GRETAP interface

Tunnels that use GRETAP interfaces allow encapsulating Level 2 traffic (Ethernet). They can then be used to link sites sharing the same IP address range through a bridge or to transport non-IP protocols over a bridge.

Adding a GRETAP interface

  1. Click on Add.
  2. Click on GRETAP interface.
    The GRETAP interface is added to the interfaces and its control panel appears.

GRETAP interface control panel

Double-click on the GRETAP interface control panel to open it. There are several tabs in the control panel.

Status

ON / OFF

Set the switch to ON/OFF to enable or disable the interface.
Disabled interfaces cannot be used. An interface that has been disabled because it is not in use, or will be deployed later, is an additional security measure against intrusions.

General settings

Name Name of the interface. This name can be changed.
Comments Allows you to enter comments regarding the interface.
This interface is

An interface can be:

  • Internal (protected): when this option is selected, this means that the interface is protected (a shield appears). a protected interface only accepts packets coming from a known address range, such as a directly connected network or a network defined by a static route. This protection includes remembering machines that have logged on to this interface, conventional traffic security mechanisms (TCP) and implicit rules for services offered by the firewall such as DHCP.

  • External (public): choosing this option indicates that the interface does not benefit from the protection of a protected interface and can therefore receive packets coming from any address range (which are not assigned to internal interfaces). This type of interface is used mainly to connect the firewall to the Internet.

GRETAP tunnel address

Tunnel source Select the network object that corresponds to the bridge that supports the GRETAP interface.
Tunnel destination Select (or create) the network object that corresponds to the public address of the appliance that hosts the remote GRETAP interface.

Address range

Address range inherited from the bridge When this option is selected, the interface becomes part of a bridge. Several parameters, such as the address range, will then be inherited from the bridge. This will unlock the Bridge field. Select the parent bridge of the interface in this field.
Dynamic / Static

Selecting this option indicates that the IP address of the interface is dynamic (obtained via DHCP) or static. This will unlock the IPv4 address field.
Dynamic IP (obtained by DHCP)

When this option is selected, the IP address of the interface will be defined by DHCP. An Advanced DHCP properties zone appears with the following parameters:

  • DNS name (optional): a fully qualified DHCP host name (FQDN) can be indicated for the DHCP request.

    If a value is entered in this field and the external DHCP server has the option of automatically updating the DNS server, the DHCP server automatically updates the DNS server with the name of the firewall, its assigned IP address and allocated lease time (field below).

  • Requested lease time (seconds): in addition to the DNS name, enter the duration for which the IP address is kept before renegotiation.

  • Request domain name servers from the DHCP server and create host objects: select this parameter so that the firewall will retrieve DNS servers from the DHCP server (access provider, for example) that provided its IP address. When this option is selected, two objects will be created: Firewall_<interface name>_dns1 and Firewall_<interface name>_dns2. They can then be used in the configuration of the DHCP service. So if the firewall provides the users on its network with a DHCP service, the users will also benefit from the DNS servers given by the access provider.
Fixed IP (static)

When this option is selected, the IP address of the interface will be static. A grid appears, in which you must add the IP address and its subnet mask. Several IP addresses and associated masks can be added if aliases need to be created, for example. These aliases allow you to use the firewall as a central routing point. As such, an interface can be connected to various sub-networks with a different address range.

If you add several IP addresses (aliases) to the same address range, these addresses must all have the same mask. Reloading the network configuration will apply this mask to the first address and a /32 mask to the addresses that follow.

Other settings

MTU Maximum length of frames (in bytes) sent over the physical medium (Ethernet) so that they are sent at one go without fragmentation. This option is not available for interfaces contained in a bridge.
Physical (MAC) address Makes it possible to specify a MAC address for an interface instead of using the address assigned by the firewall. If the interface is contained in a bridge, it will have the same MAC address as the bridge.

Routing without analysis

This zone appears only if the option Address range inherited from the bridge is selected in the Address range field in the General configuration tab.

Authorize without analyzing Allows letting IPX (Novell network), Netbios (on NETBEUI), AppleTalk (for Macintosh), PPPoE or Ipv6 packets pass between the bridge’s interfaces. No high-level analysis or filtering will be applied to these protocols (the firewall will block or pass).

Routing by interface

This zone appears only if the option Address range inherited from the bridge is selected in the Address range field in the General configuration tab.

Keep initial routing

This option will ask the firewall to not modify the destination in the Ethernet layer when a packet goes through it. The packet will be resent to the same MAC address from which it was received. The purpose of this option is to facilitate the integration of firewalls transparently into an existing network, as this makes it possible to avoid the need for modifying the default route of machines on the internal network.

Known limitations
Features on a firewall that inserts or modifies packets in sessions may fail to function correctly. The affected features are:
  • Connection reinitialization caused by an alarm,
  • SYN proxy (enabled in filtering),
  • Requests to resend packets that were dropped in order to speed up analysis,
  • Rewriting of packets by application analyses (SMTP, HTTP and web 2.0, FTP and NAT, SIP and NAT).
Keep VLAN IDs This option enables the transmission of tagged frames without the firewall having to be the VLAN endpoint. The VLAN tag on these frames is kept so that the Firewall can be placed in the path of a VLAN without the firewall interrupting this VLAN. The Firewall runs seamlessly for this VLAN.
To use this option, the previous option "Keep initial routing” must be enabled.