Physical Interfaces

This section has configuration procedures and examples for defining different types of interfaces on a Gaia platform.

Gaia automatically identifies physical interfaces (NICs) installed on the computer.

You cannot add or delete a physical interface in the Gaia Portal or Gaia Clish.

You cannot add, change or remove physical interface cards while the Gaia computer is running.

Step

Instructions

1

Turn off the Gaia computer:

  • In Gaia Portal:

    Click Maintenance > Shut Down, and click Halt

  • In Gaia Clish:

    Run: halt

2

Add, remove, or replace the interface cards.

3

Turn on the Gaia computer.

Gaia automatically identifies the new or changed physical interfaces and assigns an interface name. The physical interfaces show in the list in the Gaia Portal.

Configuring Physical Interfaces in Gaia Portal

This section includes the procedure for changing physical interface parameters in the Gaia Portal.

Note - There are settings that you can configure only in Gaia Clish.

Important - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

In the section Interfaces, select an interface from the list and click Edit.

3

Select the Enable option to set the interface status to UP.

4

In the Comment field, enter the applicable comment text (up to 100 characters).

5

On the IPv4 tab, do one of these:

  • Select Obtain IPv4 address automatically to get the IPv4 address from the DHCPv4 server.

    Important - Scalable Platform Security Groups do not support this feature (Known Limitation MBS-3246).

  • Enter the IPv4 address and subnet mask in the applicable fields.

6

Optional: On the IPv6 tab, do one of these:

  • Select Obtain IPv6 address automatically via Autoconfig.

  • Select Obtain IPv6 address automatically via Normal DHCPv6.

  • Select Obtain IPv6 address automatically via Prefix Delegation.

  • Select Use the following IPv6 address.

Important:

  • First, you must enable the IPv6 Support and reboot (see System Configuration).

  • Maestro Security Groups do not support an IPv6 address on eth<X>-Mgmt<X> interfaces (Known Limitation MBS-5482).

  • On a Multi-Domain Security Management Server, follow these instructions to configure an IPv6 address - Configuring an IPv6 Address on a Multi-Domain Server.

  • Scalable Platforms (ElasticXL, Maestro, and Chassis) do not support an automatic assignment of an IPv6 address.

7

On the Ethernet tab:

  • Select Auto Negotiation, or select a link speed and duplex setting from the list.

  • In the Hardware Address field, enter the Hardware MAC address (if not automatically received from the NIC).

    Warning - Do not manually change the MAC address unless you are sure that it is incorrect or has changed. An incorrect MAC address can lead to a communication failure.

  • In the MTU field, enter the applicable Maximum Transmission Unit (MTU) value.

    For IPv4:

    • Range: 68 - 16000 bytes

    • Default: 1500 bytes

    For IPv6:

    • Range: 1280 - 16000 bytes

    • Default: 1500 bytes

    Note - For Jumbo Frame support in Check Point Appliances, see sk111407.

  • Select Monitor Mode, if needed.

    For the configuration procedure:

8

On the SD-WAN tab, configure the applicable settings, if this Security Gateway must participate in SD-WAN.

See the SD-WAN Administration Guide.

9

Click OK.

See Gaia Management Interface.

See the SD-WAN Administration Guide.

You can configure SD-WAN settings on interfaces in one of these ways:

  • In the section Interfaces - in the properties of each interface.

  • In the section SD-WAN Interfaces.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

In the section SD-WAN Interfaces:

  • Click Add to configure SD-WAN settings for the first time on an interface.

  • Select an interface and click Edit to change SD-WAN settings on an interface.

  • Select an interface and click Delete to remove SD-WAN settings from an interface.

Configuring Physical Interfaces in Gaia Clish

Important - On Scalable Platforms, you must run the applicable commands in Gaia gClish of the applicable Security Group.

Syntax

set interface <Name of Physical Interface>

      auto-negotiation {on | off}

      breakout-mode {40G/full | 10G/full(breakout)} [force]

      comments "Text"

      enable-sgt {on | off}

      fec {auto | baser | off | rs}

      ipv4-address <IPv4 Address> {subnet-mask <Mask> | mask-length <Mask Length>}

      ipv6-address <IPv6 Address> mask-length <Mask Length>

      ipv6-autoconfig {on | off}

      link-speed {10M/half | 10M/full | 100M/half | 100M/full | 1000M/full | 10000M/full} [force]

      links <Number>

      mac-addr <MAC Address>

      monitor-mode {on | off}

      mtu <68-16000 | 1280-16000>

      multi-queue {auto | manual core <IDs of CPU Cores> | off}

      rx-ringsize <0-4096>

      sdwan

            circuit-id <Number>

            download-speed <Number>

            nat <IP address>

            next-hop <IP address>

                  is_mpls

                        nat <IP address> tag <Text>

                        tag <Text> nat <IP address>

                  nat <VALUE>

                        is_mpls tag <Text>

                        tag <Text>

                  tag <Text>

                        is_mpls nat <IP address>

                        nat <IP address>

            tag <Text>

            upload-speed <Number>

      state {on | off}

      tx-ringsize <0-4096>

 

show interfaces all

show interface <Name of Physical Interface>

show interface <Name of Physical Interface><SPACE><TAB>

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently. Scalable Platforms save the changes automatically.

Parameters

Parameter

Description

interface <Name of Physical Interface>

Specifies a physical interface.

auto-negotiation {on | off}

Configures automatic negotiation of interface link speed and duplex settings:

  • on - Enabled

  • off - Disabled

breakout-mode {40G/full | 10G/full(breakout)} [force]

Configures the breakout-mode for the 100G Port port of an acceleration card when you connect a split cable to this port.

comments "Text"

Configures an optional free text comment.

  • Write the text in double quotes.

  • Text must be up to 100 characters.

  • This comment appears in the Gaia Portal and in the output of the "show configuration" command.

enable-sgt {on | off}

Enables the interface to accept and trust traffic that contains Cisco Security Group Tags (SGTs).

See the R82.20 Identity Awareness Administration Guide > Chapter "Identity Awareness Environment" > Section "Support for Cisco Security Group Tags (SGTs)"

fec {auto | baser | off | rs}

Configures the Forward Error Correction (FEC) mode for SD-WAN.

See the SD-WAN Administration Guide.

ipv4-address <IPv4 Address>

Configures the IPv4 address.

ipv6-address <IPv6 Address>

Configures the IPv6 address.

Important:

  • First, you must enable the IPv6 Support and reboot (see System Configuration).

  • Maestro Security Groups do not support an IPv6 address on eth<X>-Mgmt<X> interfaces (Known Limitation MBS-5482).

subnet-mask <Mask>

Configures the IPv4 subnet mask using dotted decimal notation (X.X.X.X).

mask-length <Mask Length>

Configures the IPv4 or IPv6 subnet mask length using the CIDR notation (integer between 2 and 32).

ipv6-autoconfig {on | off}

Configures if this interface gets an IPv6 address from a DHCPv6 Server:

  • on - Gets an IPv6 address from a DHCPv6 Server

  • off - Does not get an IPv6 address from a DHCPv6 Server (you must assign it manually)

Important:

  • First, you must enable the IPv6 Support and reboot (see System Configuration).

  • Scalable Platforms (ElasticXL, Maestro, and Chassis) do not support an automatic assignment of an IPv6 address.

link-speed {10M/half | 10M/full | 100M/half | 100M/full | 1000M/full | 1000M/full} [force]

Configures the interface link speed and duplex status.

Available speed and duplex combinations are:

  • 10M/half

  • 10M/full

  • 100M/half

  • 100M/full

  • 1000M/full

  • 10000M/full

links <Number>

Configures the minimum number of required link interfaces for a ClusterXL Bond Load Sharing.

mac-addr <MAC Address>

Configures the hardware MAC address.

monitor-mode {on | off}

Configures Monitor Mode on this interface:

  • on - Enabled

  • off - Disabled

Default: off

For the configuration procedure:

mtu <68-16000 | 1280-16000>

Configures the Maximum Transmission Unit size for an interface.

For IPv4:

  • Range: 68 - 16000 bytes

  • Default: 1500 bytes

For IPv6:

  • Range: 1280 - 16000 bytes

  • Default: 1500 bytes

Note - For Jumbo Frame support in Check Point Appliances, see sk111407.

multi-queue {auto | manual core <IDs of CPU Cores> | off}

Configures Multi-Queue on this interface:

  • auto

    Automatic mode.

    Multi-Queue automatically configures the affinity of all supported interfaces to CPU cores that run CoreXL SND Instances.

  • manual core <IDs of CPU Cores>

    Manual mode.

    You configure the affinity of this interface to CPU cores that run CoreXL SND Instances.

  • off

    Disables the Multi-Queue on this interface.

Default: auto

For more information about Multi-Queue, see the R82 Performance Tuning Administration Guide.

rx-ringsize <0-4096>

Configures the receive buffer size.

  • Range: 0 - 4096 bytes

  • Default: Depends on the interface driver

Warning - Scalable Platforms support this configuration only on eth<X>-Mgmt<X> and BPEth<X> interfaces (Limitation ID PMTR-91054).

sdwan circuit-id <Number>

Configures the SD-WAN Circuit ID.

See the SD-WAN Administration Guide.

sdwan download-speed <Number>

Configures the SD-WAN download speed in Mbps.

See the SD-WAN Administration Guide.

sdwan nat <IP address>

Configures the NAT IP address.

See the SD-WAN Administration Guide.

sdwan next-hop <IP address>

Configures the Next Hop IP address.

See the SD-WAN Administration Guide.

The parameter "is_mpls" specifies that this interface connects to a Private Link (for example, MPLS).

sdwan tag <Text>

Configures the SD-WAN tag text.

See the SD-WAN Administration Guide.

sdwan upload-speed <Number>

Configures the SD-WAN upload speed in Mbps.

See the SD-WAN Administration Guide.

state {on | off}

Configures the interface state:

  • on - Enabled

  • off - Disabled

tx-ringsize <0-4096>

Configures the transmit buffer size.

  • Range: 0 - 4096 bytes

  • Default: Depends on the interface driver

Warning - Scalable Platforms support this configuration only on eth<X>-Mgmt<X> and BPEth<X> interfaces (Limitation ID PMTR-91054).

 
gaia> set interface eth2 ipv4-address 40.40.40.1 subnet-mask 255.255.255.0
gaia> set interface eth2 mtu 1400
gaia> set interface eth2 state on
gaia> set interface eth2 link-speed 100M/full

Integrated Switching on Check Point Firewall 3900 Appliances

Overview

The Integrated Switching enables supported appliances to use an integrated hardware switch for direct traffic forwarding between selected interfaces.

The Integrated Switching allows grouping of the switch-connected interfaces. Traffic between interfaces in the same group is forwarded directly by the hardware switch.

Key Behavior

  • When traffic flows between interfaces in the same Switching Group the traffic does not pass through the CPU or firewall inspection path.

  • Traffic is forwarded directly at the switch level:

    • Reduces CPU usage

    • Improves throughput.

Use Cases

You can assign interfaces to different Switching Groups to separate environments, for example:

  • Development network

  • Production network

Traffic between interfaces in the same switching group bypasses firewall inspection because it is switched at the hardware level. Ensure that grouping reflects trusted network boundaries.

Switching Groups

A switching group is a logical group of LAN interfaces.

  • By default, each LAN interface belongs to its own switching group.

  • When you assign two or more LAN interfaces to the same switching group, Gaia enables local forwarding between them.

  • Each switching group is represented by a logical interface.

You manage switching groups in Gaia.

Traffic Flow

Traffic handling depends on the switching group configuration:

  • Traffic within a switching group.

    The hardware switch forwards the traffic locally between the LAN interfaces, without reaching Gaia.

  • Traffic between switching groups.

    Gaia processes the traffic through the Check Point Firewall.

    Firewall inspection is applied according to the installed policy.

  • Traffic to external networks.

    Gaia processes the traffic through the Check Point Firewall.

    Firewall inspection is applied.

Notes:

  • LAN interfaces in a switching group must not have IP addresses.

  • Devices connected to the same switching group must be in the same IP subnet.

  • The switching group logical interface has an IP address.

  • The IP address of the switching group interface is the default gateway for that subnet.

Configuration

When configuring switching groups, the following rules apply:

  • A physical interface can be added to a switching group only if it does not have an IP address assigned.

  • All hosts connected to interfaces in the same switching group must belong to the same IP subnet.

  • Each switching group is represented by a virtual interface.

  • The IP address configured on the switching group interface is used as the default gateway for the subnet.

  • The show switching group command displays the switching group configuration and the MAC learning table.

Configuring Switching Groups Using the CLI (clish)

To create a Switching Group:

add switching group <id>

To add Interfaces to a Switching Group:

add switching group <id> interface <ethN>

Repeat this command for each interface that should participate in the switching group.

The interfaces must not have IP addresses configured.

Note - The switching group does not need to exist before you add an interface to it. If the switching group does not exist, it is created automatically.

To configure the Switching Group Interface:

set interface <swN> ...

Configure the switching group interface (swN) with the required IP address and interface parameters.

This IP address is used as the default gateway for the subnet.

To remove an Interface from a Switching Group:

delete switching group <id> interface <ethN>

Removes a physical interface from the specified Switching Group.

To delete a Switching Group:

delete switching group <id>

The Switching Group must be empty before it can be deleted.

Configuring Switching Groups Using the WebUI

You can also configure switching groups from the Gaia WebUI:

  1. Navigate to Network Management.

  2. Create or edit a Switching Group.

  3. Add physical interfaces to the Switching Group.

  4. Configure the Switching Group interface (swN) with an IP address.

  5. Save and apply the configuration.

Validation and Monitoring

To validate that traffic within a Switching Group is handled by the switch hardware, use the following commands.

Reset software path counters:

fwaccel swp reset cpu
fwaccel swp reset eth1
fwaccel swp reset eth2

Compare traffic paths:

watch -d "fwaccel swp diff eth1 eth2"

Expected results:

  • Traffic between interfaces in the same switching group does not increase CPU or firewall counters.

  • Traffic outside the Switching Group is processed by the firewall and reflected in CPU counters.