The information you are about to copy is INTERNAL!
DO NOT share it with anyone outside Check Point.
Bypass (Fail-Open) network interface card FAQ
Anti-Bot, Anti-Virus, Data Loss Prevention, IPS, Application Control, URL Filtering, Quantum Security Gateways, Quantum Appliances
R77.30 (EOL), R80.10 (EOL), R80.20 (EOL), R80.30 (EOL), R80.40, R81, R81.10
Platform / Model
4000, 5000, 12000, 13000, 15000, 23000, 6000, 7000, 16000, 26000, 28000
In which versions is the Bypass Card supported?
This feature is supported for R7x and R80.x versions running on Gaia OS only, in Single Gateway configuration.
For VSX R77 and above, the Bypass Card Hotfix is required. Contact Check Point Solution Center via local Check Point office to get a Bypass Card Hotfix.
What Bypass Card models are available?
How do I order a bypass card?
Refer to the Check Point Product Catalog:
User Center - Log in At the top, click on the '
QUOTING TOOLS' menu - click on the '
Product Catalog & Quoting'
Go to '
NETWORK SECURITY' section - click on the relevant appliance
Wait for the information to be loaded
Scroll down to the '
Accessories & Add Ons' - near '
More Add ons & Accessories', click on a down-pointing triangle
Wait for some short time for the information to be loaded
Refer to '
Bypass (Fail-Open)' item(s) - get the 'SKU' of the relevant card
How do I install the card?
What appliances support the Bypass Card?
The Bypass feature is supported by the 4000, 5000, 12000, 13000, 15000, 23000, 6000, 7000, 16000, 26000 and 28000 appliance series.
It is also supported on SandBlast Appliances TE100x, TE250X, TE1000X, TE2000X and TE2000X HPP.
Can higher-end appliances models, such as 64000 / 44000, support the Bypass Card for IPS?
This is currently not supported.
If Bypass Card is required on other appliances, please open a Request for Enhancement (RFE) with Check Point (contact the local Check Point office to submit such RFE).
When Bypass is enabled, can High Availability be supported?
The Bypass Card is not supported in Cluster environments (High Availability mode or Load Sharing modes).
This is an undesirable scenario and if required, it should be well investigated. When Bypass kicks in, communication between the cluster members is not guaranteed. The traffic might pass through the first device in fail-open mode with no inspection and will be transparent to the switches on both sides. Again, this is an undesirable scenario in cluster environments.
When Bypass is enabled, is performance degradation expected?
The Bypass feature should not increase latency or any performance degradation.
Does Bypass card support Link Aggregation (Bond)?
Link Aggregation (Bonding) of ports on a Bypass card / of Bypass cards is not supported.
Is Bypass card supported in VSX mode?
Starting from R77, Bypass Card is also supported in VSX mode.
Contact Check Point Solution Center via local Check Point office to get a Bypass Card Hotfix.
How long does it take for the NIC to fail open?
If bypass is initiated, the flipping is immediate as this is hardware bypass. Yet, the thresholds for each of the following states should be considered:
There is a power loss - Immediate
The appliance is rebooting - Immediate
Unable to allocate memory in kernel - Immediate
High CPU and packet drops - Threshold is set to 5,000 drops and 85% CPU usage within 20 seconds.
DLP process is crash - 20 crashes within 300 seconds
FWD process is not responding - Threshold is set to 75 seconds
Can the Bypass cards be configured to stay in bypass state?
This is currently not supported.
Are there any limitations when using this card?
sk85560 (section: Known Limitations).
Is there any limitation/degradation expected when Bypass card is installed, but bypass feature is not enabled?
No. If bypass mode is not enabled, there should be no difference between using Bypass (Fail-Open) card and normal NIC.
Is 10GbE ByPass supported?
10GbE ByPassis supported on all appliances
Related Solution: sk96246 - Documentation For Check Point Appliances Solution was incorporated into R80.30 Jumbo Hotfix Take 217 (PRJ-12833), for additional information refer to sk153152 - Jumbo Hotfix Accumulator for R80.30 (R80_30_jumbo_hf)