FW in L2

[Matlu]

Hello,

We have a FW that we want to work in transparent mode, to avoid making sudden changes in our network.

We have enabled 2 fiber interfaces (Eth1-1 and Eth1-2) in bridge mode, which we understand is the way to make the FW work in L2.

The intention is that the FW only performs web filtering to the LAN of our headquarters.

Some questions

Is it necessary to pull the topology from the SmartConsole, and should the Interfaces that are in bridge mode also be seen from here?

If we only want the appliance to perform web filter control to the LAN, is it necessary to have the FW blade of our appliance enabled?

FW: R82 - JHF 10

Thank you for your answers.

[Chris_Atkinson]

Review the documentation here:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Installation_and_Upgrade_Guide/Con...

See also sk106319, sk101371

[Matlu]

Hello.

This is the documentation I was looking at, but I wondered since I started reading the documentation, if the interfaces that one sets in the GAIA Portal as bridge mode, should or should not be pulled from the SmartConsole in the topology part.

So if I have 1, 2, or many interfaces in bridge, the topology still has to be pulled from the SmartConsole, right?

Regards.

[AkosBakos]

Hi @Matlu 

Double-check the mentioned documentaions, especially the topoligy settings.

Long story short:

Q1: yes

Q2: yes. BTW you can't have a GW appliance without firewall enabled from my point of view. (grayed out)

Akos

[the_rock]

Q1 -> yes

Q2 -> fw blade is enabled by default when object is created

Andy

[PhoneBoy]

Firewall blade is always required to be enabled.
Topology on the Bridge Mode interface should be External.

See also:

• https://support.checkpoint.com/results/sk/sk105899
• https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Gui...

[Matlu]

Hello, Mate

Before putting the FW CP, the network topology is something like this.

When we put the FW CP, the topology changes to this model.

So to be sure to apply the changes correctly, both Eth1-1 and Eth1-2 interfaces must be configured as “External”, right?

Because currently they look like “This Network”.

A DUMB question, but if the interfaces in the topology are not “configured” in the right way, can this cause traffic problems?

Thank you for your help. 🙂

[the_rock]

No dumb questions my friend. Technically, if you do get interfaces WITHOUT topology, it should fetch the right info. However, if something is incorrect, yes, it could cause issues, but considering its in bridge mode, you might be okay.

Andy

[Matlu]

Buddy,

Thanks for getting back to me.

In my scenario, and based on PhoneBoy's comment, my Eth1-1 and Eth1-2 interfaces do you think it is “mandatory” to put them in “External” mode both interfaces?

In this FW, I only have 1 more interface connected, which is the MGMT port, and it is in the topology as “External”.

Apart from that interface, I don't have another one (I don't take into account the maas_tunnel interface, since my FW is hooked to a Smart-1 Cloud).

Cheers.

[the_rock]

Yes, I believe they would need to be set as external, correct.

Andy