Bridge Mode

By implementing native Layer 2 bridging instead of IP routing, you can add Virtual Systems without adversely affecting the existing IP structure.

When in the Bridge modeClosed Security Gateway or Virtual System that works as a Layer 2 bridge device for easy deployment in an existing topology., Virtual SystemClosed Virtual Device on a VSX Gateway or VSX Cluster Member that implements the functionality of a Security Gateway. Acronym: VS. interfaces do not require IP addresses.

You can optionally assign an IP address to the Virtual System itself (not the interfaces) to enable Layer 3 monitoring, which provides network fault detection functionality.

VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. supports these Bridge mode models:

Active/Active Bridge Mode (Spanning Tree Protocol)

The Spanning Tree Protocol is an industry standard technology to prevent loops in high-speed switched networks.

To use the STP Bridge mode, you must have STP deployed and properly configured on your network.

These STP Layer 2 protocols are supported:

  • 802.1d

  • 802.1q

  • 802.1s

  • 802.1w

  • PVST+

See your vendor documentation to learn how to deploy and configure STP on your network hardware.

Active/Standby Bridge Mode

The Active/Standby Bridge Mode enhances both:

Active/Standby Bridge Mode has these advantages:

  • Instantaneous failover.

  • Enhanced administrator control over bridge failover.

  • VSLS support.

  • VLAN translation.

The principal limitation of the Active/Standby Bridge Mode is that it breaks the STP tree structure.

Note - When configuring a Virtual System in the Active/Standby Bridge Mode, you should remove Virtual System VLANs from the STP database in the switches. This action prevents delays due to trunk interface failback.

Three Layer Hierarchical Model

A three-layer hierarchical model is used in large, high-traffic network environments.

  1. A core network, with high-speed backbone switches that direct traffic to and from the Internet and other external networks.

  2. A distribution layer, with routers, for connectivity between the core and the access layer.

  3. An access layer, with redundant LAN switches, that forward traffic to and from internal networks.

VSX in Active/Standby Bridge Mode is incorporated in the distribution layer, enforcing the security policyClosed Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection..

The routers direct external traffic to the appropriate Virtual System through a segregated VLAN. Inspected traffic exits the Virtual System through a separate segregated VLAN, to the routers and then to internal destinations.

VLAN Shared Interface Deployment

In this deployment, which cannot function using a standard STP Bridge mode configuration, each VSX Cluster MemberClosed Security Gateway that is part of a cluster. connects to pair of redundant switches through a VLAN Trunk.

All Virtual Systems in a given VSX Cluster Member share the same VLAN Trunk.










Virtual System 3 is Backup


Redundant switches (external)



Redundant switches (internal)


VSX Cluster



VLAN Switch


VSX Cluster Member 1



Internal Networks


VSX Cluster Member 2


Sync Network


Virtual Systems in Bridge Mode


Physical Interface


Virtual System 1 is Active


VLAN Trunk


Virtual System 2 is Standby




With Active/Standby Bridge Mode in High Availability mode, VSX Cluster directs traffic to VSX Cluster Members according to administrator-defined priorities and status.

In Virtual System Load Sharing deployments, the system distributes the traffic load amongst VSX Cluster Members according to the Virtual System Load Sharing configuration.