Accept, or Drop Ethernet Frames with Specific Protocols

Important:

In a Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.
On Scalable Platforms (Maestro and Chassis), you must run the applicable commands in the Expert mode on the applicable Security Group.

By default, a Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources., a Cluster, or a Scalable Platform Security Group in Bridge mode Security Gateway or Virtual System that works as a Layer 2 bridge device for easy deployment in an existing topology. allows Ethernet frames that carry protocols other than IPv4 (0x0800), IPv6 (0x86DD), or ARP (0x0806) protocols.

Administrator can configure a Security Gateway, a Cluster, or a Scalable Platform Security Group in Bridge Mode to either accept, or drop Ethernet frames that carry specific protocols.

When Access Mode VLAN (VLAN translation) is configured, BPDU frames can arrive with the wrong VLAN number to the switch ports through the Bridge interface. This mismatch can cause the switch ports to enter blocking mode.

In Active/Standby Bridge Mode only, you can disable BPDU forwarding to avoid such blocking mode:

Step

Instructions

Connect to the command line on the Security Gateway, each Cluster Member Security Gateway that is part of a cluster., or Scalable Platform Security Group.

Backup the current /etc/rc.d/init.d/network file:

On the Security Gateway / each Cluster Member:

cp -v /etc/rc.d/init.d/network{,_BKP}

On the Scalable Platform Security Group:

g_cp -v /etc/rc.d/init.d/network{,_BKP}

Edit the current /etc/rc.d/init.d/network file:

vi /etc/rc.d/init.d/network

After the line:

./etc/init.d/functions

Add this line:

/sbin/sysctl -w net.bridge.bpdu_forwarding=0

Save the changes in the file and exit the Vi editor.

On the Scalable Platform Security Group:

Copy the modified file to other Security Group Members:

asg_cp2blades -b all /etc/rc.d/init.d/network

Reboot.

On the Security Gateway / each Cluster Member:

reboot

On the Scalable Platform Security Group:

g_reboot -a

Make sure the new configuration is loaded:

On the Security Gateway / each Cluster Member:

sysctl net.bridge.bpdu_forwarding

On the Scalable Platform Security Group:

g_all sysctl net.bridge.bpdu_forwarding

The output must show:

net.bridge.bpdu_forwarding = 0