> Source: [sk112572](https://support.checkpoint.com/results/sk/sk112572)

# sk112572 - Monitor Mode on SMB appliances running Gaia Embedded OS

| Property | Value |
|----------|-------|
| Solution ID | sk112572 |
| Date Created | 2016-07-24 |
| Last Modified | 2025-09-23 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R82.00.X, R81.10.X |
| Platform | 1500, 1600, 1800 |

## Solution

**Note** - For versions R81.10.x, refer to the [R81.10.X Quantum Spark Locally Managed Administration Guide](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Default.htm) \> Chapter "Configuring the Local Network" \> section "Monitor Mode on Quantum Spark Gateways".

### Monitor Mode on SMB Appliances running Gaia Embedded OS

SMB appliances running the firmware R77.20.40 and above, can monitor traffic from a Mirror Port / Span Port on a switch.

Monitor Mode enhances the ability of the appliance to monitor and analyze traffic, without affecting the production environment. For example, you can monitor application usage in your organization or evaluate Software Blade capabilities before you decide to purchase.

From the firmware R77.20.70 it is possible to configure multiple local networks to be in monitor mode at the same time (not supported on SMB appliances 600 and 1100).

### Identifying the Traffic and Enforcing the Policy

On the appliance, the outbound and inbound policies are separate. The appliance must be able to recognize the direction of traffic to apply the correct policy.

With Monitor Mode, the appliance uses one of these methods to identify the traffic and enforce the policy:

* **Automatic Learning**

  The appliance identifies the local Default Gateway from requests to the Internet (specifically, requests to Google). The appliance makes sure that traffic to the Default Gateway is inspected by the Outbound Rule Base, and traffic from the Default Gateway is inspected by the Inbound Rule Base.
* **User-Defined Networks**

  You can manually define Internal networks. Networks that are not defined as Internal, are considered to be External. This definition is for policy enforcement, not actual topology.
  * Traffic to Internal hosts is inspected by the Inbound Rule Base.
  * Traffic from Internal hosts is inspected by the Outbound Rule Base.
  * Traffic from an external host to an external host is not inspected.

### Configuring Monitor Mode

1. Only in R77.20.40: Enable the Global Monitoring with this command in Gaia Clish:

   `set monitor-mode-configuration allow-monitor-mode true`

   Note: Starting from the firmware R77.20.51, the option to configure the Monitor Mode is not hidden.
2. Configure the Monitor Mode in WebUI or in CLI:

   * Configuring Monitor Mode in WebUI:

     1. Navigate to **Device** view \> **Network** section \> **Local Network** page.

     2. Double-click the port, on which you need to enable the Monitor Mode.

     3. At the top, click the **Configuration** tab.

     4. In the section **Interface Configuration** , in the drop-down **Assigned To** , select `Monitor Mode`.
     5. The checkbox **Manually defined internal networks** controls the method for identifying the traffic and enforcing the policy:

        * To use the "Automatic Learning" method, **clear** this checkbox.

        * To use the "User-Defined Networks" method, **select** this checkbox and:

          1. Click **New** to define an internal network.
          2. Enter the IP address of the network.
          3. Enter the subnet mask of the network.
          4. Click **Apply**.

          An internal network can be with a 255.255.255.255 subnet mask, for one host. For example, to monitor the traffic after the router, enter the IP address of the Default Gateway and the 255.255.255.255 subnet.
     6. Click **Apply**.

        The **Local Network** page should now show **Monitor Mode** in the name of the port.
   * Configuring Monitor Mode in CLI

     1. Enable the Monitor Mode on the required port:

        `set interface <Name of Port> monitor-mode`
     2. Configure the method for identifying the traffic and enforcing the policy:

        * To configure the "Automatic Learning" method, disable the "User-Defined Networks" method:

          `set monitor-mode-configuration use-defined-networks false`
        * To configure the "User-Defined Networks" method:

          1. Add the required internal network:

             `add monitor-mode-network ipv4-address <IP> subnet-mask <mask>`
          2. Enable the "User-Defined Networks" method:

             `set monitor-mode-configuration use-defined-networks true`

          To see the user-defined internal networks:

          `show monitor-mode-network`

### Troubleshooting

* If you do not see the **Monitor Mode** option in the interface settings \> **Configuration** tab \> **Interface Configuration** section \> **Assigned To** drop-down menu:

  1. Double-click the **LAN1** port.
  2. Remove the port you want to monitor.
  3. Click **Apply**.
  4. Double-click the port you want to monitor.
* To verify that the Monitor Mode is working, capture the traffic on the corresponding Bridge interface called "`brS-<Name of Port>`".

  You can capture the traffic in WebUI or with the command "`tcpdump -i brS-<Name of Port>`" in the Expert mode.

  For example, if you enabled the Monitor Mode on the port **LAN2** , then the corresponding Bridge interface is called "**brS-LAN2**".

### Known Limitations

* Switches that output 802.1Q (VLAN) tagged packets are not supported.
* On SMB 600/1100 appliances, it is highly recommended to configure LAN1, LAN2, LAN5, LAN6 or LAN7 for Monitor Mode.
* Cluster configuration is not supported in the Monitor Mode.

### Related solutions

* [sk70900 - How to configure Monitor Mode on DLP Security Gateway running Gaia OS R75.45 / R76 / R77 and above](http://supportcontent.checkpoint.com/solutions?id=sk70900)
* [sk88980 - How to configure a Security Policy for Mirror Port Use](http://supportcontent.checkpoint.com/solutions?id=sk88980)
* [sk101670 - Monitor Mode on Gaia OS and SecurePlatform OS](http://supportcontent.checkpoint.com/solutions?id=sk101670)
* [sk72640 - Optimizing Security Gateway Configuration for Mirror Port Use](http://supportcontent.checkpoint.com/solutions?id=sk72640)
* [sk172286 - Traffic capture on a Quantum SPARK appliance on a Monitor port shows only broadcast and multicast packets](http://supportcontent.checkpoint.com/solutions?id=sk172286)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content