topic Re: CloudGuard CPU 0 "Type Other" in Firewall and Security Management

CloudGuard CPU 0 "Type Other"

AaronCP — Thu, 16 Sep 2021 20:13:20 GMT

Good evening,

I am experiencing an issue on our CloudGuard gateways (R80.40 T120). We have backups that run every evening that transfer data from Azure to our On-Prem servers. The throughput is approx 500mbps at the time of the transfer and the CPUs were running around 60-70% on average.

I have enabled fast_accel to help with this and I've seen a significant performance improvement this evening......however when monitoring the CPU usage, I noticed that CPU 0 had a higher load that the other 3 cores. When I check the CPU tab in CPView, CPU 0 is listed as Type = Other. The other 3 cores are listed as CoreXL_FW.

When I check the output of fw ctl affinity -l, I can see that CPU 0 looks to be allocated to two separate virtual interfaces. The other CPUs are all assigned to the kernel and other daemons. Also, when I check the output of fwaccel stats -s, it says that Accelerated Pkts/Total Pkts is 98%, and PSLXL Pkts/Total Pkts is 98%.

I was wondering what a likely cause of the CPU 0 "Other" handling traffic instead of the other CoreXL cores could be?

Still pretty new to all of this, so if I've missed anything obvious, please tell me 😊.

Thanks in advance,

Aaron.

Re: CloudGuard CPU 0 "Type Other"

PhoneBoy — Thu, 16 Sep 2021 20:55:51 GMT

It's expected behavior.
When there are four cores or more, they are split between two functions:

SNDs (Secure Network Distributors) which handle traffic from the NICs
FWK (Worker, CoreXL) which handle higher-level inspection (e.g. App Control, Threat Prevention)

A four core system will have a 1/3 split (1 SND, 3 Workers), which is what you are observing.

In practical terms, fully accelerated traffic will hit only the SND cores (or core in your case).
Partially accelerated traffic will hit both the SND core and a Worker core.

Re: CloudGuard CPU 0 "Type Other"

AaronCP — Thu, 16 Sep 2021 21:09:37 GMT

Hey @PhoneBoy,

Thanks for the speedy reply!

What would the possible impact be of assigning SND to a second CPU, and having one less FWK instance? I know Check Point don't support this configuration on less than 8 cores, but we do very little higher level inspection on these firewalls (and unlikely to in the forseeable future). The majority of that traffic is handled by our on-prem firewalls.

Any advice would be appreciated.

Re: CloudGuard CPU 0 "Type Other"

PhoneBoy — Thu, 16 Sep 2021 21:24:25 GMT

Never heard that we don't support it.
That said, the only other option you have is a 2/2 split.
You can configure this via cpconfig (requires a reboot).

Re: CloudGuard CPU 0 "Type Other"

AaronCP — Thu, 16 Sep 2021 21:39:56 GMT

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_PerformanceTuning_AdminGuide/Content/Topics-PTG/CoreXL-Allocating-Additional-CPU-Cores-to-CoreXL-SND.htm

My fault, the article states 'do not recommend' not 'do not support'!

Thanks for the advice.

Re: CloudGuard CPU 0 "Type Other"

PhoneBoy — Thu, 16 Sep 2021 21:47:55 GMT

If you're doing any App Control or Threat Prevention, then yes, not recommended.
In a situation where almost all your traffic is going to be SecureXL accelerated anyway, then this change makes sense.

Re: CloudGuard CPU 0 "Type Other"

Chen_Muchtar — Fri, 17 Sep 2021 13:24:05 GMT

As suggested, you can indeed statically configure 2 SND cores via config (requires reboot).
On upcoming versions, Dynamic Balancing feature will be able to support Cloudguard environments, allowing dynamic CoreXL cores allocation, without requiring a reboot or user intervention (we'll have it also back ported once released)
Contacting you offline to discuss potential early availability support w.t.r