Check Point Firewall: Configuring a Layer 2 Bridge (Transparent Firewall)

[Moudar]

In today’s video, we configure a Check Point Gaia R82 Security Gateway to operate as a Layer 2 Bridge. This setup allows the firewall to inspect traffic transparently between two switches without changing a single IP address in the network.

[the_rock]

Excellent!

[cyberserge]

Thank you! I was looking for L2 transparent firewall setup before. Wish this great gem was released earlier!
Although I'm still puzzled why bridge interface still need an assigned IP address.
Do we just assign any random not-is-use IP address?

[PhoneBoy]

Worth noting that while you can have multiple bridges, only have one bridge with an IP: https://support.checkpoint.com/results/sk/sk180302 
Which means it's not strictly necessary, though the gateway will likely need Internet access through a different interface.

[cyberserge]

A follow up question: does it need L2 device before and after the bridge? Can it be L3 device?
An example would be: inserting Check Point gateway in L2 Bridge mode between edge firewall and router

[Moudar]

Yes, I think you can. It’s worth testing it in a lab.

You can insert a Check Point bridge between two Layer 3 devices (like an edge firewall and a router).

The bridge acts as a "transparent wire." The edge firewall and the router stay in the same IP subnet and talk to each other directly.

You get security inspection, without having to change any IP addresses or routing tables on your existing equipment.

Both L3 devices must be on the same broadcast domain (same subnet) so they can "see" each other via ARP through the bridge.