Change the properties of physical interfaces for Virtual NGFW Engines

• None — Corresponds to a single network interface on the NGFW Engine.
• Aggregated Link in High Availability Mode — Represents two interfaces on the NGFW Engine. Only the first interface in the aggregated link is actively used. The second interface becomes active only if the first interface fails. Connect the first interface to one external switch and the second interface to another external switch.
  Note: When you select a Virtual Resource for an interface in the Master NGFW Engine, two Physical Interfaces are created in the Virtual Firewall properties. Each interface in the aggregated link interface pair is represented by a separate Physical Interface in the Virtual Firewall properties.
• Aggregated Link in Load Balancing Mode — Represents up to eight interfaces on the NGFW Engine. The interfaces in the aggregated link are actively used and connections are automatically balanced between the interfaces.

  This mode is implemented based on the IEEE 802.3ad Link Aggregation standard. Connect the interfaces to a single external switch. Make sure that the external switch supports the Link Aggregation Control Protocol (LACP) and that LACP is configured on the switch.

(When Type is Aggregated Link in High Availability Mode)

(When Type is Aggregated Link in Load Balancing Mode)

(Master NGFW Engines only)

The Virtual Resource associated with the interface. Select the same Virtual Resource in the properties of the Virtual NGFW Engine to add the Virtual NGFW Engine to the Master NGFW Engine. If the interface is to be used for the Master NGFW Engine system communications, select None.

For Master NGFW Engines that host Virtual Firewalls, you can select Multiple Virtual Resources to allow several Virtual Firewalls to share a single physical interface.

To add multiple Virtual Resources for Virtual IPS engines or Virtual Layer 2 Firewalls, add VLAN Interfaces to the Physical Interface, then select a Virtual Resource in the properties of each VLAN Interface.

(When the Virtual Resource option is a single Virtual Resource)

(When the Virtual Resource option is Multiple Virtual Resources)

(Master NGFW Engines only)

(Optional)

(Optional)

(When QoS Mode is Full QoS)

Enter the throughput for the link on this interface as megabits per second.

If the interface is a Physical Interface, the same throughput is automatically applied to any VLANs created under it.

The throughput is for uplink speed (outgoing traffic) and typically must correspond to the speed of an Internet link (such as an ADSL line), or the combined speeds of several such links when connected to a single interface.

(Optional)

(Optional)

(All optional settings)

• Default — The interface uses the SYN rate limits defined for the NGFW Engine on the Advanced Settings branch of the Engine Editor.
• None — Disables SYN rate limits on the interface.
• Automatic — This is the recommended mode if you want to override the general SYN rate limits defined on the Advanced Settings branch of the Engine Editor. The NGFW Engine calculates the number of allowed SYN packets per second and the burst size (the number of allowed SYNs before the NGFW Engine starts limiting the SYN rate) based on the NGFW Engine’s capacity and memory size.
• Custom — Enter the values for Allowed SYNs per Second and Burst Size.

We recommend that you set the burst size to be at least one tenth of the Allowed SYNs per Second value. If the burst size is too small, SYN rate limits do not work. For example, if the value for Allowed SYNs per Second is 10000, set the value for Burst Size to at least 1000.

By default, each generated Antispoofing and Discard log entry is logged separately and displayed as a separate entry in the Logs view. Log Compression settings allow you to define the maximum number of separately logged entries. When the defined limit is reached, a single antispoofing log entry or Discard log entry is logged. The single entry contains information about the total number of the generated Antispoofing log entries or Discard log entries. After this log entry, the logging returns to normal and all generated entries are once more logged and displayed separately. Log Compression is useful when the routing configuration generates a large volume of antispoofing logs or the number of Discard logs becomes high.

• Log Rate (Entries/s) — The maximum number of entries per second. The default value for antispoofing entries is 100 entries/s. By default, Discard log entries are not compressed.
• Burst Size (Entries) — The maximum number of matching entries in a single burst. The default value for antispoofing entries is 1000 entries. By default, Discard log entries are not compressed.

• Capture Interface — Network traffic is monitored only. Traffic cannot be blocked. A connection can be terminated by sending a TCP Reset response.
• Inline IPS Interface — The interface is directly on the traffic path so that traffic passes through the interface to reach its destination.
• Inline Layer 2 Firewall Interface — The interface is directly on the traffic path so that traffic passes through the interface to reach its destination.

(When Type is Inline IPS Interface)

Select how traffic to the Inline IPS Interface is handled if the NGFW Engine goes offline.

• Bypass — traffic is allowed through the Inline Interface without inspection.
• Normal — traffic is not allowed through the Inline Interface.

The Virtual Resource associated with the interface. Select the same Virtual Resource in the properties of the Virtual NGFW Engine to add the Virtual NGFW Engine to the Master NGFW Engine. If the interface is to be used for the Master NGFW Engine system communications, select None.

For Master NGFW Engines that host Virtual Firewalls, you can select Multiple Virtual Resources to allow several Virtual Firewalls to share a single physical interface.

To add multiple Virtual Resources for Virtual IPS engines or Virtual Layer 2 Firewalls, add VLAN Interfaces to the Physical Interface, then select a Virtual Resource in the properties of each VLAN Interface.

(Optional)

(Optional)

(All optional settings)

• Default — The interface uses the SYN rate limits defined for the NGFW Engine on the Advanced Settings branch of the Engine Editor.
• None — Disables SYN rate limits on the interface.
• Automatic — This is the recommended mode if you want to override the general SYN rate limits defined on the Advanced Settings branch of the Engine Editor. The NGFW Engine calculates the number of allowed SYN packets per second and the burst size (the number of allowed SYNs before the NGFW Engine starts limiting the SYN rate) based on the NGFW Engine’s capacity and memory size.
• Custom — Enter the values for Allowed SYNs per Second and Burst Size.

We recommend that you set the burst size to be at least one tenth of the Allowed SYNs per Second value. If the burst size is too small, SYN rate limits do not work. For example, if the value for Allowed SYNs per Second is 10000, set the value for Burst Size to at least 1000.

By default, each generated Antispoofing and Discard log entry is logged separately and displayed as a separate entry in the Logs view. Log Compression settings allow you to define the maximum number of separately logged entries. When the defined limit is reached, a single antispoofing log entry or Discard log entry is logged. The single entry contains information about the total number of the generated Antispoofing log entries or Discard log entries. After this log entry, the logging returns to normal and all generated entries are once more logged and displayed separately. Log Compression is useful when the routing configuration generates a large volume of antispoofing logs or the number of Discard logs becomes high.

• Log Rate (Entries/s) — The maximum number of entries per second. The default value for antispoofing entries is 100 entries/s. By default, Discard log entries are not compressed.
• Burst Size (Entries) — The maximum number of matching entries in a single burst. The default value for antispoofing entries is 1000 entries. By default, Discard log entries are not compressed.

• Normal Interface — Corresponds to a single network interface on the engine. Not supported on Virtual IPS engines.
• Capture Interface — Network traffic is monitored only. Traffic cannot be blocked.
• Inline Interface — The interface is directly on the traffic path so that traffic must always pass through the engine to reach its destination. Only traffic that attempts to pass through Inline Interfaces can be actively filtered.

(Optional)

(Optional)

(Optional)

(When Type is Capture Interface)

(When Type is Inline Interface)

Select how traffic to the Inline Interface is handled if the engine goes offline.

• Bypass — traffic is allowed through the Inline Interface without inspection.
• Normal — traffic is not allowed through the Inline Interface.

(When Type is Capture Interface or Inline Interface)

(Master NGFW Engines only)

(When Type is Inline Interface)

(When Type is Inline Interface)

(Optional)

(Master NGFW Engines only)

(Optional)

(When QoS Mode is Full QoS)

Enter the throughput for the link on this interface as megabits per second.

If the interface is a Physical Interface, the same throughput is automatically applied to any VLANs created under it.

The throughput is for uplink speed (outgoing traffic) and typically must correspond to the speed of an Internet link (such as an ADSL line), or the combined speeds of several such links when connected to a single interface.

(Master NGFW Engines only)

The Virtual Resource associated with the interface. Select the same Virtual Resource in the properties of the Virtual NGFW Engine to add the Virtual NGFW Engine to the Master NGFW Engine. If the interface is to be used for the Master NGFW Engine system communications, select None.

For Master NGFW Engines that host Virtual Firewalls, you can select Multiple Virtual Resources to allow several Virtual Firewalls to share a single physical interface.

To add multiple Virtual Resources for Virtual IPS engines or Virtual Layer 2 Firewalls, add VLAN Interfaces to the Physical Interface, then select a Virtual Resource in the properties of each VLAN Interface.

(When the Virtual Resource option is a single Virtual Resource)

(All optional settings)

• Default — The interface uses the SYN rate limits defined for the NGFW Engine on the Advanced Settings branch of the Engine Editor.
• None — Disables SYN rate limits on the interface.
• Automatic — This is the recommended mode if you want to override the general SYN rate limits defined on the Advanced Settings branch of the Engine Editor. The NGFW Engine calculates the number of allowed SYN packets per second and the burst size (the number of allowed SYNs before the NGFW Engine starts limiting the SYN rate) based on the NGFW Engine’s capacity and memory size.
• Custom — Enter the values for Allowed SYNs per Second and Burst Size.

We recommend that you set the burst size to be at least one tenth of the Allowed SYNs per Second value. If the burst size is too small, SYN rate limits do not work. For example, if the value for Allowed SYNs per Second is 10000, set the value for Burst Size to at least 1000.

By default, each generated Antispoofing and Discard log entry is logged separately and displayed as a separate entry in the Logs view. Log Compression settings allow you to define the maximum number of separately logged entries. When the defined limit is reached, a single antispoofing log entry or Discard log entry is logged. The single entry contains information about the total number of the generated Antispoofing log entries or Discard log entries. After this log entry, the logging returns to normal and all generated entries are once more logged and displayed separately. Log Compression is useful when the routing configuration generates a large volume of antispoofing logs or the number of Discard logs becomes high.

• Log Rate (Entries/s) — The maximum number of entries per second. The default value for antispoofing entries is 100 entries/s. By default, Discard log entries are not compressed.
• Burst Size (Entries) — The maximum number of matching entries in a single burst. The default value for antispoofing entries is 1000 entries. By default, Discard log entries are not compressed.

• Normal interface — Corresponds to a single network interface on the Layer 2 Firewall engine.
• Capture Interface — Traffic is only captured for inspection.
  Note: Capture Interfaces allow the hosted Virtual Layer 2 Firewall to listen to traffic that is not routed through the Master NGFW Engine. You can have as many Capture Interfaces as there are available physical ports on the Master NGFW Engine. External equipment must be set up to mirror traffic to the Capture Interface.
• Inline Interface — The interface is directly on the traffic path so that traffic must always pass through the Layer 2 Firewall to reach its destination. Only traffic that attempts to pass through Inline Interfaces can be actively filtered.
  Note: An Inline Interface consists of two different Physical Interfaces on the Master NGFW Engine. This way, the hosted Virtual Layer 2 Firewall can inspect the traffic coming from one interface and either stop the traffic or send it out through the other interface.

(Optional)

(Optional)

(Optional)

(When Type is Capture Interface)

(When Type is Capture Interface or Inline Interface)

(Master NGFW Engines only)

(When Type is Inline Interface)

(Inline Interfaces only)

(Optional)

(Master NGFW Engines only)

(When Type is Inline Interface)

(Optional)

(When QoS Mode is Full QoS)

Enter the throughput for the link on this interface as megabits per second.

If the interface is a Physical Interface, the same throughput is automatically applied to any VLANs created under it.

The throughput is for uplink speed (outgoing traffic) and typically must correspond to the speed of an Internet link (such as an ADSL line), or the combined speeds of several such links when connected to a single interface.

(Master NGFW Engines only)

Only one Virtual Resource can be selected for each Physical Interface. If you want to add multiple Virtual Resources, add VLAN Interfaces to the Physical Interface, then select the Virtual Resource in the VLAN Interface properties.

(All optional settings)

• Default — The interface uses the SYN rate limits defined for the NGFW Engine on the Advanced Settings branch of the Engine Editor.
• None — Disables SYN rate limits on the interface.
• Automatic — This is the recommended mode if you want to override the general SYN rate limits defined on the Advanced Settings branch of the Engine Editor. The NGFW Engine calculates the number of allowed SYN packets per second and the burst size (the number of allowed SYNs before the NGFW Engine starts limiting the SYN rate) based on the NGFW Engine’s capacity and memory size.
• Custom — Enter the values for Allowed SYNs per Second and Burst Size.

We recommend that you set the burst size to be at least one tenth of the Allowed SYNs per Second value. If the burst size is too small, SYN rate limits do not work. For example, if the value for Allowed SYNs per Second is 10000, set the value for Burst Size to at least 1000.

By default, each generated Antispoofing and Discard log entry is logged separately and displayed as a separate entry in the Logs view. Log Compression settings allow you to define the maximum number of separately logged entries. When the defined limit is reached, a single antispoofing log entry or Discard log entry is logged. The single entry contains information about the total number of the generated Antispoofing log entries or Discard log entries. After this log entry, the logging returns to normal and all generated entries are once more logged and displayed separately. Log Compression is useful when the routing configuration generates a large volume of antispoofing logs or the number of Discard logs becomes high.

• Log Rate (Entries/s) — The maximum number of entries per second. The default value for antispoofing entries is 100 entries/s. By default, Discard log entries are not compressed.
• Burst Size (Entries) — The maximum number of matching entries in a single burst. The default value for antispoofing entries is 1000 entries. By default, Discard log entries are not compressed.