Show All

• In which versions is the Bypass Card supported?
  

  This feature is supported for R7x and R80.x versions running on Gaia OS only, in Single Gateway configuration.

  • For VSX R77 and above, the Bypass Card Hotfix is required. Contact Check Point Solution Center via local Check Point office to get a Bypass Card Hotfix.

• What Bypass Card models are available?
  

  Supported Bypass Cards:
  

  • 1 GbE Copper, 4 port
  • 10 GbE SFP+ Line Card, 2 Port 

  
  For more information, refer to Check Point Security Appliance Accessories Guide and to the relevant Appliance Datasheet.

• How do I order a bypass card?
  

  Refer to the Check Point Product Catalog:

  1. Go to User Center - Log in
  2. At the top, click on the 'QUOTING TOOLS' menu - click on the 'Product Catalog & Quoting'
  3. Go to 'NETWORK SECURITY' section - click on the relevant appliance
  4. Wait for the information to be loaded
  5. Scroll down to the 'Accessories & Add Ons' - near 'More Add ons & Accessories', click on a down-pointing triangle
  6. Wait for some short time for the information to be loaded
  7. Refer to 'Bypass (Fail-Open)' item(s) - get the 'SKU' of the relevant card

• How do I install the card?
  

  For Download links, Installation Guides, Feature Descriptions, and additional information, refer to sk85560 - Installing a Bypass (Fail-Open) network interface card on Check Point appliances.

• What appliances support the Bypass Card?
  

  The Bypass feature is supported by the 4000, 5000, 12000, 13000, 15000, 23000, 6000, 7000, 16000, 26000 and 28000 appliance series.
  It is also supported on SandBlast Appliances TE100x, TE250X, TE1000X, TE2000X and TE2000X HPP.

• Can higher-end appliances models, such as 64000 / 44000, support the Bypass Card for IPS?
  

  This is currently not supported.
  If Bypass Card is required on other appliances, please open a Request for Enhancement (RFE) with Check Point (contact the local Check Point office to submit such RFE).

• When Bypass is enabled, can High Availability be supported?
  

  The Bypass Card is not supported in Cluster environments (High Availability mode or Load Sharing modes).
  This is an undesirable scenario and if required, it should be well investigated.
  
  When Bypass kicks in, communication between the cluster members is not guaranteed. The traffic might pass through the first device in fail-open mode with no inspection and will be transparent to the switches on both sides. Again, this is an undesirable scenario in cluster environments.

• When Bypass is enabled, is performance degradation expected?
  

  The Bypass feature should not increase latency or any performance degradation.

• Does Bypass card support Link Aggregation (Bond)?
  

  Link Aggregation (Bonding) of ports on a Bypass card / of Bypass cards is not supported.

• Is Bypass card supported in VSX mode?
  

  Starting from R77, Bypass Card is also supported in VSX mode.
  Contact Check Point Solution Center via local Check Point office to get a Bypass Card Hotfix.

• How long does it take for the NIC to fail open?
  

  If bypass is initiated, the flipping is immediate as this is hardware bypass. Yet, the thresholds for each of the following states should be considered:
  

  • There is a power loss - Immediate
  • The appliance is rebooting - Immediate
  • Unable to allocate memory in kernel - Immediate
  • High CPU and packet drops - Threshold is set to 5,000 drops and 85% CPU usage within 20 seconds.
  • DLP process is crash - 20 crashes within 300 seconds
  • FWD process is not responding - Threshold is set to 75 seconds

• Can the Bypass cards be configured to stay in bypass state?
  

  This is currently not supported.

• Are there any limitations when using this card?
  

  Refer to sk85560 (section: Known Limitations).

• Is there any limitation/degradation expected when Bypass card is installed, but bypass feature is not enabled?
  

  No. If bypass mode is not enabled, there should be no difference between using Bypass (Fail-Open) card and normal NIC.

• Is 10GbE ByPass supported?
  

  10GbE ByPassis supported on all appliances

 

Related Solution: sk96246 - Documentation For Check Point Appliances

Solution was incorporated into R80.30 Jumbo Hotfix Take 217 (PRJ-12833), for additional information refer to sk153152 - 
Jumbo Hotfix Accumulator for R80.30 (R80_30_jumbo_hf)