VLAN Interfaces

This section shows you how to configure VLAN interfaces in the Gaia Portal and Gaia Clish.

You can configure virtual LAN (VLAN) interfaces on Ethernet interfaces.

VLAN interfaces let you configure subnets with a secure private link to Security Gateways and Management Servers using your existing topology.

With VLAN interfaces, you can multiplex Ethernet traffic into many channels using one cable.

Important - In a Cluster, you must configure all the Cluster Members in the same way.

Notes:

  • The name of a VLAN interface in Gaia is "<Name of Physical Interface>.<VLAN ID>".

    For example, the name of a VLAN interface with a VLAN ID of 5 on a physical interface eth1 is "eth1.5".

  • The VLAN tunnel is not secure, because it is not encrypted.

  • To configure MTU on a VLAN interface, you must configure MTU on the physical interface.

    This MTU applies to all VLAN interfaces configured on this physical interface.

  • The Gaia operating system supports the VLAN tagging protocol IEEE 802.1Q.

Configuring VLAN Interfaces in Gaia Portal

Important - On Scalable Platforms (ElasticXL, Maestro, and Chassis), you must connect to the Gaia Portal of the applicable Security Group.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

Make sure that the physical interface, on which you add a VLAN interface, does not have an IP address.

3

Click Add > VLAN.

4

In the Add VLAN window, select the Enable option to set the VLAN interface to UP.

5

On the IPv4 tab, do one of these:

  • Select Obtain IPv4 address automatically to get the IPv4 address from the DHCPv4 server.

    Important - Scalable Platforms (ElasticXL, Maestro, and Chassis) do not support this feature (Known Limitation MBS-3246).

  • Enter the IPv4 address and subnet mask in the applicable fields.

6

Optional: On the IPv6 tab, do one of these:

  • Select Obtain IPv6 address automatically via Autoconfig.

  • Select Obtain IPv6 address automatically via Normal DHCPv6.

  • Select Obtain IPv6 address automatically via Prefix Delegation.

  • Select Use the following IPv6 address.

Important:

  • First, you must enable the IPv6 Support and reboot (see System Configuration).

  • R82 does not support IPv6 Address on the Gaia Management Interface (Known Limitation PMTR-47313).

  • On a Multi-Domain Security Management Server, follow these instructions to configure an IPv6 address - Configuring an IPv6 Address on a Multi-Domain Server.

  • Scalable Platforms (ElasticXL, Maestro, and Chassis) do not support this feature (Known Limitation MBS-3246).

7

On the VLAN tab, enter or select a VLAN ID (VLAN tag) between 2 and 4094.

8

In the Member Of field, select the applicable physical interface.

9

Click OK.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

Select a VLAN interface and click Edit.

3

Configure the applicable settings.

4

Click OK.

Note - You cannot change the VLAN ID or physical interface for an existing VLAN interface. To change these parameters, delete the VLAN interface and then create a new VLAN interface.

Step

Instructions

1

In the navigation tree, click Network Management > Network Interfaces.

2

Select a VLAN interface and click Delete.

3

Click OK, when the confirmation message shows.

Configuring VLAN Interfaces in Gaia Clish

Important:

  • On Scalable Platforms (ElasticXL, Maestro, and Chassis), you must run the applicable commands in Gaia gClish of the applicable Security Group.

  • Make sure that the physical interface, on which you wish to add a VLAN interface, does not have an IP address.

Syntax

add interface <Name of Physical Interface> vlan <VLAN ID> 

set interface <Name of Physical Interface>.<VLAN ID>
      comments "Text"
      ipv4-address <IPv4 Address>
            subnet-mask <Mask>
            mask-length <Mask Length>
      ipv6-address <IPv6 Address> mask-length <Mask Length>
      ipv6-autoconfig {on | off}
      mtu <68-16000 | 1280-16000>
      state {on | off}

Note - You cannot change the VLAN ID or physical interface for an existing VLAN interface. To change these parameters, delete the VLAN interface and then create a new VLAN interface.

show interface<SPACE><TAB>

show interface <Name of VLAN Interface>

delete interface <Name of Physical Interface> vlan <VLAN ID>

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently. Scalable Platforms save the changes automatically.

Parameters

Parameter

Description

<Name of Physical Interface>

Specifies a physical interface.

comments "Text"

Defines the optional comment.

  • Write the text in double quotes.

  • Text must be up to 100 characters.

  • This comment appears in the Gaia Portal and in the output of the "show configuration" command.

<VLAN ID>

Configures the ID of the VLAN interface (integer between 2 and 4094).

<IPv4 Address>

Assigns the IPv4 address.

<IPv6 Address>

Assigns the IPv6 address.

Important - First, you must enable the IPv6 Support and reboot (see System Configuration).

subnet-mask <Mask>

Configures the IPv4 subnet mask using the dotted decimal notation (X.X.X.X) - integer between 2 and 32..

mask-length <Mask Length>

Configures the IPv6 subnet mask length using CIDR notation (/xx) - integer between 1 and 128.

ipv6-autoconfig {on | off}

Configures if this interface gets an IPv6 address from a DHCPv6 Server:

  • on - Gets an IPv6 address from a DHCPv6 Server

  • off - Does not get an IPv6 address from a DHCPv6 Server (you must assign it manually)

Important - First, you must enable the IPv6 Support and reboot (see System Configuration).

mtu <68-16000 | 1280-16000>

Configures the Maximum Transmission Unit size for an interface.

For IPv4:

  • Range: 68 - 16000 bytes

  • Default: 1500 bytes

For IPv6:

  • Range: 1280 - 16000 bytes

  • Default: 1500 bytes

state {on | off}

Configures interface's state:

  • on - Enabled

  • off - Disabled

 
gaia> add interface eth1 vlan 99
gaia> set interface eth1.99 ipv4-address 99.99.99.1 subnet-mask 255.255.255.0
gaia> set interface eth1.99 ipv6-address 209:99:1 mask-length 64
gaia> delete interface eth1 vlan 99

Access Mode VLAN and Trunk Mode VLAN

VLAN traffic can pass through a Bridge interface in one of these modes:

If you configure the switch ports in Access Mode, create the Bridge interface with two VLAN interfaces as its subordinate interfaces.

For VLAN translation, use different numbered VLAN interfaces to create the Bridge interface.

You can build multiple VLAN translation bridges on the same Security Gateway.

  1. Configure two VLAN interfaces.

  2. Create a Bridge interface and select the VLAN interfaces as its subordinate interfaces (see Bridge Interfaces).

Note - VLAN translation is not supported over bridged ports of a FONIC (Fail-Open NIC, see sk85560).

Example topology:

Item

Description

1

Security Gateway

2

Switch

3

Access mode bridge 1 with VLAN translation

4

Access mode bridge 2 with VLAN translation

5

VLAN 3 (eth 1.3)

6

VLAN 33 (eth 2.33)

7

VLAN 2 (eth 1.2)

8

VLAN 22 (eth 2.22)

If you configure the switch ports as VLAN trunk, the Check Point Bridge interface should not interfere with the VLANs.

To configure a Bridge interface with VLAN trunk, create the Bridge interface with two physical (non-VLAN) interfaces as its subordinate interfaces (see Bridge Interfaces).

The Security Gateway processes the tagged packet and does not remove VLAN tags from them.

The traffic passes with the original VLAN tag to its destination.

Note - VLAN translation is not supported in Trunk mode.