The Switching section provides Layer 2 network management capabilities for the Industrial Firewall. This section is available in Routing Mode only and is not accessible when the appliance is operating in Transparent Mode.
VLAN Aware-Bridge
A VLAN Aware-Bridge extends a standard network bridge with IEEE 802.1Q VLAN awareness. Each port on the bridge can be configured to accept tagged frames (trunk port), untagged frames (access port), or both, enabling seamless integration with upstream switches and multi-VLAN OT network architectures.
You must enable VLAN Filtering on the bridge for VLAN membership rules to take effect. Without VLAN Filtering enabled, the bridge behaves as a plain Layer 2 bridge and forwards all frames to all ports regardless of their VLAN tag — effectively bypassing all per-VLAN access control configured below.
Egress VLAN ID: The VLAN ID that the bridge applies to a packet when sending it out of a port. It determines which VLAN the outgoing frame belongs to on that egress port, and may also control whether the frame is sent tagged or untagged depending on the port's VLAN configuration.
Tagged VLANs: VLANs for which frames are forwarded with the 802.1Q VLAN tag preserved on egress. Use this on trunk ports connected to switches or other VLAN-aware devices.
Untagged VLANs: VLANs for which the 802.1Q tag is stripped before frames are forwarded on egress. Use this on access ports connected to end devices that do not process VLAN tags.
PVID (Port VLAN ID): The default VLAN ID assigned to untagged frames arriving on a port. Frames without an 802.1Q tag are treated as belonging to the PVID VLAN upon ingress.
A port can belong to multiple VLANs simultaneously — as a tagged member for trunk VLANs and as an untagged member for its access VLAN. The PVID must correspond to one of the port's configured VLANs.
MAC Filtering
A security feature that allows or denies network access based on the unique MAC addresses of devices. By creating a list of permitted or blocked MAC addresses, you can control which devices can connect to your network, enhancing security.
Setting
Log Limitation: Restrict the logging of each MAC Filtering rule based on the specified rate limit and burst limit.
Rules
Source MAC: The MAC address of the device initiating the traffic.
Interface: The bridge where the rule is applied. We can create Bridge at Network tab
Destination MAC: The MAC address of the target device.
Ethernet Type: The type of Ethernet protocol being used.
Status: Indicates whether the rule is enabled or disabled.
Log: Option to log traffic that matches the rule.
Action: Options to edit or delete the rule.
Alert
Enter the MAC address in the provided field. Optionally, you can assign a friendly name to the IP or MAC address for easier identification. If you wish to remove the MAC address you just added, click the Delete Last IP/MAC button. The appliance will generate an event for any blocked traffic directed to the MAC address specified on this page.
MAC Address Table
The MAC Address Table displays the live Forwarding Database (FDB) maintained by the Linux kernel bridge. It shows which MAC addresses have been learned on each interface, allowing administrators to monitor device connectivity, identify unknown or unexpected devices on the network, and tune how long learned entries are retained.
Entries Tab
Displays all active MAC address entries currently in the bridge forwarding database.
MAC Address: The hardware address of the learned device.
Interface: The physical member interface on which the MAC address was learned (e.g. LAN).
Bridge: The logical bridge the interface belongs to.
VLAN ID: The VLAN associated with this entry. Blank when the bridge does not have VLAN filtering enabled or when the entry is not associated with a specific VLAN.
Entry Type: How the entry was added to the FDB.
Vendor: The device manufacturer resolved from the MAC address OUI prefix. Blank if the OUI is not found in the vendor list.
Settings Tab
Configures how long dynamically learned MAC address entries are retained in the FDB before they expire.
Aging Time: The number of seconds a dynamically learned entry remains in the table without being refreshed by new traffic. When a device stops sending frames, its entry is removed after this period. Valid range: 10–1,000,000 seconds. Default: 300 seconds.
SPAN/RSPAN
SPAN
Source Port(s): One or more interfaces whose traffic is mirrored.
Direction: Controls which traffic direction is mirrored: Ingress (Rx): Mirror only inbound traffic on the source port Egress (Tx): Mirror only outbound traffic on the source port. Both: Mirror all traffic in both directions (default).
Destination Port: The interface where mirrored traffic is delivered. Connect this port to a monitoring device such as an IDS sensor, packet analyzer, or data recorder. The destination port only receives mirrored frames and cannot forward normal network traffic while assigned to a SPAN session.
RSPAN
RSPAN uses a dedicated VLAN to transport mirrored traffic across multiple switches to a remote destination. The source switch encapsulates copied frames in the RSPAN VLAN; the destination switch strips the RSPAN encapsulation and delivers the frames to the monitoring port.
RSPAN is configured in two roles — each role is set up separately on the respective appliance:
RSPAN - Source Switch
Configured on the appliance where the traffic to be monitored originates. The source switch captures frames from the specified source ports and floods them into the RSPAN VLAN, which carries the mirrored traffic toward the destination switch over trunk links.
Source Port(s): One or more interfaces whose traffic is mirrored, specified on the source appliance.
Direction: Controls which traffic direction is mirrored (Ingress, Egress, or Both).
RSPAN VLAN: The dedicated VLAN ID used exclusively to carry mirrored traffic between the source and the remote destination. This VLAN must be configured as a trunk VLAN on all intermediate switches in the path. Do not use this VLAN for any production traffic.
RSPAN - Destination Switch
Configured on the appliance where the monitoring device is connected. The destination switch receives mirrored frames from the RSPAN VLAN, strips the RSPAN encapsulation, and forwards the reconstructed frames out of the designated destination port to the monitoring device.
RSPAN VLAN: The dedicated VLAN ID used exclusively to carry mirrored traffic between the source and the remote destination. This VLAN must be configured as a trunk VLAN on all intermediate switches in the path. Do not use this VLAN for any production traffic.
Destination Port: The interface on the remote appliance where mirrored traffic is delivered to the monitoring device.