Operating modes between interfaces

You can configure three modes in which interfaces on the firewall interact:

  • Advanced mode (Router),
  • Bridge mode (or transparent mode),
  • Hybrid mode.

Advanced mode

In advanced mode: with this configuration mode, the firewall operates like a router between its various interfaces,

Every enabled interface has an IP address from the network to which it is directly connected, so translation rules can be configured to access other zones on the firewall.

This requires some IP addresses to be changed on routers or servers when you move them to a different network (behind a different interface of the firewall).

The advantages of this mode are:

  • Address translation between the various networks.
  • Only traffic passing from one network to another passes through the firewall (internal network to the Internet, for example). This considerably lightens the firewall’s load and returns better response times.
  • Items belonging to each zone are easier to differentiate (internal, external and DMZ), as the IP addresses are different for each zone. This provides a clearer view of the separations and the configuration to be applied to these items.

Bridge mode or transparent mode

In transparent (bridge) mode: interfaces are part of the address range declared on the bridge.

The transparent or "bridge" mode, makes it possible to keep the same address range between interfaces.

You can filter traffic later by using interface objects or address ranges depending on your requirements, and protect any part of your network.

The advantages of this mode are:

  • Ease of integration of the product since there is no change in the configuration of client workstations (default router, static routes, etc.) and no change in IP address on your network.
  • Compatibility with IPX (Novell network), Netbios in Netbeui, Appletalk or IPv6.
  • No address translation, therefore time is saved when the firewall processes packets.

This mode is therefore recommended between the external zone and the DMZ. It allows keeping a public address range on the firewall’s external zone and on the DMZ’s public servers.

Hybrid mode

In hybrid mode: some interfaces have the same IP address and others have a distinct address.

The hybrid mode uses a combination of both modes mentioned earlier. This mode may only be used with Stormshield Network products having more than two network interfaces. You may define several interfaces in transparent mode


Internal zone and DMZ (or external zone and DMZ) and certain interfaces in a different address range. This provides greater flexibility when you integrate the product.

Link aggregation (LACP) – SN510, SN710, SN910, SN2000, SN2100, SN3000, SN3100, SN6000 and SN6100.

The LACP (IEEE 802.3ad - Link Aggregation Control Protocol) feature helps improve the firewall’s bandwidth while maintaining a high level of availability (link redundancy).

Several physical ports on a firewall can be grouped together to be considered a single logical interface. Therefore, by aggregating x links, it will be possible to set up a link of x times 1 Gbps or 10 Gbps between two appliances.

This feature is only available on SN510, SN710, SN910, SN2000, SN2100, SN3000, SN3100, SN6000 and SN6100 models.

Ensure that the remote appliances support LACP.


The choice of a mode is made only where network interface configuration is concerned. The configuration of the firewall is then the same for all modes.

Security-wise, all operating modes are equal. The same things are filtered and attack detection is identical.