The number of AE interface groups you can add depends on the firewall model. The Product Selection tool indicates the Maximum aggregate interfaces that each firewall model supports. Each AE interface group can have up to eight interfaces.
|
•
|
To configure an AE interface group, Add Aggregate Group, configure the settings described in the following table, and then assign interfaces to the group (see Aggregate Ethernet (AE) Interface).
|
The read-only Interface Name is set to ae. In the adjacent field, enter a numeric suffix to identify the AE interface group. The range of the numeric suffix depends on how many AE groups the firewall model supports. See the Maximum aggregate interfaces supported per firewall model in the Product Selection tool.
|
|||||||||
|
(Optional) Enter a description for the interface.
|
|||||||||
|
|||||||||
|
If you want to export unidirectional IP traffic that traverses an ingress interface to a NetFlow server, select the server profile or NetFlow Profile to define a new profile (see Device > Server Profiles > NetFlow). Select None to remove the current NetFlow server assignment from the AE interface group.
|
|||||||||
|
Aggregate Ethernet Interface > LACP
|
If you enable LACP, interface failure detection is automatic at the physical and data link layers regardless of whether the firewall and its LACP peer are directly connected. (Without LACP, interface failure detection is automatic only at the physical layer between directly connected peers.) LACP also enables automatic failover to standby interfaces if you configure hot spares (see Max Ports).
|
||||||||
|
|||||||||
|
|||||||||
|
Aggregate Ethernet Interface > LACP (cont)
|
|||||||||
|
The number of interfaces (1 to 8) that can be active at any given time in an LACP aggregate group. This value cannot exceed the number of interfaces you assign to the group. If the number of assigned interfaces exceeds the number of active interfaces, the firewall uses the LACP port priorities of the interfaces to determine which are in standby mode. You set the LACP port priorities when configuring individual interfaces for the group (see Aggregate Ethernet (AE) Interface).
|
|||||||||
|
Aggregate Ethernet Interface > LACP (cont)
|
This applies only to firewalls deployed in an HA active/passive configuration; firewalls in an active/active configuration require unique MAC addresses.
|
||||||||
|
Aggregate Ethernet Interface > LACP (cont)
|
If you Use Same System MAC Address, select a system-generated MAC address or enter your own MAC address for both firewalls in the active/passive HA pair. You must verify that the address is globally unique.
|
||||||||
|
Aggregate Ethernet Interface > SD-WAN
|
|||||||||
|
Select a Management profile that defines the protocols (for example, SSH, Telnet, and HTTP) you can use to manage the firewall over this interface. Select None to remove the current profile assignment from the interface.
|
|||||||||
|
Enter the maximum transmission unit (MTU) in bytes for packets sent on this interface (range is 576 to 9,192; default is 1,500). If machines on either side of the firewall perform Path MTU Discovery (PMTUD) and the interface receives a packet exceeding the MTU, the firewall returns an ICMP fragmentation needed message to the source indicating the packet is too large.
|
|||||||||
Use these settings to address the case where a tunnel through the network requires a smaller MSS. If a packet has more bytes than the MSS without fragmentation, this setting enables the adjustment.
|
|||||||||
|
To add one or more static Address Resolution Protocol (ARP) entries, Add an IP address and its associated hardware [media access control (MAC)] address. To delete an entry, select the entry and click Delete. Static ARP entries reduce ARP processing.
|
|||||||||
|
To provide neighbor information for Neighbor Discovery Protocol (NDP), Add the IPv6 address and MAC address of the neighbor.
|
|||||||||
|
If you selected Enable NDP Proxy, you can filter numerous Address entries by entering a filter and clicking Apply Filter (gray arrow).
|
|||||||||
|
Add one or more IPv6 addresses, IP ranges, IPv6 subnets, or address objects for which the firewall will act as NDP proxy. Ideally, one of these addresses is the same address as that of the source translation in NPTv6. The order of addresses does not matter.
If the address is a subnetwork, the firewall will send an ND response for all addresses in the subnet, so we recommend you also add the IPv6 neighbors of the firewall and then click Negate to instruct the firewall not to respond to these IP addresses.
|
|||||||||
|
Negate an address to prevent NDP proxy for that address. You can negate a subset of the specified IP address range or IP subnet.
|
|||||||||
|
Select an LLDP Profile or create a new LLDP Profile. The profile is the way in which you configure the LLDP mode, enable syslog and SNMP notifications, and configure the optional Type-Length-Values (TLVs) you want transmitted to LLDP peers.
|
|||||||||
|
Select Settings to make the DDNS fields available to configure.
|
|||||||||
|
Create a Certificate Profile to verify the DDNS service. The DDNS service presents the firewall with a certificate signed by the certificate authority (CA).
|
|||||||||
The Name and Value fields that follow the vendor name are vendor-specific. The read-only fields notify you of parameters that the firewall uses to connect to the DDNS service. Configure the other fields, such as a password that the DDNS service provides to you and a timeout that the firewall uses if it doesn’t receive a response from the DDNS server.
|
|||||||||