Physical Interfaces

This section has configuration procedures and examples for defining different types of interfaces on a Gaia platform.

Gaia automatically identifies physical interfaces (NICs) installed on the computer.

You cannot add or delete a physical interface in the Gaia Portal or Gaia Clish.

You cannot add, change or remove physical interface cards while the Gaia computer is running.

Step

Instructions

1

Turn off the Gaia computer:

  • In Gaia Portal:

    Click Maintenance > Shut Down, and click Halt

  • In Gaia Clish:

    Run: halt

2

Add, remove, or replace the interface cards.

3

Turn on the Gaia computer.

Gaia automatically identifies the new or changed physical interfaces and assigns an interface name. The physical interfaces show in the list in the Gaia Portal.

Configuring Physical Interfaces in Gaia Portal

This section includes the procedure for changing physical interface parameters in the Gaia Portal.

Note - There are settings that you can configure only in Gaia Clish.

Important - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

In the section Interfaces, select an interface from the list and click Edit.

3

Select the Enable option to set the interface status to UP.

4

In the Comment field, enter the applicable comment text (up to 100 characters).

5

On the IPv4 tab, do one of these:

  • Select Obtain IPv4 address automatically to get the IPv4 address from the DHCPv4 server.

    Important - Scalable Platform Security Groups do not support this feature (Known Limitation MBS-3246).

  • Enter the IPv4 address and subnet mask in the applicable fields.

6

Optional: On the IPv6 tab, do one of these:

  • Select Obtain IPv6 address automatically via Autoconfig.

  • Select Obtain IPv6 address automatically via Normal DHCPv6.

  • Select Obtain IPv6 address automatically via Prefix Delegation.

  • Select Use the following IPv6 address.

Important:

  • First, you must enable the IPv6 Support and reboot (see System Configuration).

  • R82 does not support IPv6 Address on the Gaia Management Interface (Known Limitation PMTR-47313).

  • Maestro Security Groups do not support an IPv6 address on eth<X>-Mgmt<X> interfaces (Known Limitation MBS-5482).

  • On a Multi-Domain Security Management Server, follow these instructions to configure an IPv6 address - Configuring an IPv6 Address on a Multi-Domain Server.

  • Scalable Platforms (ElasticXL, Maestro, and Chassis) do not support an automatic assignment of an IPv6 address.

7

On the Ethernet tab:

  • Select Auto Negotiation, or select a link speed and duplex setting from the list.

  • In the Hardware Address field, enter the Hardware MAC address (if not automatically received from the NIC).

    Warning - Do not manually change the MAC address unless you are sure that it is incorrect or has changed. An incorrect MAC address can lead to a communication failure.

  • In the MTU field, enter the applicable Maximum Transmission Unit (MTU) value.

    For IPv4:

    • Range: 68 - 16000 bytes

    • Default: 1500 bytes

    For IPv6:

    • Range: 1280 - 16000 bytes

    • Default: 1500 bytes

    Notes:

    • For Jumbo Frame support in Check Point Appliances, see sk111407.

    • Scalable Chassis 40000 / 60000 support the maximum MTU of 9000 bytes for the SSM440 ports (Limitation ID 02169635).

  • Select Monitor Mode, if needed.

    For the configuration procedure:

8

On the SD-WAN tab, configure the applicable settings, if this Security Gateway must participate in SD-WAN.

See the Quantum SD-WAN Administration Guide.

9

Click OK.

See Gaia Management Interface.

See the Quantum SD-WAN Administration Guide.

You can configure SD-WAN settings on interfaces in one of these ways:

  • In the section Interfaces - in the properties of each interface.

  • In the section SD-WAN Interfaces.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

In the section SD-WAN Interfaces:

  • Click Add to configure SD-WAN settings for the first time on an interface.

  • Select an interface and click Edit to change SD-WAN settings on an interface.

  • Select an interface and click Delete to remove SD-WAN settings from an interface.

Configuring Physical Interfaces in Gaia Clish

Important - On Scalable Platforms, you must run the applicable commands in Gaia gClish of the applicable Security Group.

Syntax

set interface <Name of Physical Interface>

      auto-negotiation {on | off}

      breakout-mode {40G/full | 10G/full(breakout)} [force]

      comments "Text"

      ipv4-address <IPv4 Address> {subnet-mask <Mask> | mask-length <Mask Length>}

      ipv6-address <IPv6 Address> mask-length <Mask Length>

      ipv6-autoconfig {on | off}

      link-speed {10M/half | 10M/full | 100M/half | 100M/full | 1000M/full | 10000M/full} [force]

      links <Number>

      mac-addr <MAC Address>

      monitor-mode {on | off}

      mtu <68-16000 | 1280-16000>

      multi-queue {auto | manual core <IDs of CPU Cores> | off}

      rx-ringsize <0-4096>

      sdwan

            circuit-id <Number>

            download-speed <Number>

            nat <IP address>

            next-hop <IP address>

                  is_mpls

                        nat <IP address> tag <Text>

                        tag <Text> nat <IP address>

                  nat <VALUE>

                        is_mpls tag <Text>

                        tag <Text>

                  tag <Text>

                        is_mpls nat <IP address>

                        nat <IP address>

            tag <Text>

            upload-speed <Number>

      state {on | off}

      tx-ringsize <0-4096>

show interfaces all

show interface <Name of Physical Interface>

show interface <Name of Physical Interface><SPACE><TAB>

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently. Scalable Platforms save the changes automatically.

Parameters

Parameter

Description

interface <Name of Physical Interface>

Specifies a physical interface.

auto-negotiation {on | off}

Configures automatic negotiation of interface link speed and duplex settings:

  • on - Enabled

  • off - Disabled

breakout-mode {40G/full | 10G/full(breakout)} [force]

Configures the breakout-mode for the 100G Port port of an acceleration card when you connect a split cable to this port.

comments "Text"

Configures an optional free text comment.

  • Write the text in double quotes.

  • Text must be up to 100 characters.

  • This comment appears in the Gaia Portal and in the output of the "show configuration" command.

ipv4-address <IPv4 Address>

Configures the IPv4 address.

ipv6-address <IPv6 Address>

Configures the IPv6 address.

Important:

  • First, you must enable the IPv6 Support and reboot (see System Configuration).

  • R82 does not support IPv6 Address on the Gaia Management Interface (Known Limitation PMTR-47313).

  • Maestro Security Groups do not support an IPv6 address on eth<X>-Mgmt<X> interfaces (Known Limitation MBS-5482).

subnet-mask <Mask>

Configures the IPv4 subnet mask using dotted decimal notation (X.X.X.X).

mask-length <Mask Length>

Configures the IPv4 or IPv6 subnet mask length using the CIDR notation (integer between 2 and 32).

ipv6-autoconfig {on | off}

Configures if this interface gets an IPv6 address from a DHCPv6 Server:

  • on - Gets an IPv6 address from a DHCPv6 Server

  • off - Does not get an IPv6 address from a DHCPv6 Server (you must assign it manually)

Important:

  • First, you must enable the IPv6 Support and reboot (see System Configuration).

  • Scalable Platforms (ElasticXL, Maestro, and Chassis) do not support an automatic assignment of an IPv6 address.

link-speed {10M/half | 10M/full | 100M/half | 100M/full | 1000M/full | 1000M/full} [force]

Configures the interface link speed and duplex status.

Available speed and duplex combinations are:

  • 10M/half

  • 10M/full

  • 100M/half

  • 100M/full

  • 1000M/full

  • 10000M/full

links <Number>

Configures the minimum number of required link interfaces for a ClusterXL Bond Load Sharing.

mac-addr <MAC Address>

Configures the hardware MAC address.

monitor-mode {on | off}

Configures Monitor Mode on this interface:

  • on - Enabled

  • off - Disabled

Default: off

For the configuration procedure:

mtu <68-16000 | 1280-16000>

Configures the Maximum Transmission Unit size for an interface.

For IPv4:

  • Range: 68 - 16000 bytes

  • Default: 1500 bytes

For IPv6:

  • Range: 1280 - 16000 bytes

  • Default: 1500 bytes

Notes:

  • For Jumbo Frame support in Check Point Appliances, see sk111407.

  • Scalable Chassis 40000 / 60000 support the maximum MTU of 9000 bytes for the SSM440 ports (Limitation ID 02169635).

multi-queue {auto | manual core <IDs of CPU Cores> | off}

Configures Multi-Queue on this interface:

  • auto

    Automatic mode.

    Multi-Queue automatically configures the affinity of all supported interfaces to CPU cores that run CoreXL SND Instances.

  • manual core <IDs of CPU Cores>

    Manual mode.

    You configure the affinity of this interface to CPU cores that run CoreXL SND Instances.

  • off

    Disables the Multi-Queue on this interface.

Default: auto

For more information about Multi-Queue, see the R82 Performance Tuning Administration Guide.

rx-ringsize <0-4096>

Configures the receive buffer size.

  • Range: 0 - 4096 bytes

  • Default: Depends on the interface driver

Warning - Scalable Platforms support this configuration only on eth<X>-Mgmt<X> and BPEth<X> interfaces (Limitation ID PMTR-91054).

sdwan circuit-id <Number>

Configures the SD-WAN Circuit ID.

See the Quantum SD-WAN Administration Guide.

sdwan download-speed <Number>

Configures the SD-WAN download speed in Mbps.

See the Quantum SD-WAN Administration Guide.

sdwan nat <IP address>

Configures the NAT IP address.

See the Quantum SD-WAN Administration Guide.

sdwan next-hop <IP address>

Configures the Next Hop IP address.

See the Quantum SD-WAN Administration Guide.

The parameter "is_mpls" specifies that this interface connects to a Private Link (for example, MPLS).

sdwan tag <Text>

Configures the SD-WAN tag text.

See the Quantum SD-WAN Administration Guide.

sdwan upload-speed <Number>

Configures the SD-WAN upload speed in Mbps.

See the Quantum SD-WAN Administration Guide.

state {on | off}

Configures the interface state:

  • on - Enabled

  • off - Disabled

tx-ringsize <0-4096>

Configures the transmit buffer size.

  • Range: 0 - 4096 bytes

  • Default: Depends on the interface driver

Warning - Scalable Platforms support this configuration only on eth<X>-Mgmt<X> and BPEth<X> interfaces (Limitation ID PMTR-91054).

 
gaia> set interface eth2 ipv4-address 40.40.40.1 subnet-mask 255.255.255.0
gaia> set interface eth2 mtu 1400
gaia> set interface eth2 state on
gaia> set interface eth2 link-speed 100M/full