Configuring the Local Network

The Device view > Network section > Local Network page lets you set and enable the local network connections, switches, bridge or wireless network (on wireless devices only).

A bridge connects two or more local area networks (LANs). A switch is similar to a bridge but can perform data transmission between multiple port pairs at the same time.

The Network table shows all available network connections.

The page also lets you:

• Configure multiple switches (port based VLANs) between the available local LAN interfaces and wireless networks. You can create tag-based VLANs under separate LAN ports and DMZ or under a LAN switch. Traffic is not monitored or inspected between the LAN ports of a switch.

• Configure multiple bridges between interfaces. Traffic in a bridge is always monitored and inspected by the appliance.

• Create and configure tag based VLANs (802.1q) on any of the LAN interfaces or DMZ.

  Note - DMZ is not supported in 1530 / 1550 appliances.

• Create an alias IP. With an alias IP, you can associate more than one IP address to a network interface. A single network device can have multiple connections to a network.

• Create and configure VPN tunnels (VTI) which can be used to create routing rules which determine which traffic is routed through the tunnel and therefore also encrypted (Route based VPN).

• Create a BOND (Link Aggregation) between two or more interfaces. This improves performance and redundancy by increasing the network throughput and bandwidth. The LAN Bond can be an unassigned network.

• On wireless devices - Add new wireless networks (Virtual Access Points). This can also be done through the Device > Wireless page.

  There are two radio transmitters: 2.4 GHz and 5 GHz. Each network is configured separately under a specified transmitter.

You can also use unassigned LAN ports to create an internet connection. In the table, these ports have the status Assigned to Internet.

To create any of the above options:

Click New and select the option you want.

To edit/delete/enable/disable any of the above options:

Select the relevant row and click Edit/Delete/Enable/Disable.

For each network, the table on this page shows you:

• Name - Name of the network, interfaces that participate (if there are multiple interfaces), and a description (optional)

• Local IP Address

• Subnet Mask

• MAC Address

• Status - Shows a status for physical interfaces and wireless networks:

  • Physical interfaces - Shows cable connection status of each physical interface that is enabled. Otherwise, it shows disabled.

  • Wireless networks - Shows if the wireless network is up or disabled.

Reserved IP Address for Specific MAC

You can configure your network so that IP addresses are assigned only for known hosts. Known hosts are already defined as network objects and a specific MAC address is assigned to the IP. Other hosts' DHCP requests are ignored.

To configure:

1. Select the specific LAN name and click Edit or double-click the LAN name.

   The Edit LAN window opens.

2. In the Configuration tab, click Enabled under DHCPv4 Server.

3. In the DHCPv4 Settings tab, enter the DHCP domain name and click the checkbox for Assign IP addresses for known host only.

4. Click Apply

Switch

A LAN Switch is a group of LAN ports (for example, LAN2, LAN3, LAN5) that are grouped together and represented by the "pivot" port (the port with lowest index, LAN2 in this example).

Monitor Mode

Security Gateways can monitor traffic from a Mirror Port or Span Port on a switch.

With Monitor Mode, the appliance uses Automatic Learning or user-defined networks to identify internal and external traffic, and to enforce policy.

Automatic Learning - The appliance automatically recognizes external networks by identifying the default gateway's network from requests to the Internet (specifically, requests to Google). The rest of the networks are considered internal.

User-Defined Networks - You can manually define internal networks. If a network is not defined as internal, it is considered external.

In both Automatic Learning and user-defined networks:

• Traffic to internal hosts is inspected by the Incoming/Internal/VPN Rule Base All rules configured in a given Security Policy. Synonym: Rulebase..

• Traffic to external hosts is inspected by the Outgoing Rule A set of traffic parameters and other conditions in a Rule Base that cause specified actions to be taken for a communication session. Base.

• Threat prevention's default configuration is optimized to inspect suspicious traffic from external hosts to internal hosts.

After you configure monitor mode:

1. Go to Device > Advanced Settings.

2. Turn off Anti-Spoofing.

If you do not see the Monitor Mode option:

1. Run this command in Gaia Clish The default shell of the Gaia CLI:

   set monitor-mode-configuration allow-monitor-mode true

2. Select an interface in WebUI and click Edit.

   Monitor Mode is now added to the options list.

For more information on monitor mode, see sk112572.

Mirror Port

All traffic that goes through one or more LAN ports of the appliance can be duplicated into one designated mirror port. For example, all traffic that passes through LAN1 and LAN2 is duplicated into LAN5, which is configured as the mirror port. You can only configure one mirror port at a time.

Use Case – If an external device is connected to the mirror port, it receives all traffic that goes through LAN1/LAN2 of the appliance. This enables you to monitor traffic that goes through the appliance from the external device.

The mirror port is the opposite of the existing monitor port feature, in which the traffic from an external source such as a network switch or router goes into the (WAN) port of the appliance, so the appliance can inspect the traffic going through the external source.

To configure a mirror port:

To configure a mirror port:

1. In the Device > Local Network page, select the designated mirror port and unassign it:

   1. Click Edit.

      The Edit LAN window opens.

   2. In the Configuration tab, in the Assigned to field, select Unassigned.

   3. Click Apply

2. In the Local Network table, select the LAN port you want to duplicate and click Edit.

   The Edit LAN window opens.

3. In the Port Mirroring section of the Advanced tab, select the checkbox Assign to mirror port.

4. In the Port field, select the mirror port from the drop-down menu.

5. Click Apply.

6. In the Local Network table, right-click the mirror port and click Enable.

7. Repeat for each LAN port you want to duplicate in the mirror port.

Physical Interfaces

To edit a physical interface:

Configure the fields in the tabs. Note that for the DMZ there is an additional tab Access Policy:

The 'Advanced' tab

The options that are shown vary based on interface type and status. Configure the options that are applicable:

• Description - Enter an optional description. The description is shown in the local network table next to the name.

• MTU size - Configure the Maximum Transmission Unit size for an interface. Note that in the Quantum Spark Appliance, the value is global for all physical LAN and DMZ ports.

• Disable auto negotiation - Select this option to configure manually the link speed of the interface.

• Override default MAC address – This option is for local networks except those on VLANs and wireless networks. Use this option to override the default MAC address of the network's interface:

  • When the device has two separate local networks connected to the same external switch.

  • If the ISP is searching for the gateway MAC address to accept the connection. If you upgrade your new gateway, the ISP may block it because the new gateway has a different MAC address. In this case, you can override the gateway MAC address with the old one.

  Best Practice - This is a rare configuration. Do not select this option unless you are sure you need it.

• Exclude from DNS proxy – Select this checkbox for any network that you do not want exposed to internal domains. In guest VAPs (wireless network for guests), this is selected by default.

The 'Access Policy' tab (only for DMZ)

These options create automatic rules that are shown in the Access Policy > Firewall Policy page.

• Allow access from this network to local networks

• Log traffic from this network to local networks

Bridge

To create a bridged internet connection in a cluster, see the Configuring Internet Connectivity page > Bridged Internet Connection in a Cluster section.

To create/edit a bridge, configure the fields in the tabs:

The 'Configuration' tab

• In Bridge Configuration, select the networks you want to be part of the bridge.

• Enable Spanning Tree Protocol - When Spanning Tree Protocol (STP - IEEE 802.1d) is enabled, each bridge communicates with its neighboring bridges or switches to discover how they are interconnected. This information is then used to eliminate loops, while providing optimal routing of packets. STP also uses this information to provide fault tolerance, by re-computing the topology in the event that a bridge or a network link fails.

• Enter a Name for the bridge interface. Note that you can only enter "brN" where N is a number between 0 and 9. For example, br2.

• Select the IP address and Subnet mask.

• Use Hotspot - Select this checkbox to redirect users to the Hotspot portal before allowing access from this interface. Hotspot configuration is defined in the Device > Hotspot page.

• DHCP Server

  Select one of the options:

  • Enabled - Enter the IP address range and if necessary the IP address exclude range. The appliance's own IP address is automatically excluded from this range. You can also exclude or reserve specific IP addresses by defining network objects in the Users & Objects > Network Objects page. Reserving specific IP addresses requires the MAC address of the device.

  • Relay - Enter the DHCP server IP address.

  • Disabled

The 'Advanced' tab

• MTU size - Configure the Maximum Transmission Unit size for an interface.

• Disable auto negotiation - Select this option to configure manually the link speed of the interface.

• Override default MAC address – This option is for local networks except those on VLANs and wireless networks. Use this option to override the default MAC address used by the network's interface, when the device has two separate local networks connected to the same external switch.

  Best Practice - This is a rare configuration. Do not select this option unless you are sure you need it.

• Exclude from DNS proxy – Select this checkbox for any network that you do not want exposed to internal domains. In guest VAPs (wireless network for guests), this is selected by default.

To configure Advanced IPv6 settings:

1. Configure the Router Advisement fields.

2. Under Prefix Delegation, select the checkbox for Enable prefix delegation and enter the relevant information.

VLANs

To create/edit a tag based VLAN:

You can create a new VLAN only if you have at least one physical interface that is not part of an existing network (switch or bridge).

Alias IP

With an alias IP, you can associate more than one IP address to a network interface.

• A single network device can have multiple connections to a network.

• A specific port is used by more than one network.

All devices are on the same network, even though they show different IPs. For example, LAN4 and LAN4:1 have different IP addresses, but are on the same network. LAN4:1 is the alias.

You can also have an alias IP for VLAN and a switch.

Use Case

A customer is migrating his device to a new subnet, but wants the host to still be able to "approach" a resource such as a printer on his old subnet during the transition period.

VPN Tunnel (VTI)

To create/edit a VPN Tunnel (VTI):

A Virtual Tunnel Interface (VTI) is a virtual interface on a Security Gateway A dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. that is related to an existing, Route Based VPN tunnel. The Route Based VPN tunnel works as a point-to-point connection between two peer Security Gateways in a VPN community. Each peer Security Gateway has one VTI that connects to the tunnel.

The VPN tunnel and its properties are defined by the VPN community that contains the two gateways. You must define the VPN community and its member Security Gateways before you can create a VTI.

Configure the fields in the tabs:

The 'Configuration' tab

• VPN Tunnel ID - A number identifying the VTI.

• Peer - The name of the remote VPN site. See Configuring VPN Sites.

  The VPN tunnel interface can be numbered or unnumbered. Select the applicable option:

• Numbered VTI - You configure a local and remote IP address for a numbered VTI:

  • Local IPv4 address - The IP address to be used for the local point-to-point virtual interface.

  • Remote IP address - The IP address to be used at the peer gateway's point-to-point virtual interface.

• Unnumbered VTI - When the VTI is unnumbered, it is not necessary to configure local and remote IP addresses. You define a local interface to use as the source IP address for outbound traffic.

  • Internet connection - Select from the list.

  • Local bridge interface - Select the local interface from the list.

Virtual Access Point (VAP)

To create/edit a Virtual Access Point (VAP):

See the Device > Wireless Network help page.

DNS Server Settings (For DHCPv6/SLAAC)

Select one of these options:

• Auto - Use the DNS configuration of the device.

• Use the following IP addresses - Enter the first, second and third DNS servers.

DNS Server Settings (For DHCPv4)

These settings are effective only if a DHCPv4 server is enabled.

Select one of these options:

• Auto - This uses the DNS configuration of the appliance as configured in the Device > DNS and Device > Internet pages.

• Use the following IP addresses - Enter the IP addresses for the First DNS server, Second DNS server, and Third DNS server.

Default Gateway

Select one of these options:

• Use this gateway's IP address as the default gateway

• Use the following IP address - Enter an IP address to use as the default gateway.

WINS

Select one of these options:

• Use the WINS servers configured for the internet connection

• Use the following WINS servers - Enter the IP addresses of the First and Second WINS servers.

Lease section

Lease time - Configure the timeout in hours for a single device to retain a dynamically acquired IP address.

Other Settings

You can optionally configure these additional parameters so they will be distributed to DHCP clients:

• Time servers

• Call manager

• TFTP server

• TFTP boot file

• X Window display manager

• Avaya IP phone

• Nortel IP phone

• Thomson IP phone

Use Case

Link Aggregation binds two or more physical ports together to form a LAG (Link Aggregation Group A collection of objects, such as user accounts, with shared attributes.) bundle that results in higher bandwidth and link redundancy. If one link in the group fails, traffic is automatically routed through the remaining interfaces.