VLAN Interfaces

This section shows you how to configure VLAN interfaces in the Gaia PortalClosed Web interface for the Check Point Gaia operating system. and Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

You can configure virtual LAN (VLAN) interfaces on Ethernet interfaces.

VLAN interfaces let you configure subnets with a secure private link to Security Gateways and Management Servers using your existing topology.

With VLAN interfaces, you can multiplex Ethernet traffic into many channels using one cable.

Important - In a ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.

Notes:

  • The name of a VLAN interface in GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. is "<Name of Physical Interface>.<VLAN ID>".

    For example, the name of a VLAN interface with a VLAN ID of 5 on a physical interface eth1 is "eth1.5".

  • The VLAN tunnel is not secure, because it is not encrypted.

  • To configure MTU on a VLAN interface, you must configure MTU on the physical interface.

    This MTU applies to all VLAN interfaces configured on this physical interface.

  • The Gaia operating system supports the VLAN tagging protocol IEEE 802.1Q.

Configuring VLAN Interfaces in Gaia Portal

Important - On Scalable Platforms (Maestro and Chassis), you must connect to the Gaia Portal of the applicable Security Group.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

Make sure that the physical interface, on which you add a VLAN interface, does not have an IP address.

3

Click Add > VLAN.

4

In the Add VLAN window, select the Enable option to set the VLAN interface to UP.

5

On the IPv4 tab, do one of these:

  • Select Obtain IPv4 address automatically to get the IPv4 address from the DHCPv4 server.

    Important - Scalable Platforms (Maestro and Chassis) do not support this feature (Known Limitation MBS-3246).

  • Enter the IPv4 address and subnet mask in the applicable fields.

6

Optional: On the IPv6 tab, do one of these:

  • Select Obtain IPv6 address automatically to get the IPv6 address from the DHCPv6 server.

    Important - Scalable Platforms (Maestro and Chassis) do not support this feature (Known Limitation MBS-3246).

  • Enter the IPv6 address and mask length in the applicable fields.

Important:

7

On the VLAN tab, enter or select a VLAN ID (VLAN tag) between 2 and 4094.

8

In the Member Of field, select the applicable physical interface.

9

Click OK.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

Select a VLAN interface and click Edit.

3

Configure the applicable settings.

4

Click OK.

Note - You cannot change the VLAN ID or physical interface for an existing VLAN interface. To change these parameters, delete the VLAN interface and then create a new VLAN interface.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

Select a VLAN interface and click Delete.

3

Click OK, when the confirmation message shows.

Configuring VLAN Interfaces in Gaia Clish

Important:

  • On Scalable Platforms (Maestro and Chassis), you must run the applicable commands in Gaia gClish of the applicable Security Group.

  • Make sure that the physical interface, on which you wish to add a VLAN interface, does not have an IP address.

Syntax

add interface <Name of Physical Interface> vlan <VLAN ID> 

set interface <Name of Physical Interface>.<VLAN ID>
      comments "Text"
      ipv4-address <IPv4 Address>
            subnet-mask <Mask>
            mask-length <Mask Length>
      ipv6-address <IPv6 Address> mask-length <Mask Length>
      ipv6-autoconfig {on | off}
      mtu <68-16000 | 1280-16000>
      state {on | off}

Note - You cannot change the VLAN ID or physical interface for an existing VLAN interface. To change these parameters, delete the VLAN interface and then create a new VLAN interface.

show interface<SPACE><TAB>

show interface <Name of VLAN Interface>

delete interface <Name of Physical Interface> vlan <VLAN ID>

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently.

Parameters

Parameter

Description

<Name of Physical Interface>

Specifies a physical interface.

comments "Text"

Defines the optional comment.

  • Write the text in double quotes.

  • Text must be up to 100 characters.

  • This comment appears in the Gaia Portal and in the output of the "show configuration" command.

<VLAN ID>

Configures the ID of the VLAN interface (integer between 2 and 4094).

<IPv4 Address>

Assigns the IPv4 address.

<IPv6 Address>

Assigns the IPv6 address.

Important - First, you must enable the IPv6 Support and reboot (see System Configuration).

subnet-mask <Mask>

Configures the IPv4 subnet mask using the dotted decimal notation (X.X.X.X) - integer between 2 and 32..

mask-length <Mask Length>

Configures the IPv6 subnet mask length using CIDR notation (/xx) - integer between 1 and 128.

ipv6-autoconfig {on | off}

Configures if this interface gets an IPv6 address from a DHCPv6 Server:

  • on - Gets an IPv6 address from a DHCPv6 Server

  • off - Does not get an IPv6 address from a DHCPv6 Server (you must assign it manually)

Important - First, you must enable the IPv6 Support and reboot (see System Configuration).

mtu <68-16000 | 1280-16000>

Configures the Maximum Transmission Unit size for an interface.

For IPv4:

  • Range: 68 - 16000 bytes

  • Default: 1500 bytes

For IPv6:

  • Range: 1280 - 16000 bytes

  • Default: 1500 bytes

state {on | off}

Configures interface's state:

  • on - Enabled

  • off - Disabled

 
gaia> add interface vlan eth1
gaia> set interface eth1.99 ipv4-address 99.99.99.1 subnet-mask 255.255.255.0
gaia> set interface eth1.99 ipv6-address 209:99:1 mask-length 64
gaia> delete interface eth1 vlan 99

Access Mode VLAN and Trunk Mode VLAN

VLAN traffic can pass through a Bridge interface in one of these modes:

If you configure the switch ports in Access Mode, create the Bridge interface with two VLAN interfaces as its subordinate interfaces.

For VLAN translation, use different numbered VLAN interfaces to create the Bridge interface.

You can build multiple VLAN translation bridges on the same Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources..

  1. Configure two VLAN interfaces.

  2. Create a Bridge interface and select the VLAN interfaces as its subordinate interfaces (see Bridge Interfaces).

Note - VLAN translation is not supported over bridged ports of a FONIC (Fail-Open NIC, see sk85560).

Example topology:

Item

Description

1

Security Gateway

2

Switch

3

Access mode bridge 1 with VLAN translation

4

Access mode bridge 2 with VLAN translation

5

VLAN 3 (eth 1.3)

6

VLAN 33 (eth 2.33)

7

VLAN 2 (eth 1.2)

8

VLAN 22 (eth 2.22)

If you configure the switch ports as VLAN trunk, the Check Point Bridge interface should not interfere with the VLANs.

To configure a Bridge interface with VLAN trunk, create the Bridge interface with two physical (non-VLAN) interfaces as its subordinate interfaces (see Bridge Interfaces).

The Security Gateway processes the tagged packet and does not remove VLAN tags from them.

The traffic passes with the original VLAN tag to its destination.

Note - VLAN translation is not supported in Trunk mode.