topic Re: CoreXL SND and FW Instance for VSX in Firewall and Security Management

CoreXL SND and FW Instance for VSX

Kosin_Usuwanthi — Sun, 07 Feb 2021 09:41:28 GMT

I have project to implement VSX on checkpoint 28000 (72 cpu with SMT) and I have plan to assign 20 cpu for SND and others for fw instance share to all vsx and I have question as below.

1.Can I just allocate 20 cpu for SND and auto assign to all interface like non vsx gateway ?

2.When I set 32 cpu for fw instance on smart console how I see what cpu number that allocate from this setting ?

3.From question no.2 if I have 3 vsx all vsx will use same cpu or not ?

Thank you

Re: CoreXL SND and FW Instance for VSX

genisis__ — Sun, 07 Feb 2021 12:49:00 GMT

If you mean can you take advantage of the dynamic spit feature, then no it's not supported in VSX mode. Please see sk164155

Not supported: Check Point Appliances that run in VSX mode (regardless of the number of CPU cores), Check Point Maestro

Re: CoreXL SND and FW Instance for VSX

Kosin_Usuwanthi — Sun, 07 Feb 2021 13:07:24 GMT

Thank you but I'm not mean dynamic balance just like when we use cpconfig and allocate cpu fw instance and others for snd.

I don't want to manual assign cpu number for fw instance and snd.

Re: CoreXL SND and FW Instance for VSX

genisis__ — Sun, 07 Feb 2021 14:10:03 GMT

I belive you can do this by using fw ctl affinity -s

also remember that each VS core allocation should remain within the same CPU.

good command that Tim provided:

cat /proc/cpuinfo | awk '/processor/{c=$3} /physical id/{p=$4} /core id/{d=$4; print p,"-",d,"-",c}'| sort -k1n,1 -k3n,3 -k5n,5

example:

VS1 = CPU 0, core 5,21,6,22

Re: CoreXL SND and FW Instance for VSX

Kosin_Usuwanthi — Mon, 08 Feb 2021 04:44:35 GMT

I have set 32 cpu for each vsx on smart console but when I show fw ctl affinity -l it show cpu per each vsx more than 32 cpu

fw ctl affinity -l
Interface Mgmt: CPU 0
VS_0 fwk: CPU 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71
VS_1 fwk: CPU 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71
VS_2 fwk: CPU 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71
Interface eth7-01: has multi queue enabled
Interface eth7-02: has multi queue enabled
Interface eth3-01: has multi queue enabled
Interface eth3-02: has multi queue enabled
Interface eth5-01: has multi queue enabled
Interface eth8-07: has multi queue enabled
Interface eth8-08: has multi queue enabled
Interface eth6-01: has multi queue enabled
Interface Sync: has multi queue enabled
Interface eth5-02: has multi queue enabled
Interface eth6-02: has multi queue enabled
Interface eth1-01: has multi queue enabled
Interface eth6-03: has multi queue enabled
Interface eth1-02: has multi queue enabled
Interface eth6-04: has multi queue enabled
Interface eth2-01: has multi queue enabled
Interface eth2-02: has multi queue enabled
Interface eth2-03: has multi queue enabled
Interface eth2-04: has multi queue enabled

Re: CoreXL SND and FW Instance for VSX

genisis__ — Mon, 08 Feb 2021 09:11:18 GMT

I believe this is normal unless you have manually setup affinity using 'sim affinity -s' ('ve not personally used this but I believe this is the reason why you are seeing the above output).

another handy command found here.

go into the VS:

top -d 1 -H -p $(pgrep fwk$(echo $INSTANCE_VSID))

This will show you the fwk process utilisation for this VS.