topic Re: FW Accel Conns 0% in Firewall and Security Management

FW Accel Conns 0%

Sam2 — Wed, 02 Feb 2022 18:45:02 GMT

Hi Team,

I have a firewall running R81 with take 44 that currently has 0% accelerated conns, see output below:

Accelerated conns/Total conns : 22/37423 (0%)
Accelerated pkts/Total pkts : 131018190109/134923281770 (97%)
F2Fed pkts/Total pkts : 3905091661/134923281770 (2%)
F2V pkts/Total pkts : 982863959/134923281770 (0%)
CPASXL pkts/Total pkts : 1466487054/134923281770 (1%)
PSLXL pkts/Total pkts : 128928729017/134923281770 (95%)
CPAS pipeline pkts/Total pkts : 0/134923281770 (0%)
PSL pipeline pkts/Total pkts : 0/134923281770 (0%)
CPAS inline pkts/Total pkts : 0/134923281770 (0%)
PSL inline pkts/Total pkts : 0/134923281770 (0%)
QOS inbound pkts/Total pkts : 0/134923281770 (0%)
QOS outbound pkts/Total pkts : 0/134923281770 (0%)
Corrected pkts/Total pkts : 0/134923281770 (0%)

Reviewing fw accel stat does not show that templating should be disabled,

Accept Templates : enabled
Drop Templates : disabled
NAT Templates : enabled

enabled blades output:
fw urlf av appi ips anti_bot ThreatEmulation Scrub

I have reviewed sk32578 and the policy does not include anything that would impact connection templating. For my TP blades, we are using the autonomous policy with the edge profile. I am using updateable objects for both azure and o365, and I have them at the top of my rulebase, is there a chance that they impact secureXL?

Re: FW Accel Conns 0%

Ben_Maoz — Thu, 03 Feb 2022 08:25:05 GMT

Hi Sam2,

Please note " Accelerated conns/Total conns" means fully accelerated connections.

As you can see "PSLXL pkts/Total pkts : 128928729017/134923281770 (95%)" so most of your traffic is accelerated but not fully accelerated (Medium path).

Thanks,

Ben

Re: FW Accel Conns 0%

HeikoAnkenbrand — Thu, 03 Feb 2022 10:53:50 GMT

Hi @Sam2,

It is exactly as @Ben_Maoz described it. If you need more info on the PSLXL path see my articles:
- R8x - Security Gateway Architecture (Logical Packet Flow)
- R8x - Security Gateway Architecture (Logical Packet Flow) - Update R80.20+
- R8x - Security Gateway Architecture (Content Inspection)

Re: FW Accel Conns 0%

Timothy_Hall — Thu, 03 Feb 2022 14:49:26 GMT

As Ben and Heiko said throughput acceleration via the Medium Path is working fine. The zero Accelerated Conns rate just means that SecureXL is not doing Accept templates at all even though fwaccel stat shows that there is no rule disabling templating. Generally I believe this is caused by Anti-bot being enabled, as SecureXL itself cannot perform the IP reputation checks for Accept templates that is required when Anti-bot is enabled. With the advent of Column-based matching in R80.10 Accept templating rates are much less important than they used to be for most environments, so I wouldn't worry about it.