Secondary IP address on a network inteface - SMB

[Daniel_Pukas]

Is it possible to configure a secondary IP address on a network interface on a SMB? Under the 'Supported and Unsupported Features' section in sk105380 article 'Alias / Secondary IP address' states that it is supported for both Centrally and Locally managed SMBs, but I can not find the syntax to configure in CLI or by using the Web GUI.

[PhoneBoy]

What's the specific use case here?

[Daniel_Pukas]

The client would like to move the layer 3 interface which contains 3 subnets from a switch to the newly installed gateway

[PhoneBoy]

The SK says this is NOT supported for ALL appliances (including SMB)

If you need to support multiple subnets, you need to one of:

• Create a virtual switch for each subnet and assign a LAN port to that switch
• Create a VLAN trunk on one LAN port and trunk it with a switch port with the same configuration

[Daniel_Pukas]

Update from SR 3-0641449281

"The feature requested is not possible and we have edited sk105380 as not supported."

[G_W_Albrecht]

According to sk89980: Support for Sub-interfaces / Alias IP address / Secondary IP address in Check Point product..., support of Alias / Secondary IP is very limited in GAiA:

Gaia OS supports the configuration of Secondary IP addresses only on single Security Gateways. In all other releases/configurations (e.g., ClusterXL, Dynamic Routing), the use of Secondary IP addresses is not officially supported. If the physical machine does not have enough physical interfaces, then VLAN interfaces should be configured.

So i do not think that this is supported on GAiA Embedded without these limitations - if supported at all, maybe the sk105380 is rather speaking of VLANs...

[Daniel_Pukas]

I suspect it is not supported in GAiA embedded, I have a TAC case raised to confirm, currently with R&D

[G_W_Albrecht]

Thank you for having that confirmed !

[Steffen_Appel]

It is supported on the new SMB device (1500, 1600, 1800): https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Jimmyktran]

I have the new SMB 1500m1600 and 1800.  I'm not sure if this is an option for trunking multiple VLAN to one interface.  We need this function, and the past gateway was able to do this.  If this is an option, there is nothing to tell us how to do this.  Please help, we just purchase a lot of this gateway, but if the feature is not there, then there will be an issue.   

[PhoneBoy]

Yes, this is supported.
In my lab, I have multiple VLANs trunked to my DMZ interface.
You have to create each one and assign the relevant networks/settings to it.
https://sc1.checkpoint.com/documents/SMB_R80.20.30/AdminGuides/Locally_Managed/EN/Topics/Configuring...

[Steffen_Appel]

Yes we have used VLAN-trunking on the SMB devices.