topic Re: Fast accel to be enable in Cluster Gateway in Firewall and Security Management

Fast accel to be enable in Cluster Gateway

Roshan_Sinha — Tue, 27 Jul 2021 04:45:39 GMT

Hi Team,

need your suggestion if we need to enable Fast acceleration rule in Cluster firewall, do i have to enable the same on each firewall manually or if i enable it in Active, it will be replicated in Standby automatically.

Re: Fast accel to be enable in Cluster Gateway

RamGuy239 — Tue, 27 Jul 2021 06:31:33 GMT

You should read sk156672. Fast acceleration requires R80.20+ (new SecureXL) and on a firewall cluster, you need to replicate the rules on all cluster members as it's a per gateway configuration.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk156672

(8) Example Usage:
fw ctl fast_accel add 1.1.1.1 2.2.2.0/24 80 6
fw ctl fast_accel delete 192.168.0.0/16 any 8080 17
fw ctl fast_accel add 255.168.240.0/20 255.0.0.0/8 1503 any
fw ctl fast_accel show_table
fw ctl fast_accel enable
fw ctl fast_accel disable

And remember that policy needs to be pushed after the rules have been added for them to take effect. And it will only affect new connections, existing connections will not be re-matched towards fast acceleration rules.

Re: Fast accel to be enable in Cluster Gateway

Roshan_Sinha — Tue, 27 Jul 2021 16:54:48 GMT

Thank you very much for quick reply and sharing the information.

Re: Fast accel to be enable in Cluster Gateway

Timothy_Hall — Tue, 27 Jul 2021 17:49:32 GMT

Great rundown of the fast_accel feature. One thing to add is if the traffic cannot be accelerated at all and must go slowpath/F2F (and possibly CPASXL path), the fast_accel will have no effect on the acceleration of the matched traffic.