topic Re: Traffic not accelerated by Secure XL-0% in Firewall and Security Management

Traffic not accelerated by Secure XL-0%

Rahul_Borah — Sat, 05 Mar 2022 13:07:22 GMT

Hi mates,

I am facing an issue with secure XL. Traffics not accelerated by Secure XL. F2Fed is 99%

Kindly suggest. Screenshot attached.

Version: R81

Blade: IPS and FW

Rule:350

RAM: 8 GB (85% used)

Regards,

Chris_Atkinson — Sat, 05 Mar 2022 13:40:53 GMT

Is the WAN connection PPPoE?

Or are you using any of the following IPS protections:

* When IPS protection "SYN Attack" ("SYNDefender") is activated in SmartDefense / IPS.

* When IPS protection "Small PMTU" is activated in SmartDefense / IPS.

* When IPS protection "Network Quota" is activated in SmartDefense / IPS (refer to sk31630).

* When IPS protection "Malicious IPs" (DShield.org Storm Center) is activated in SmartDefense / IPS (because it uses Dynamic Objects).

Please also share the following output to start:

[Expert@MyGW:0]# fwaccel stat

Rahul_Borah — Sat, 05 Mar 2022 14:43:32 GMT

Hi Chris,

Please find the details...

* Is the WAN connection PPPoE? NO

* When IPS protection "SYN Attack" ("SYNDefender") is activated in SmartDefense / IPS. Enabled

* When IPS protection "Small PMTU" is activated in SmartDefense / IPS. Inactive

* When IPS protection "Network Quota" is activated in SmartDefense / IPS (refer to sk31630). Inactive

* When IPS protection "Malicious IPs" (DShield.org Storm Center) is activated in SmartDefense / IPS (because it uses Dynamic Objects). Inactive

Screenshot attached...

Timothy_Hall — Sat, 05 Mar 2022 14:51:21 GMT

The only red flag is SYNDefender being enabled, but that functionality was added into SecureXL in R80.20 and should not be the cause of high F2F. sk120476: Important changes in IPS "SYN Attack" (SYN Defender) protection

Was the fwaccel stats -s command run on the standby member of a cluster? If so high F2F is expected.

Please provide the output of enabled_blades and the Super Seven commands for further diagnosis:

Rahul_Borah — Sat, 05 Mar 2022 15:03:12 GMT

Hi,

Please find the details...

Was the fwaccel stats -s command run on the standby member of a cluster? If so high F2F is expected.
A- Yes, F2F is 99%

Please provide the output of enabled_blades and the Super Seven commands for further diagnosis:
A- Only FW and IPS blads are enable

Chris_Atkinson — Sat, 05 Mar 2022 15:10:49 GMT

This is expected on the standby member.

Review the stats on the active member instead.