration" feature described here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk156672
You can try the commands listed here, but I'm not sure they'll work on SMB appliances.

Re: Exclude all Traffic inspection on certain port/vlan

G_W_Albrecht — Wed, 08 Jul 2020 12:52:29 GMT

For such a task i would add other hw switch and only connect internet traffic to the SMB.

Re: Exclude all Traffic inspection on certain port/vlan

Chris_Atkinson — Wed, 08 Jul 2020 13:50:55 GMT

You may also wish to review the following options where relevant, see also sk111756.