topic Re: SecureXL in Firewall and Security Management

SecureXL

Ratnesh_Singh — Tue, 02 Feb 2021 07:28:36 GMT

Hi Team,

I have doubt related to SecureXL .If we have already connection table in firewall kernel,then what is the need of maintaining secureXL connection table?

Re: SecureXL

Danny — Tue, 02 Feb 2021 07:48:07 GMT

The SecureXL connections table 'fwaccel conns' shows all connections handled by SecureXL while the connections kernel table also shows those not handled by SecureXL. Also check sk104468.

Re: SecureXL

G_W_Albrecht — Tue, 02 Feb 2021 09:37:45 GMT

Look here: sk98348: Best Practices - Security Gateway Performance

Re: SecureXL

Timothy_Hall — Tue, 02 Feb 2021 14:06:53 GMT

When a packet arrives at the firewall, it always hits the SecureXL Implementation Module (sim) kernel driver running on an SND/IRQ core first. In R80.20+ if the packet's attributes match a connection in the SecureXL state table (fwaccel conns - in other words SecureXL is handling that connection), SecureXL commences direct processing on that packet. If the packet does not match a connection in the SecureXL state table because it is the first packet of a new connection, or it is part of an existing unaccelerated connection that is not being handled by SecureXL, the packet is sent up to a Firewall Worker/Instance which is maintaining its own state table (fw tab -t connections). There is a notification mechanism to sync certain operations between the two separate tables.

Re: SecureXL

Bob_Zimmerman — Tue, 02 Feb 2021 14:44:53 GMT

It's probably worth noting the SecureXL table is simpler, so it's faster to check. That's ultimately the reason for maintaining the tables separately.

Re: SecureXL

PhoneBoy — Tue, 02 Feb 2021 20:33:08 GMT

One of the original design goals of SecureXL was to provide acceleration for connections in hardware independent from the main CPU of the system.
This necessitates a separate connection table for the accelerator device itself.
There are no hardware accelerator cards that we sell currently, though they have been sold in the past.