Configuring Internet Connectivity

The Device view > Network section > Internet page shows how the appliance connects to the Internet.

On this page you can:

  • Add new IPv6 and IPv4 connections and edit, delete, or disable existing connections.

    Note - Only one IPv6 connection can exist at a time.

  • Configure a single Internet connection or multiple connections in High Availability or Load Sharing configurations. When multiple Internet connections are defined, the page shows them in a table.

  • Monitor the servers and Internet connections (see Monitoring).

We recommend you contact your local Internet Service Provider (ISP) to understand how to configure your specific Internet connection.

Note - ADSL/VDSL settings are relevant only for devices that have a DSL port. In 1570 / 1590 appliances, you can also configure a DSL connection over the DMZ port (see To configure an Internet connection over the DMZ port:).

Getting Started

  1. Connect with WebUI on the Quantum Spark Appliance at this address:

    https://<IP Address>:4434

  2. Go to Device view > Network section > Internet page.

  3. Configure an Internet connection.

    1. Click New or Add an IPv4 Internet connection.

      The New Internet Connection window opens.

    2. Configure the required setting on the Configuration tab:

      1. Expand the Internet Configuration section.

      2. In the Name field, do one of these:

        • Enter a name for the connection (you can change it later).

        • Leave the default "Internet<N>" label (where <N> indicates an incrementing number).

        You can create a maximum of 32 Internet connections. This includes alias IP connections.

      3. In the Interface field, select the required interface.

        Interface

        Notes

        WAN

        Suitable for most types of Internet connections.

        You can configure multiple static IP addresses on the same WAN interface.

        VXLAN

        Creates a VXLAN connection.

        DMZ

        Suitable for most types of Internet connections.

        The DMZ port has 2 inputs:

        • LAN (RJ45) and SFP.

        • In non-VDSL 1570 / 1590 appliances, you can use an external DSL modem connected to the DMZ SFP port.

          Only Check Point Branded SFP DSL is supported. Third party SFP DSL is not supported.

        DMZ is not supported in 1530 / 1550 appliances.

        LAN<N>

        You can use unassigned LAN ports with no VLANs configured.

        When you delete the Internet connection, the port reverts to an unassigned LAN.

        If you remove or disable a LAN, any assigned alias IPs are also removed.

        Unassigned LAN ports use case - If your company is in a region where Internet connections supplied by ISPs are unreliable and experience multiple disconnections, you can connect your appliances to multiple Internet connections from different ISPs.

        New Link Aggregation (Bond)

        Creates a link between two or more physical interfaces.

        This improves performance and redundancy by increasing the network throughput and bandwidth.

        A WAN or LAN bond can act like a regular Internet connection in the cluster flow.

        A WAN bond in a cluster can be a monitoring interface.

        ADSL/VDSL

        If you select the ADSL/VDSL interface, you must select one of these in the Type field: PPPoE, IPoE - static IP, IPoE - dynamic IP.

      4. In the Type field, select the required connection type.

        Warning - When you change the connection type in an existing connection, the appliance may disconnect from the Internet.

        See:

        Based on the selected connection type, additional fields may appear.

        Connection Type

        Additional Fields

        DHCP

        None

        VXLAN

        • VNI

        • Peer address

        • Destination port

        • Internet connection

        Static IP

        • IP address

        • Subnet mask

        • Default gateway

        PPPoE

        • ISP login username

        • ISP login password

        PPTP

        or

        L2TP

        • Server IP address

        • ISP login username

        • ISP login password

        Bridge

        • Bridge to

        • DHCP/Static IP

        • Default gateway

      5. If applicable, select the option Use connection as VLAN.

      6. New in R81.10.15: High Availability Settings section.

        Note - This section is only visible if you configured a cluster.

        High Availability is enabled by default.

        Enter the Cluster IP address (the virtual IP address of the cluster) and the Peer physical IP address.

        Note - Changes made here appear in the list of Configured Interfaces on the High Availability page, including their status (High Availability or Sync). The Cluster status for an Interface also appears on the relevant Edit Internet Connection window of the Local Network page.

      7. Optional: Expand the DNS Server Settings section and configure the required DNS servers.

        This section appears for specific connection types (for example, for Static IP and Bridge).

    3. Configure the required settings on the Connection Monitoring tab:

      Note - Based on the selected connection type on the Configuration tab, some options may not be available.

      1. Expand the Connection Monitoring section.

      2. Select Automatically detect loss of connectivity to the default gateway to detect connectivity loss by sending ARP requests (pinging) to the default gateway and expecting responses.

        Important - If you use Dynamic Routing, you must clear this option to prevent probing of the default gateway.

      3. Select Monitor connection state by sending probe packets to one or more servers on the Internet to detect connectivity loss by using more methods and servers.

        Important - In versions R81.10.10 and higher, it is supported to disable probing in an Internet connection only if you clear the option, "This Internet connection will be a part of SD-WAN" (on the "Advanced" tab > section "SD-WAN Settings").

      4. In the Connection probing method section, select one of these:

        • Ping addresses - To send pings to the servers configured on this tab (enter an IP address or a hostname).

        • Probe DNS servers - To send pings to the DNS servers you configured on the Configuration tab.

    4. Configure the required settings on the Advanced tab:

      Note - Based on the selected connection type on the Configuration tab, different sections and options appear.

      In the IP Address Assignment section (for PPPoE, PPTP, or L2TP), configure the applicable settings.

      • Local tunnel IP address

        Configures how this Internet connection (PPPoE, PPTP, or L2TP) gets its local IP address - automatically or uses the configured IP address.

      • Unnumbered PPPoE

        Controls whether the appliance dials only one time and supports a range or IP addresses assigned by an ISP.

      • WAN IP assignment

        Configures how this Internet connection (PPTP or L2TP) gets its WAN IP address - automatically or uses the configured IP address, Subnet mask, and Default gateway.

      In the Service Provider Assignment section (for PPPoE, PPTP, or L2TP), configure the applicable settings.

      • Service

        Optional. Configures a name for the dial service name.

      • Authentication method

        Configures the authentication method for the dial service (Auto, PAP, CHAP).

      In the Connect on demand section (for PPPoE, PPTP, or L2TP), configure the applicable settings.

      Connect on demand

      Controls whether to use the connect-on-demand feature.

      Applies only when you are in a High Availability cluster of appliances.

      In the Port Settings section, configure the applicable settings.

      • If necessary, select Use custom MTU value and configured the MTU size value.

        You can apply an MTU on:

        • LANs and DMZ – They must be separate networks, or assigned to a bridge network.

        • Switches - The MTU is assigned to the switch itself, not the LANs that are assigned to it.

        • Bonds

        • VLANs - The VLAN MTU must be lower or equal to its parent MTU.

        You cannot apply an MTU on:

        • Interfaces assigned to switches or bonds.

        • Bridges - Configure the MTU separately for each of their children.

        • Aliases

        • Virtual Access Points

        To avoid fragmentation (which slows transmission), set the MTU according to the smallest MTU of all the network devices between your gateway and the packet destination

        For static and DHCP mode, set MTU to 1500 or lower.

        For PPPoE connections, set MTU to 1492 or lower.

        Note - When the appliance is behind a modem that works as a NAT device, the MTU value of the connection must be the same as configured in the modem. If the modem has a PPPoE connection, configure the MTU in the connection to 1492 or lower.

      • MAC address clone

        • Use default MAC address - This Internet connection uses the default MAC address of the selected physical port.

        • Override default MAC address - You can override the default MAC address for this Internet connection. This is useful when the appliance replaces another device and it is necessary to mimic its MAC address.

      • Disable auto negotiation

        If you select this option, you can configure the link speed and duplex for this Internet connection.

        Different values are available for different appliance models.

      In the QoS Settings section, configure the applicable settings.

      Important:

      • This applies only to IPv4 Internet connections.

      • To apply these QoS settings, you must enable the QoS Software Blade:

        Go to the Home view > Overview section > Security Dashboard page > in the QoS section, move the slider to the right position (enabled green).

      • Enable QoS (download)

        Enables and configures the restriction for the inbound traffic (download on the internal networks behind the appliance).

      • Enable QoS (upload)

        Enables and configures the restriction for the outbound traffic (upload on the internal networks behind the appliance).

      In the ISP Redundancy section, configure the applicable settings.

      Important:

      • This applies only to IPv4 Internet connections.

      • To apply these setting in R81.10.10 and higher, you must disable the SD-WAN Software Blade:

        Go to the Access Policy view > Firewall section > SD-WAN page > at the top, move the slider SD-WAN blade is enabled to the left position).

      You can configure multiple Internet connections in High Availability or Load Balancing modes. When you configure more two or mote Internet connections, you can configure the ISP Redundancy mode on the Device view > Network section > Internet page (at the top of the page > below the line Multiple Internet connections).

      In this ISP Redundancy section of each Internet connection you can configure the priority or weights of each Internet connection (based on the configured ISP Redundancy mode).

      • Route traffic through this connection by default

        Controls whether the appliance sends all traffic through this Internet connection.

        The appliance sends traffic through this Internet connection device only if specific, usually service-based, routing rules exist for this Internet connection. This is commonly used when you have a connection that is used for dedicated traffic.

        When you clear this option, this connection does not participate in ISP Redundancy.

      • High Availability > Priority

        Configures the priority for the Internet connection in ISP Redundancy. The appliance uses an Internet connection with a lower priority only if an Internet connection with a higher priority failed.

      • Load Balancing > Weight

        Configures how to share the traffic between the Internet connections.

      In the NAT Settings section, configure the applicable settings.

      Do not hide internal networks behind this Internet connection

      Controls whether to disable NAT for traffic from your internal networks that goes through this Internet connection.

      In the Bond Settings section, configure the applicable settings.

      • Hash policy

        Configures the Bond hash policy (how to assign connections to Active subordinate interfaces):

        • Layer2 - Based on the XOR of hardware MAC addresses.

        • Layer2+3 - Based on the XOR of hardware MAC addresses and IP addresses.

        • Layer3+4 - Based on the IP addresses and Ports.

      • MII interval

        Configures the Bond Media Monitoring Interval (MII) that specifies how much time in milliseconds to wait before checking the link on subordinate interfaces for a failure.

      In the DHCP Settings section, configure the applicable settings.

      Hostname via DHCP

      Controls whether the appliance gets its hostname from your DHCP server.

      In the SD-WAN Settings section, configure the applicable settings.

      • Download speed (Mbps)

        Configures the restriction for the inbound traffic (download on the internal networks behind the appliance) if this Internet connection participates in SD-WAN.

      • Upload speed (Mbps)

        Configures the restriction for the outbound traffic (upload on the internal networks behind the appliance) if this Internet connection participates in SD-WAN.

      • This Internet connection will be a part of SD-WAN

        Configures this Internet connection to participate in SD-WAN.

        Refer to the Access Policy view > Firewall section > SD-WAN page.

      • This Internet connection will be set as backup in SD-WAN

        Configures this Internet connection to participate in SD-WAN as a backup for the main SD-WAN Internet connection. Select this only for links that are expensive or of poor quality. For example, Cellular networks have a plan, and if you exceed your limit it can be costly. In the MPLS network, you pay per use.

  4. Click Save.

Watch the video

IPv4 Connection Types

IPv4 connection types

Select the connection type:

  • DHCP - Dynamic Host Configuration Protocol (DHCP) automatically issues IP addresses within a specified range to devices on a network. The device retains the assigned address for a specified administrator-defined period. This does not apply to the ADSL/VDSL interface.

  • Static IP - A fixed (non-dynamic) IP address. If you want an alias IP, configure another static IP type connection on the same internet port. Example: WAN and WAN:1 (WAN:1 is the alias IP).

  • PPPoE - A network protocol to encapsulate Point-to-Point Protocol (PPP) frames inside Ethernet frames. It is used mainly in DSL systems. PPPoE can run directly over the ADSL/VDSL interface as well as the DMZ interface with the SFP port. It can also run over WAN or DMZ interfaces that are typically connected to an external DSL modem. You must enter the IP address, the subnet mask, default gateway and DNS Server Settings.

  • IPoE - dynamic IP (DSL only) - The Internet IP of the appliance is imported through DHCP.

  • IPoE - static IP (DSL) - The Internet IP of the appliance is determined statically. You must enter the IP address, the subnet mask, default gateway and DNS Server Settings.

  • PPTP - The Point-to-Point Tunneling Protocol (PPTP) uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets.

  • L2TP - Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol. It does not provide any encryption or confidentiality but relies on an encryption protocol that it passes within the tunnel to provide privacy.

  • Bridge - Connects multiple network segments at the data link layer (Layer 2).

  • Bridge DHCP - The bridge is configured as a DHCP client and the DHCP settings (including IP and subnet) are removed.

  • Cellular - This is for appliances with an internal LTEClosed Long Term Evolution - a standard for wireless broadband communication for mobile devices and data terminals, based on the GSM/EDGE and UMTS/HSPA technologies. It increases the capacity and speed using a different radio interface together with core network improvements. modem. Both SIM cards are used for the internet connection with a failover between them. The cellular connection can be over IPv4 or IPv6 and is configured the same way in both.

  • Cellular Modem - Connect to the Internet with a cellular modem to the ISP through a 3G or 4G network. For this option, select the USB/Serial option in the Interface name.

    Notes:

    • Only one cellular modem is supported.

    • Only customers with an approved RFE will be supported with the external modem specified in the RFE.

Bridged Internet Connection in a Cluster

Starting from R81.10.15, you can configure a bridged internet connection in a cluster. The bridge is configured between an internet connection and a LAN interface.

Procedure:

  1. On the Internet page, click Add an internet connection. In the New Internet Connection window, for Type select Bridge.

  2. In the Bridge to field, select New This opens the New Bridge window.

  3. For Bridge children, select any LAN interface.

  4. Enter the IP address, Subnet mask and Default Gateway.

  5. Click Save.

IPv6 Connection Types

IPv6 connection types

Important - The device can have only a single IPv6 Internet connection.

  • Static IPv6 - A fixed (non-dynamic) IP address.

  • Obtain automatically (DHCPv6/SLAAC) - In both Dynamic Host Configuration Protocol (DHCP) and Stateless Address Auto Configuration (SLAAC) the user does not set the IP as this is handled by the router/DHCP server. DHCPv6 issues a full IP address. SLAAC issues an IP address prefix, and the gateway completes the rest of the address according to discovery protocols.

  • PPPoE (IPv6 only) - A network protocol to encapsulate Point-to-Point Protocol (PPP) frames inside Ethernet frames. It is used mainly with DSL services where individual users connect to the DSL modem over Ethernet and Metro Ethernet networks.

  • PPPoE (IPv4/IPv6) - Same as PPPoE ( IPv6 only), but the user must first configure a type IPv4 PPPoE internet connection on the same interface. Use this option when the ISP provides both IPv4 and IPv6 addresses through the same PPPoE connection. This prevents the need to define the same dialer connection details more than once.

  • IPv6 Bridge - A Layer 2 bridge between internal and external networks, containing both IPv4 and IPv6 addresses (or just IPv6) to make the gateway reachable through the bridge in a dual stack/pure IPv6 network.

    Supported as static WAN IP and DHCP.

To configure an Internet connection over the DMZ port:

  1. On the Configuring Internet Connectivity page, click New to create a new Internet connection.

    The New Internet Connection window opens in the Configuration tab.

  2. For Interface, select DMZ.

    • For a DSL over DMZ Connection, select SFP-DSL.

    • For a non-DSL connection, select RJ45/SFP-Fiber.

  3. Click Save.

IPv6 configuration

When an Internet connection has prefix delegation enabled, the gateway can request a prefix (in addition to an IP address) from the server and configure an internal network DHCPv6 server that uses this prefix. Connected devices are then routable without the need to use NAT.

These connection types support prefix delegation:

  • PPPoE-IPv6

  • LAN-IPv6

  • VLAN

  • Switch

  • Bridge

To enable prefix delegation in an IPv6 connection:

  1. On the Internet Connectivity page, click New to create a new IPv6 connection.

    The New IPv6 Internet Connection window opens.

  2. In the Advanced tab, select Enable prefix delegation for this Internet connection.

  3. Click Apply.

    Note - Configure the settings for this Internet connection in the Configuration tab.

A network or bridge with prefix delegation enabled must have the IPv6 Auto Assignment set to SLAAC, DHCPv6, or Disabled.

For each delegated network, the behavior depends on the IPv6 Auto Assignment settings:

IPv6 Auto Assignment setting

Delegation Action

Disabled

Address range is set according to the prefix and subnet. The DHCPv6 server is automatically enabled when it receives a prefix.

SLAAC

Addresses are provided via Stateless Address Auto Configuration, according to SLAAC rules. The prefix and subnet are provided.

DHCPv6

Address range is set according to the prefix and subnet.

On some IPv6 networks, where prefix delegation is not supported, you can use the Neighbor Discover Protocol (ND proxy) to assign globally-routable IPv6 addresses to internal (LAN) interfaces and hosts.

Workflow:

  1. The Security GatewayClosed A dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. receives a globally-routable /64 IPv6 prefix from the ISP through a dynamic IPv6 Internet-connection, using RA (Router Advertisement).

  2. Instead of assigning an IPv6 address to the Internet-connection interface (using SLAAC), the address is assigned to one of the internal interfaces(LAN, DMZ, Bridge, and so on).

  3. SLAAC is enabled automatically on the internal network/bridge.

    Hosts behind this internal network/bridge receive a globally-routable IPv6 address automatically.

  4. The Internet-connection interface is not assigned with any global IPv6 address, but still has a link-local IPv6 address.

  5. A default-gateway route is created to the ISP's gateway link-local address (as with all IPv6 Internet-connection).

  6. ND proxy is used to answer Neighbor Discovery requests from the ISP side to the internal network for hosts that were assigned addresses with IPv6 prefix received from the ISP.

To enable ND proxy:

  1. In the Configuring Internet Connectivity page, click New/Edit the IPv6 connection.

    The Edit Internet Connection window opens in the Configuration tab.

  2. For Connection type, select Obtain automatically (DHCPv6/SLAAC).

  3. In the Advanced tab, expand the Neighbor Discovery proxy section.

  4. Select the Enable Neighbor Discovery proxy checkbox.

  5. Select your local network from the drop down menu.

  6. Make sure NAT Settings are disabled:

  7. Expand the NAT Settings section and select the Do not hide internal networks behind this Internet connection checkbox.

  8. Make sure Prefix Delegation is disabled:

  9. Expand the Prefix Delegation section and make sure that Enable prefix delegation for this Internet connection is not checked.

  10. Click Apply.

This feature is available starting from R81.10.15.

Use Cases:

You can configure the IPv4 gateway setting manually while the IPv6 still uses DHCP/SLAAC and add a default IPv4 gateway.

Procedure:

  1. In the Internet page, click New/Edit the IPv6 connection.

  2. The Edit IPv6 Internet Connection window opens in the Configuration tab.

  3. For Interface, select WAN.

  4. For Type, select IPv6 Bridge.

  5. For DHCPv6/SLAAC or Static IP, select Static IP.

  6. Enter the Default gateway (IPv4).

  7. Enter the Default gateway (IPv6).

  8. Optional: In the DNS Server Settings section, enter the DNS server(s) (first, second, and third).

  9. Click Save.

DS-Lite is a connection type used by ISPs to provide Internet access to IPv4 networks and services. It can be WAN, DMZ, or an unassigned LAN port. You can use DS-Lite to carry IPv4 traffic over an IPv6 tunnel between the gateway and a server.

IPv6 connection types:

  • DHCPv6

  • PPPoE

  • Static IP - WAN, DMZ or unassigned LAN port.

The DS-Lite master WAN connection type must be one of these:

  • Dynamic IPv6

  • Static IPv6

  • PPPoEv6

  • Bridge IPv6

To enable DS-Lite:

  1. In the Configuring Internet Connectivity page, click New/Edit the IPv4 connection.

    The Edit Internet Connection window opens.

  2. For Connection type, select DS-Lite.

    Note - Make sure the interface type is the same for both IPv4 and IPv6. For example, if the IPv4 the interface is configured as WAN, the IPv6 interface must also be configured as WAN.

  3. The AFTR address field is displayed.

    Note - This field is not mandatory when the IPv6 connection type is DHCPv6.

  4. In the Linked connection field, select the IPv6 connection name.

  5. In the Advanced tab:

    • Set the default MTU of the DS-Lite interface to 1460 (IPv4 default = 1500)

    • Set the size of the IPv6 header to 40.

  6. Click Apply

IPIP, a variation of DS-Lite, is used to tunnel IPv4 traffic over IPv6-only networks. As in DS-Lite, the IPv4 traffic is tunneled over an existing IPv6 connection. The DS-Lite/IPIP tunnel is created between the client (gateway) and a peer (AFTR which resides on the ISP and is configured statically or acquired via DHCPv6).

IPIP uses the same IPv4-over-IPv6 tunnel as DS-Lite, but you can configure a static IPv4 address, which is globally routable.

The gateway first establishes an IPv6 connection to the ISP. The IPv6 address consists of:

  • Prefix - Obtained using prefix delegation or RA messages (SLAAC).

  • Suffix - Configured by the user

Comparison of DS-Lite and IPIP:

  • Both DS-Lite and IPIP use an IPv6 internet connection to carry the IPv4 traffic.

  • DS-Lite – The gateway address is non-globally-routable and automatically selected from the subnet 192.0.0.0/32.

    IPIP - The gateway address is globally-routable and you configure it manually.

  • In both DS-Lite and IPIP, you can get the prefix of the IPv6 address dynamically using SLAAC.

  • DS-Lite – The IPv6 address is automatically generated based on the acquired prefix and an auto-generated suffix, based on the interface Ethernet MAC address.

    IPIP - The IPv6 address must end with a manually configured suffix.

  • When the prefix of the IPv6 carrying the IPIP connection is changed, you must notify the IPIP tunnel provider over HTTP.

The WAN connection type of the IPIP master must be Dynamic IPv6.

To enable IPIP:

  1. Enable the IPIP feature in Advanced Settings.

  2. Configure an IPv6 Internet connection.

  3. In the Configuring Internet Connectivity page, click New/Edit the IPv4 connection.

    The Edit Internet Connection window opens.

  4. For Connection type, select IPv4 over IPv6 (IPIP).

    Note - Make sure the interface type is the same for both IPv4 and IPv6. For example, if the IPv4 the interface is configured as WAN, the IPv6 interface must also be configured as WAN.

  5. The AFTR address field appears. This field shows the hostname or IPv6 address for DS-Lite/IPIP tunnel.

    Note - This field is optional when the IPv6 connection type is DHCPv6.

  6. In the Linked connection field, select the IPv6 connection name.

    This is the IPv6 Internet connection index on which the DS-Lite/IPIP tunnel is defined.

    Note - The IPIP tunnel and its linked IPv6 connection must be on the same appliance port.

  7. In the VNE Settings section:

    VNE is an added service that enables you to send an HTTP(S) request to your provider's server and update them that your IPv6 address changed.

    For Service name, select one of these:

    • Transix - If you select this option, these fields appear:

      • Update server URL - The Server URL if your IPv6 changed. Default value: http://update.transix.jp/request

      • User Name - Your username for the updater service.

      • Password - Your username password for the updater service.

    • v6 Connect - If you select this option, these fields appear:

      • Update server URL - The Server URL if your IPv6 changed. Default value: https://v6update.asahi-net.or.jp/prefix

      • User Name - Your username for the updater service.

      • Password - Your username password for the updater service.

    • Xpass - Includes additional services such as DDNS and the ability to buy a prefix of IPv4. With Xpass, you can support 1/8/16 Static IPv4 address. If you select this option, these fields appear:

      • Update server URL - The Server URL if your IPv6 changed.

      • User name - Your username for the updater service.

      • Password - Your username password for the updater service.

      • FQDN - The URL in this contract (Example: 1234abcd.v4v6.xpass.jp this URL maps to the gateway).

      • DDNS ID - The ID for the DDNS service.

      • DDNS Pass - The password for the DDNS service.

      • Unnumbered - Select this checkbox if you want your IP1, IP8 or IP16 IPv4 address to be unnumbered for the option to assign the public IP from the WAN network on LAN.

    • General

      When you select this option, you do not need to enter your credentials.

  8. In the Advanced tab:

    1. In the IPv4 over IPv6 (IPIP) Settings section, select Enable static IPv6 suffix.

      Note - This is configured in the IPv6 connection configuration window. Otherwise, IPIP is configured on the IPv4 connection.

    2. Configure the default MTU of the IPIP interface to 1460 (IPv4 default = 1500). The size of the IPv6 header is 40.

  9. Click Apply.

Mapping of Address and Port using Encapsulation (MAP-E), like DSLite, is a mechanism to facilitate the transition from IPv4 to IPv6. It relies on an IPv6 network backbone to carry IPv4 traffic. Both the address and port mapping information are embedded within the IPv6 address. Unlike DSLite, this method involves a direct mapping scheme without the need for a centralized CGNAT. IPv4 packets are encapsulated in IPv6 but use predefined mapping rules to determine the destination.

This feature is available starting from R81.10.15.

Use Cases:

MAP-E is a less expensive method for end users seeking a scalable, decentralized approach to manage IPv4 traffic over an IPv6 network, especially in environments with high traffic volumes that need efficient resource utilization.

Procedure:

  1. On the Internet page, click New > New Internet Connection.

  2. In the New Internet Connection window, enter the Name and select the Interface from the pulldown menu.

    Supported interfaces (must have the DHCPv6/SLAAC internet connection):

    • WAN

    • DMZ

  3. For Type, select Mapping of Address and Port.

  4. Select the Linked connections from the pulldown menu. This is the IPv6 connection that the MAP-E is routed over.

  5. In the MAP-E Settings section, select the MAP-E vendor:

    • OCN Virtual Connect - Connection options: Dynamic or Static mode

    • JPX - Connection options: Dynamic mode only

  6. For MAP-E connection type, select Dynamic or Static.

    • Dynamic - Gives the port range you can use within your IPv4 connection. This is a subset of all the available ports.

    • Static - You can use the entire port range. If you select this mode, enter the Update server URL, the Username, and the Password.

  7. Select or clear the Unnumbered IP address checkbox. This is the option to allow assigning the WAN IP to the LAN IP.

  8. Click Save.

On the Internet page, you now see the new Internet connection. Check that the status shows as Connected and probing is enabled.

To see the available Port Ranges:

  1. Click the MAP-E options link.

  2. The MAP-E Options and Monitoring page opens and displays the Last update time, the Service name, and the port ranges.

  3. Optional - Click to Refresh View or to Clear the MAP Table. Clearing the MAP table deletes the current MAP-E rule (the IP address, and the port range) and fetches a new one. If the values of the new MAP-E rule are different, this results in a reconnection and a different IP address.

Other configuration types

  1. In the Internet Connection page, to create a new internet connection, click Configure internet.

    The New Internet Connection window opens in the Configuration tab.

  2. Under Internet Configuration, enter the Connection name.

  3. For Interface, select New link aggregation (Bond).

  4. For Ports, select a minimum of 2 interfaces that are unassigned and disabled.

    Note - 1530 / 1550 appliances do not have a DMZ port.

  5. Select the Operation mode:

    • 802.3ad – Dynamically uses Active interfaces to share the traffic load.

    • Round Robin – Selects the Active interface sequentially.

    • XOR – All interfaces are Active for Load Sharing. Traffic is assigned to Active interfaces based on the transmit hash policy (Layer2 or Layer3+4).

    • High Availability (Active/Backup) – Gives redundancy when there is an interface or link failure. If you select this mode, you must select a Master i.e. the primary/default port for the traffic.

  6. Select the Connection type.

  7. In the Advanced tab, select the Mii interval. The Mii interval is the frequency (in ms) that the system polls the Media Independent Interface (Mii, the standard interface for fast Ethernet) to get status.

  8. If you selected 802.3ad or XOR as your operation mode, select the Hash policy from the dropdown menu.

    • Layer2 - Based on the XOR of hardware MAC addresses.

    • Layer2+3 - Based on the XOR of hardware MAC addresses and IP addresses.

    • Layer3+4 - Based on the IP addresses and Ports.

  9. Click Apply.

To add a Bond as an additional internet connection:

  1. In the Internet Connection page, click Add an internet connection...

    The New Internet Connection window opens in the Configuration tab.

  2. Configure the rest of the fields as for a new connection.

Cellular Connections

Note - The gateway can connect through IPv4, IPv6 or a mixed IPv4v6 service.

  1. Click Configure Internet (if not configured at all), Add (for another Internet connection), or Edit.

    The New or Edit Internet Connection window opens.

  2. In the Configuration tab, select Cellular for Interface name.

  3. Click Apply

    Note - This closes the Edit Internet Connection window.

    The remaining steps are optional additional settings and are not essential for configuration.

  4. In the Cellular tab, under Cellular settings, select the Primary SIM and which SIM to disable: SIM 1, SIM 2 or Neither.

    • SIM 1 – Micro-SIM

    • SIM 2 – Nano-SIM

  5. For each SIM, enter the APN and PIN number.

    Note - Some cellular carriers require a password to access the cellular Internet. In this case, the administrator must enter the credentials to connect to the appliance.

  6. For Connection Type, select one of these values:

    • IPv4 – Both SIMs are configured to IPv4 only

    • IPv6 – Both SIMs are configured to IPv6 only

    • IPv4v6 – There are two connections, one IPv4 and one IPv6. Select this if one of the SIM cards is configured as dual-stack, or if the two SIM cards are configured with different connection types

  7. Configure the Connection Monitoring and Advanced tabs as for other interface connections.

  8. Click Apply

  1. Connect to the command line on the Quantum Spark appliance.

  2. If your default shell is Bash, go to Gaia ClishClosed The default shell of the Gaia CLI:

    clish

  3. Disable the use of the configuration file:

    set os-settings advanced-settings use-secondary-mccmnc-file false

  4. Go from Gaia Clish to the Expert mode:

    • If your default shell is Gaia Clish:

      expert

    • If your default shell is Expert mode:

      exit

  5. Back up the current configuration file:

    cp -v /pfrm2.0/etc/usb_dev/mcc_mnc_secondary_list.conf{,_BKP}

  6. Edit the current configuration file:

    vi /pfrm2.0/etc/usb_dev/mcc_mnc_secondary_list.conf

  7. Configure the required values.

    Format:

    [<SIM ID Number (MCC/MNC)>]
apn=<STRING>
carrier_package=<STRING>

    Example:

    [302220]
apn=isp.telus.com
carrier_package=TELUS

  8. Save the changes in the file and exit Vi editor.

  9. Go from the Expert mode to Gaia Clish:

    • If your default shell is Gaia Clish:

      exit

    • If your default shell is Expert mode:

      clish

  10. Enable the use of the configuration file:

    set os-settings advanced-settings use-secondary-mccmnc-file true

For Security Gateways with cellular Internet connections, you can switch the active image between carrier-approved firmware configurations.

The image contains files used to configure the module for use with specific carriers. Multiple images can be stored on the device. During a firmware upgrade, you can add images packages to the module or replace an image with a newer version.

Note - You can only switch to an image already uploaded to the module.

The image package contains these files:

  • Firmware file – Contains the module's firmware.

  • Carrier Configuration file (the Product Release Information or PRI) – Contains custom settings for a specific carrier and is linked internally to a specific firmware file.

The module runs an active image which contains a single uncompressed copy of a firmware file and a single configuration file.

To see a list of available carriers and their image packages, go here.

  • EM7455 – Global region

  • EM7430 – APAC region

Use cases:

Some carriers require the module to run a specific carrier configuration file, and may also request this for the certification process. In addition, the carrier configuration file ensures the use of carrier-specific parameters when you register with that carrier.

To select an active image for a SIM:

  1. In Device > Internet, double click an existing cellular connection, or select the connection and click Edit. You can also click New to create a new cellular connection.

    The Edit Internet Connection window opens.

  2. In the Cellular tab, for each SIM, select the new Carrier configuration package from the list of supported image package names. Each SIM can have a different carrier.

    Note - This list dynamic, based on the valid installed packages on the modem.

  3. Click Apply

On the Internet page, the Status changes to Connecting with the message:

Switching carrier configuration package. This may take a few minutes.

To disable image switching:

In the Cellular tab, for each SIM, select None for the Carrier configuration package.

  • For PPPoE over ATM over VDSL/ADSL or IPoE over ATM over VDSL/ADSL or for an ADSL interface:

    • Enter the VPI number and VCI number you received from your service provider, and the Encapsulation type (LLC or VC_MUX).

  • For WAN/DMZ interfaces and static, DHCP, PPPoE, PPTP, and L2TP connection types

    or

    For VDSL/ADSL interfaces and IPoE - dynamic IP and IPoE - static IP connection types over PTM:

    • Use connection as VLAN - Select this checkbox to add a virtual Internet interface.

    • VLAN ID - Enter a VLAN ID between 1 and 4094.

If you are in an Annex L system, in Advanced Settings, you must enable the Annex L and disable the Annex J/M.

If you are in an Annex M system, in Advanced Settings, you must enable Annex J/M and disable the Annex L.

In all other Annex systems, no changes are needed to the default configuration.

Notes:

  • Multiple Internet connections can be established over a single VDSL/ADSL connection carrying PTM traffic or in the case of WAN and DMZ interfaces.

  • Only one Internet connection can be established over a VDSL/ADSL interface carrying ATM traffic or a USB interface.

  • One IPoE or PPPoE connection can be established over ATM running over the DSL interface.

  • A single IPoE connection or multiple PPPoE connections can be established over one untagged DSL interface carrying PTM traffic.

  • A single IPoE connection or multiple PPPoE connections can be established over one VLAN tagged DSL interface carrying PTM traffic.

  • A single DHCP or Static IP connection can be established over a USB interface.

  • A single DHCP or Static IP connection or multiple PPPoE connections can be established over one untagged or one VLAN tagged WAN or DMZ interface.

  • When all the ADSL standards are turned off in the Advanced Settings and you can only connect using the VDSL2 standard, the VPI, the VCI and the encapsulation options still appear even though they are not used to open an Internet connection.

Monitoring

This section applies to both IPv4 and IPv6 connections.

On the Internet Connectivity page, click Connection monitoring...

The Monitoring Servers table shows the configured connections:

  • Connection - Name. For example, Internet1.

  • Server Name

  • IP address

  • Packet Loss

  • Failures

  • Avg. Latency

  • Min Latency

  • Max Latency

  • Jitter

Probing provides information about the quality of an internet connection and what action to take if there is no connectivity. You can configure separate probing settings for each internet connection.

To configure probing for an internet connection (pings):

  1. In the Internet Connectivity page, select a connection and click Connection Monitoring.

    The Edit Internet Connection window opens.

  2. In the Connection Monitoring tab, select Monitor connection state by sending probe packets to one or more servers on the Internet.

    Select this option to use more methods and servers to detect connectivity loss.

    Important - In versions R81.10.10 and higher, it is supported to disable probing in an Internet connection only if you clear the option, "This Internet connection will be a part of SD-WAN" (on the "Advanced" tab > section "SD-WAN Settings").

  3. For Connection probing method, select ping addresses.

  4. Under Advanced Probing Settings, use the default values or enter new ones for:

    • Recovery time (in seconds)

    • Max latency allowed (milliseconds)

    • Probing frequency (seconds)

    • Window size (pings)

    • Failover pings (percent failures)

  5. Click Apply.

To monitor a connection by DNS probe:

  1. In the Connection Monitoring tab, select Monitor connection state by sending probe packets to one of more servers on the Internet.

    Important - In versions R81.10.10 and higher, it is supported to disable probing in an Internet connection only if you clear the option, "This Internet connection will be a part of SD-WAN" (on the "Advanced" tab > section "SD-WAN Settings").

  2. For Connection probing method, select DNS probe.

  3. Click Apply.

To monitor Cellular connections (internal LTE modem):

Click the Monitor cellular modem link to see this information in the Cellular Modem Monitoring window:

  • Cellular radio

  • Cellular modem

  • Operator

  • SIM cards - Which SIM is active, primary or disabled.