topic Re: CoreXL disabled after reboot or upgrade in Firewall and Security Management

CoreXL disabled after reboot or upgrade

Paul_Hagyard — Tue, 19 Jul 2022 02:46:57 GMT

Hoping we can get some clarification from a Check Point employee as attempts to clarify through local SEs haven't resolved it for us.

Similar to sk172623 and https://community.checkpoint.com/t5/General-Topics/CoreXL-option-disabled-in-cpconfig/m-p/73820, we have seen ongoing issues in multiple versions (and environments - at least four so far) where CoreXL configuration disappears on reboot or with an upgrade.

We were told that PRJ-20160 was fixed from R80.40 JHF 100, which seems related to sk172623 above, but we've seen the issue in R80.40 JHF 125 on CG IaaS on VMware, and more recently in an in-place VSX upgrade from R80.20 to R81 on HPE server hardware (open server).

We're still deploying the originally suggested workaround from TAC (chattr +i $FWDIR/boot/boot.conf) to make boot.conf immutable and prevent these issues.

I've never seen PRJ-20160 appear in any of the release notes. We were told in December that the issue was (again...) fixed in R81.10 - but there's no obvious relevant items in the release notes.

Is there a clear indication that this issue is resolved in R81.10?

Re: CoreXL disabled after reboot or upgrade

Chris_Atkinson — Tue, 19 Jul 2022 07:12:00 GMT

The referenced SK states relevance to R81 and earlier only and I can't see anything to suggest otherwise.

Re: CoreXL disabled after reboot or upgrade

Timothy_Hall — Tue, 19 Jul 2022 14:11:54 GMT

I have run into this problem teaching the CCSE class, some students run into it and others don't. We use the cp_conf corexl enable 3 workaround on p. 563 since cpconfig cannot be used to force CoreXL back on. I'm suspecting that this may have something to do with Dynamic Balancing/Split which exists in R80.40 but is not enabled by default: sk164155: Dynamic Balancing for CoreXL

I've also requested awhile back for the owner of that SK to update it specifying exactly when this feature will be enabled by default after upgrade, as it doesn't seem to be on after an in-place upgrade to R81+, but is enabled after a fresh install of R81+. Jumbo HFAs may be messing with this as well.

Re: CoreXL disabled after reboot or upgrade

AmitShmuel — Tue, 19 Jul 2022 16:03:00 GMT

Dynamic Balancing is not supported on open servers or VMware, so this perhaps is not the case here.

After an in-place upgrade to R81+, Dynamic Balancing will be enabled by default only if CoreXL or Multi-Queue settings were not manually changed in the old version, i.e. the feature will not override existing manual settings. I've added it to the SK, it should be published shortly, thanks.