Can TX gateways in transparent block?

[Travais_Sookoo]

Hello 'mates,

As the subject asks, I would like to deploy a pair of Sec Gateways with IPS, ASPam, AV, TE and TX but the interfaces bridged and directly connected to another firewall and switch, inline to all traffic coming a high security network.

Will the Sec Gateway device be able to block any traffic deemed to be high risk based on the blades and TX or will it be monitor only?

[Vladimir]

I believe you'll be able to use a subset of features to block threats, but the most important limitations of the bridge mode are the absence of support for HTTPS inspection and Identity Awareness.

[Pablo_Barriga · Accepted solution]

Hello Gateways support this deployments

Blade	Supported in Bridge Gateway mode?	Supported in Bridge VSX mode?
Firewall	Yes	Yes
IPS	Yes	Yes
URL Filtering	Yes	Yes
Data Loss Prevention	Yes	No
Anti-Bot	Yes	Yes
Anti-Virus	Yes	Yes
Application Control	Yes	Yes
HTTPS Inspection	Yes (1)	No
Identity Awareness	Yes	No
Threat Emulation - ThreatCloud emulation	Yes	Yes in Active/Active Bridge ModeNo in Active/Standby Bridge Mode
Threat Emulation - Local emulation	Yes	No in all Bridge Modes
Threat Emulation - Remote emulation	Yes	Yes in Active/Active Bridge ModeNo in Active/Standby Bridge Mode
UserCheck	Yes	No
QoS	Yes (see sk89581)	No (see sk79700)
HTTP / HTTPS proxy	Yes	No
SMTP / HTTP / FTP / POP3 Security Servers	Yes	No
Client Authentication	Yes	No
User Authentication	Yes	No

Sandblast Inline Mode supports this configurations

• Background
  • Allows to use "Prevent" action and "Ask" action (with UserCheck) in the Threat Prevention policy to block traffic before it goes to the internal computer.
• Deployment with a Mail Transfer Agent (MTA):
  Mail Transfer Agent (MTA) is needed:
  If you need to inspect SMTP over TLS traffic
  If you need to use the "Prevent" action for SMTP over TLS traffic
  If you need to perform Threat Extraction on SMTP traffic
• Deployment in Bridge Mode:
  • SandBlast TE Appliance is connected in Bridge Mode performs emulation.
    Other existing Security Gateway perform FireWall, NAT and other functions.
• Deployment with Proxy / ICAP Server:
  • A Proxy / ICAP Server collects files and sends then via ICAP to SandBlast TE Appliance for emulation.

[Travais_Sookoo]

Much thanks Pablo Barriga and https://community.checkpoint.com/people/highe19f56cc9-7e21-4ec2-8189-286599ead4d8‌

As a reference, the quoted excerpt is sk101371

[Vladimir]

Pablo's answer makes sense if the bridge mode is non-transparent, i.e. you'll have to assign the IP to the bridge in order to utilize HTTPS inspection, IA, DLP, and other functionality relying on it.

As you've mentioned "transparent" in the header of your question, I've supplied the limitations associated with it.

Cheers,

Vladimir