topic Re: Upgrade to R81 SecureXL and Other Issues in Firewall and Security Management

Upgrade to R81 SecureXL and Other Issues

Carlos_Caraball — Tue, 21 Sep 2021 13:28:47 GMT

Hello,

We recently upgraded from R80.40 to R81 and are still experiencing some issues. Here's our environment information:

- Cluster of two 5800 appliances running VSX

- A total of 10 vs systems

- Upgrade from R80.40 old kernel to R81 new kernel (3.10). Had to run a fresh install, vsx util upgrade, vsx util reconfigure

After upgrade was completed over the weekend, noticed on Monday internet traffic gradually slowing down until it totally stopped. After thorough analysis with the checkpoint professional services, we disabled securexl on the vs handling traffic out to the internet and that fixed the problem. Tried enabling securexl after increasing ws_max_sessions_per_conn and ws_max_timestamped_sessions_per_conn params but still experienced the same problem. Also noticed we are not able to run the cipher_util command. It comes back with a "Cannot access features configuration directory" message.

Without securexl on we are experiencing higher than usual cpu usage than normal on our perimeter web traffic gateway and cannot enable disable ciphers not being able to issue the ciphers_util command.

Summary:

- Can't run acceleration on web gateway traffic which hinders cpu usage

- Can't run ciphers_util command

I have created tickets with the TAC for each of these problems.

Want to know if anyone has experience similar issues.

Thanks!

Re: Upgrade to R81 SecureXL and Other Issues

the_rock — Tue, 21 Sep 2021 13:43:20 GMT

Just curious...whats is CPU % difference when you have sxl on/off? Is it really significant?

Re: Upgrade to R81 SecureXL and Other Issues

Carlos_Caraball — Tue, 21 Sep 2021 13:57:16 GMT

It used to be 30-35 % during high use times before. Now we hit 90% during high usage times. Almost constantly over 50%.

Re: Upgrade to R81 SecureXL and Other Issues

the_rock — Tue, 21 Sep 2021 14:06:15 GMT

That sounds pretty serious to me. What did TAC suggest so far?

Re: Upgrade to R81 SecureXL and Other Issues

Carlos_Caraball — Tue, 21 Sep 2021 14:21:16 GMT

No suggestions so far. Re-creating environment on their lab. Will most likely escalate the securexl issue.

Re: Upgrade to R81 SecureXL and Other Issues

the_rock — Tue, 21 Sep 2021 14:37:09 GMT

Good idea.

Re: Upgrade to R81 SecureXL and Other Issues

Hari — Sun, 03 Oct 2021 17:51:04 GMT

issue has been resolved ? we are also planning to upgrade VSX from R80.40 to R81, bit worried after i seeing this post.

Re: Upgrade to R81 SecureXL and Other Issues

PhoneBoy — Sun, 03 Oct 2021 21:44:12 GMT

Just so you know, the new(er) kernel was in R80.40 also.
TAC is definitely going to have to dig into the issue with SecureXL.

Re: Upgrade to R81 SecureXL and Other Issues

Naama_Specktor — Mon, 04 Oct 2021 07:15:41 GMT

Hello Carlos ,

We are not familiar with this issue , I will appreciate it if you share the SR # (you can also in PM).

Re: Upgrade to R81 SecureXL and Other Issues

Hari — Mon, 04 Oct 2021 07:19:17 GMT

looks like still R81 is not recommended for VSX 🙄

Re: Upgrade to R81 SecureXL and Other Issues

Carlos_Caraball — Mon, 04 Oct 2021 12:48:52 GMT

SR#6-0002981704

Re: Upgrade to R81 SecureXL and Other Issues

Carlos_Caraball — Mon, 04 Oct 2021 12:50:16 GMT

Issue has not been resolved yet. TAC is working on a fix for us and was supposed to be ready by past Thursday Sept 30th but haven't heard back from them. Will contact today to find out and get a status update.

Re: Upgrade to R81 SecureXL and Other Issues

PhoneBoy — Tue, 05 Oct 2021 00:56:53 GMT

Where precisely are you seeing a declaration that R81 is NOT recommended for VSX?
It's not clear, on the surface anyway, the issue in this thread has anything to do with VSX.

Re: Upgrade to R81 SecureXL and Other Issues

Hari — Tue, 05 Oct 2021 06:04:33 GMT

yes his environment similar to our setup and don't want to take any unnecessary risk related to production traffic.

Re: Upgrade to R81 SecureXL and Other Issues

Carlos_Caraball — Tue, 05 Oct 2021 11:08:19 GMT

TAC was supposed to deliver a fix last Thursday and they're still working on the fix. I'm also having issues with memory. VSX running web perimeter gateway handling https inspection and the one consuming the most CPU cycles have run out of memory twice now. Monitoring memory now. If it runs out of memory again will have to open another case with TAC for this memory issue.

Re: Upgrade to R81 SecureXL and Other Issues

Ilya_Yusupov — Tue, 05 Oct 2021 13:13:45 GMT

Hi @Carlos_Caraball ,

I will take it offline with you for further investigation.

Thanks,

Ilya

Re: Upgrade to R81 SecureXL and Other Issues

Hari — Fri, 08 Oct 2021 20:32:03 GMT

please let us know the progress of the SR.

Re: Upgrade to R81 SecureXL and Other Issues

Carlos_Caraball — Mon, 11 Oct 2021 11:18:09 GMT

TAC produced a fix on 10/7/2021. I installed it early 10/8/2021 and so far it has fixed all issues. Currently running securexl with no problems reported thus far.

Re: Upgrade to R81 SecureXL and Other Issues

Hari — Sat, 16 Oct 2021 19:22:09 GMT

thanks for the update

Re: Upgrade to R81 SecureXL and Other Issues

genisis__ — Sun, 17 Oct 2021 12:38:36 GMT

Do we know if this will be integrated into the next R81 and R81.10 Jumbos? If so when?