Nokia Network Voyager for IPSO 4.0 Reference Guide 139Enabling or Disabling VRRP for a Transparent Mode GroupIf you are enabling VRRP on a VRRP master, the node will perform transparent modeoperations as described in the section, “Transparent Mode” on page 132. As a VRRP standby, itwill drop all packets except those with local destinations.For more information on configuring VRRP, see “Configuring VRRP” on page 186To enable or disable VRRP for a transparent mode group1. Click Transparent Mode under Configuration > Interface Configuration in the tree view.2. Click the link of the transparent mode group to which you would like to enable VRRP.3. Select the Yes or No radio button in the VRRP Enabled table.4. Click Apply.5. Click Save to make your changes permanent.Monitoring Transparent Mode GroupsTo monitor transparent mode groups1. Click Transparent Mode under Monitor in the tree view.2. Click a transparent mode group under XMODE Group Id.Transparent Mode and Check Point NGXThis section explains some details about configuring a firewall to work with transparent mode.Configuring AntispoofingThe proper configuration for antispoofing depends on how the interfaces in the transparent modegroup are configured.All Interfaces Are InternalIf all the interfaces in the group are internal, you should configure antispoofing normally. Youtreat the interfaces as being on the same subnet and, any other nested networks must be properlydefined so that antispoofing to be aware of them and traffic is not dropped.One Interface Is ExternalIf one interface is external, do not use antispoofing. If antispoofing is applied, the firewall dropsreply packets because they are sourced from the same subnet.Configuring VRRPWhen you use the Check Point NGX SmartDashboard to configure the Gateway Clusterproperties of a VRRP pair that uses IPSO transparent mode, you must follow this procedure.
