Configure Layer 2 Settings for NGFW Engines in the Firewall/VPN role
Layer 2 Settings for NGFW Engines in the Firewall/VPN role define the Layer 2 Interface Policy for the NGFW Engine, and advanced settings for layer 2 physical interfaces on the NGFW Engine.
Layer 2 Interface Policies contain rules for traffic detected by layer 2 physical interfaces on NGFW Engines in the Firewall/VPN role. To use layer 2 physical interfaces, you must select the Layer 2 Interface Policy for the NGFW Engine. All layer 2 physical interfaces on the NGFW Engine use the same Layer 2 Interface Policy.
For more details about the product and how to configure features, click Help or press F1.
Steps
- Right-click an NGFW Engine, then select Edit <element type>.
- Browse to .
- From the Policy for Layer 2 Interfaces drop-down list, select the Layer 2 Interface Policy.
-
(Optional) Configure one or more of these advanced settings for layer 2 physical interfaces:
- Connection tracking options
- Bypass options for Capture Interfaces and Inline IPS Interfaces
- Click Save and Refresh to transfer the changes.
Engine Editor > General > Layer 2 Settings
Use this branch to configure settings for layer 2 physical interfaces on Single Firewalls, Firewall Clusters, and Virtual Firewalls.
Option | Definition |
---|---|
Policy for Layer 2 Interfaces |
The Layer 2 Interface Policy that contains rules for traffic detected by layer 2 physical interfaces. All layer 2 physical interfaces on the NGFW Engine use the same Layer 2 Interface Policy. If there are no layer 2 physical interfaces, this setting is ignored. |
Layer 2 Interface Settings section | Defines settings for connection tracking on layer 2 physical interfaces. |
Layer 2 Connection Tracking Mode |
When connection tracking is enabled, reply packets are allowed as part of the allowed connection without an explicit Access rule. You can override this engine-specific setting and configure connection tracking for TCP, UDP, and ICMP traffic in Access rules.
|
Inline IPS and Capture Interface Settings section | Defines advanced settings for Inline IPS Interfaces and Capture Interfaces. |
Bypass Traffic on Overload |
When selected, the NGFW Engine dynamically reduces the number of inspected connections if the load is too high. Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection. If this option is not selected, the NGFW Engine inspects all connections. Some connections might not get through if the engine gets overloaded. |