Virtual Addresses (eth0:1) on SecurePlatform?

[mogmismo]

Hey all,

I'm familiar with adding virtual interfaces on Linux, such as eth0:1, eth0:2, but don't know how SecurePlatform will handle it. I understand that I will need to add the interfaces in the topography, but not sure what else I need to do to have the interface work correctly in NGX. Are there any caviats I should now before doing this? Also, will SecurePlatform respect new ifcfg-eth0:1 files in /etc/sysconfig/network-scripts/ on reboot?

Thanks,

M.

[kva.kva]

Use sysconfig - Network connections - add network connection (may be New network connection) and select necessary interface.
Sorry I don't remember exactly menu names and don't check this on SPLAT now.

[mogmismo]

Thanks. For future travellers on this path:

sysconfig

option 5 - Network Connections
option 1 - Add new connection
option 1 - Secondary IP on interface (alias)
option X - ethX, which one you want to add the connection on
IP Address - Enter IP
Netmask - Enter Netmask
Broadcast - Enter Broadcast (or enter for default)

Done.

Also, and it confused me, the interface must be UP for the command to work. It will not work if the interface is in a down state.

[mogmismo]

Thanks for your previous help.

All is working, with my virutal interfaces, except when I go to add the topology in SmartDashboard. When going to the firewall object -> topology and clicking Add, I type in eth0:1, and get the error that "Interface name cannot contain a colon symbol"

How do I add the interface to the topography? Can I simply define both networks in the topology of eth0?

Thanks,

M.

[kva.kva]

I tried to get topology with interfaces after adding secondary interface and got error :)

So I found next https://secureknowledge.checkpoint.c...270321.2607685
"VPN-1/FireWall-1 ignores virtual interfaces, so that inspection and anti-spoofing take place on the physical interface.
To use virtual interfaces with anti-spoofing, define two network objects, one for each subnet. Then create a network group, which consists of the two network objects. Put the group in the anti-spoofing entry of the physical interface, just as you would if there were another physical network connected to the interface."

I think no necessity adding interface, you need to add networks to anti-spoofing group only.

[mogmismo]

Thanks for your help. That worked.

M.