topic Re: VSX not in USFW ? in Firewall and Security Management

VSX not in USFW ?

Wolfgang — Wed, 06 Apr 2022 18:53:12 GMT

We did some troubleshooting regarding a problem and detect that we have definite Output of 'fw ctl affinity' does not show FWK affinity to CPU core after upgrade of R80.30 Security Gateway to R80.40

cpprod_util FwIsUSFW shows „0“

Some virtual switches, firewalls and a virtual router are running, looks like no problem at the moment. To change this a reboot will be need and we are waiting for a maintenance schedule.
Please can someone explain if we run in a problem with USFW disabled?

15600 appliance running R80.40 VSX HA

Re: VSX not in USFW ?

Chris_Atkinson — Thu, 07 Apr 2022 02:06:44 GMT

15600 generally wouldn't have USFW enabled by default, also it's unlikely that you were previously using the 3.10 kernel version of R80.30. With that said VSs are already user mode processes...

What could be made clearer is the interaction between VSX & USFW on such appliance models. Will submit feedback on sk167052 accordingly.

Re: VSX not in USFW ?

shais — Thu, 07 Apr 2022 06:07:53 GMT

Hi,

While VSX indeed utilizes USFW infra, it's not registered as USFW.

The registry helps us understand in what mode the setup is - Kernel mode / User mode / VSX
As VSX contains more than the regular USFW, we identify it by using a specific registry and not the User Mode.

This is valid and you should not change the registry unless you are removing VSX and changing to User Space FireWall mode