Ethernet bridge big problem on Internal network

I have recently implemented a bridge, and it is working well, so there is hope.

The documentation says that a bridge can only be formed from unused NICs, so you need at least 3 spares -- 2 for the new bridge, and one for managing the device during the transition.  It sounds like you tried to a shortcut using CC, but apparently it did not work out.

For my process it helped to have two laptops, one for configuration and one for testing.

Assume:

• 192.168.1.10 on A1, with default gateway to 192.168.1.1
• A2 configured with 10.10.10.10 for temporary administration.   Connect with a crossover cable and perform the process from laptop #1
• Assume we are moving from out-of-band configuration to in-line with another firewall.

Process:

• Combine unused A3 and A4 to create BR1.
• Remove 192.168.1.10 from A1, apply it to BR1.
• Move the cable from A1 to A3 to make it active. 
• Connect A4 as desired to connect the firewall and complete the bridge.
• Configure default gateway to route toward the firewall and the internet
• Configure static route to send internal traffic 192.168.0.0/16 toward 192.168.1.1
• Configure other static routes as needed.
• Move any additional interface addresses from A1 to BR1.
• If any network objects were locked on A1, remove the lock or move them to BR1.   Searching the Network object list for A1 works well to ensure completeness of this step.
• Use laptop#2 for testing, first as an internal client doing outbound traffic, then as an external client doing inbound traffic such as WAF or VPN

Notes

• If A4 connects directly to a firewall, you may need a crossover cable.   You can also use ethtool from ssh to force MDIX mode.   My appliance did not perform automatic MDI/MDIX switching, nor did my firewall, so I had to set it explicitly.

Hope this helps.

I have recently implemented a bridge, and it is working well, so there is hope.

The documentation says that a bridge can only be formed from unused NICs, so you need at least 3 spares -- 2 for the new bridge, and one for managing the device during the transition.  It sounds like you tried to a shortcut using CC, but apparently it did not work out.

For my process it helped to have two laptops, one for configuration and one for testing.

Assume:

• 192.168.1.10 on A1, with default gateway to 192.168.1.1
• A2 configured with 10.10.10.10 for temporary administration.   Connect with a crossover cable and perform the process from laptop #1
• Assume we are moving from out-of-band configuration to in-line with another firewall.

Process:

• Combine unused A3 and A4 to create BR1.
• Remove 192.168.1.10 from A1, apply it to BR1.
• Move the cable from A1 to A3 to make it active. 
• Connect A4 as desired to connect the firewall and complete the bridge.
• Configure default gateway to route toward the firewall and the internet
• Configure static route to send internal traffic 192.168.0.0/16 toward 192.168.1.1
• Configure other static routes as needed.
• Move any additional interface addresses from A1 to BR1.
• If any network objects were locked on A1, remove the lock or move them to BR1.   Searching the Network object list for A1 works well to ensure completeness of this step.
• Use laptop#2 for testing, first as an internal client doing outbound traffic, then as an external client doing inbound traffic such as WAF or VPN

Notes

• If A4 connects directly to a firewall, you may need a crossover cable.   You can also use ethtool from ssh to force MDIX mode.   My appliance did not perform automatic MDI/MDIX switching, nor did my firewall, so I had to set it explicitly.

Hope this helps.