topic Re: Top-Connections in Firewall and Security Management

Top-Connections

HristoGrigorov — Tue, 01 Sep 2020 07:27:07 GMT

I upgraded our production firewall to R80.40 T77, applied sk167903 but can't get Network -> Top-Connections to work in CPview. Am I the only one experiencing this kind of problem ?

Re: Top-Connections

HeikoAnkenbrand — Tue, 01 Sep 2020 07:41:12 GMT

Hi @HristoGrigorov

Is is no longer supported in R80.40.The 3.10 kernel do no longer supports firewall priority queues. These are required for showing the top connections in cpview.

More read here: R80.x - Performance Tuning Tip - Elephant Flows (Heavy Connections)

Re: Top-Connections

Martin_Valenta — Tue, 01 Sep 2020 08:03:51 GMT

yes, same here, also not working. This is fun stuff really.

I don't understand why this SK is requiring also changes with on fly command and putting it to simkern.conf file, like it could not be there by default aftering installing patch higher > take 69

Re: Top-Connections

HristoGrigorov — Tue, 01 Sep 2020 08:06:04 GMT

Thanx for sharing this info Martin. I have wondered the same and my assumption is that it may cause performance issues on really busy fw.

Re: Top-Connections

Martin_Valenta — Tue, 01 Sep 2020 08:10:53 GMT

it works now for me..how much connections did you have on that production fw? there must be some threshold for how many connections it needs to have to show it as top connections..

Re: Top-Connections

HristoGrigorov — Tue, 01 Sep 2020 08:20:25 GMT

I hope someone from CheckPoint will clarify this but I believe it is not about the number of concurrent connections but rather pps and Mbps above some threshold.

But I remember this has worked in T69 on our lab server and was kind of surprised to see it not working in T77 on prod fw.

@Martin_Valenta KMFW or USFW there ?

Re: Top-Connections

HristoGrigorov — Tue, 01 Sep 2020 08:26:58 GMT

LOL, I found why it was not working. What I was doing was copy&paste from that SK. When I typed the command manually it started to work right away. There must be some hidden character or possible browser issue (Chome on Windows).

Re: Top-Connections

Martin_Valenta — Tue, 01 Sep 2020 08:31:23 GMT

KMFW, it's azure vm with 4 cores.