topic Re: 1570R bridging in Spark Firewall (SMB)

1570R bridging

Vince_Galentine — Mon, 14 Jun 2021 14:17:49 GMT

Does anyone know how to set up a bridge on the new 1570R appliances? I do not understand why it ask for an IP address on the br0 interface. If anyone can help me with how to set up the bridge (step by step) it would be greatly appreciated.

Re: 1570R bridging

PhoneBoy — Mon, 14 Jun 2021 14:37:09 GMT

Don’t believe you can do a bridge without an IP address on the SMB appliances.

Re: 1570R bridging

Vince_Galentine — Mon, 14 Jun 2021 14:41:41 GMT

OK, What address do you use? Does the bridge still work like normal? I want to run a connection through the firewall (not getting in the way of the traffic) to monitor and then maybe apply rules. Is this possible?

Re: 1570R bridging

PhoneBoy — Mon, 14 Jun 2021 16:15:10 GMT

Yes, I actually do this in my lab using Access Policy rules to block specific traffic from specific hosts on my LAN:

Ideally, the IP would be on the same subnet as where you want to put the bridge, but I'm not sure it matters.

Re: 1570R bridging

Vince_Galentine — Mon, 14 Jun 2021 16:25:12 GMT

OK thanks. Do the interfaces need to be a certain type? Separate Network, Unassigned, LAN1 switch, or Monitor Mode? Sorry for all the questions. Working with Checkpoint since 1997 but not doing brides on SMB devices.

Re: 1570R bridging

PhoneBoy — Mon, 14 Jun 2021 16:59:32 GMT

The interfaces you choose for the bridge (only two are supported) should be unassigned to a switch.
Monitor Mode is used when you want the device to consume data from a mirror port.

Re: 1570R bridging

Vince_Galentine — Mon, 14 Jun 2021 17:20:49 GMT

Thank you for all the help.

Re: 1570R bridging

Martin_Raska — Tue, 13 Sep 2022 14:41:40 GMT

Why there can be selected more then two ports at the same time and can be applied? Same for SMB and Gaia also.

Gateway-ID-7F7A8546> show bridge br0
name: br0
ipv4-address: 192.168.200.1
subnet-mask: 255.255.255.0
stp: on
mode: on
status:
members: DMZ
LAN1
LAN2
LAN3
LAN4

Doest it make any sense?

Re: 1570R bridging

PhoneBoy — Tue, 13 Sep 2022 16:55:18 GMT

Not sure why the UI allows that if it's not officially supported.
That said, it definitely works (at least on SMB).

Re: 1570R bridging

neal_culligan0 — Wed, 14 Sep 2022 18:16:01 GMT

This could be the switch element on the 1570R.

We do support Interface -> LAN switch.

The CLI isn't clear if that's configured but its most likely

Re: 1570R bridging

Martin_Raska — Thu, 15 Sep 2022 07:17:32 GMT

Hello Neal,

its 730 appliance, all interfaces are separate L3. LAN switch was deleted.

My another questions is: Could we configure multiple bridges?

Br0 LAN1 - LAN2

Br1 LAN3 - LAN4

then use LAN5 and LAN6 as routed interface?

Re: 1570R bridging

neal_culligan0 — Thu, 15 Sep 2022 12:31:48 GMT

Multiple bridges are possible, limitation is 2 interfaces per bridge.

Re: 1570R bridging

PhoneBoy — Thu, 15 Sep 2022 16:00:42 GMT

To answer my own question why the UI allows this: A "bridge" with more than two interfaces is considered a switch.
And yes, this is definitely supported on SMB appliances (not on regular Gaia).

Re: 1570R bridging

Martin_Raska — Fri, 16 Sep 2022 12:16:36 GMT

This is very good information, thanks Daemon