topic SecureXL - No accelerated connections in Firewall and Security Management

SecureXL - No accelerated connections

CP-NDA — Wed, 22 Dec 2021 11:40:30 GMT

Hi,

We are facing an issue with SecureXL

First of all the output of fwaccel stat were indicating that Accept Templates were disabled by Firewall. After investigation we found that QoS module were active in the Package but blade were disabled on the Gateway. Seems that disabling QoS from the package improved the situation as here is the output now

Accept Templates : enabled
Drop Templates : enabled
NAT Templates : enabled

# fwaccel stats -s
Accelerated conns/Total conns : 66/29137 (0%)
Accelerated pkts/Total pkts : 68884176/69598302 (98%)
F2Fed pkts/Total pkts : 714126/69598302 (1%)
F2V pkts/Total pkts : 476266/69598302 (0%)
CPASXL pkts/Total pkts : 817/69598302 (0%)
PSLXL pkts/Total pkts : 68672216/69598302 (98%)
CPAS pipeline pkts/Total pkts : 0/69598302 (0%)
PSL pipeline pkts/Total pkts : 0/69598302 (0%)
CPAS inline pkts/Total pkts : 0/69598302 (0%)
PSL inline pkts/Total pkts : 0/69598302 (0%)
QOS inbound pkts/Total pkts : 0/69598302 (0%)
QOS outbound pkts/Total pkts : 0/69598302 (0%)
Corrected pkts/Total pkts : 0/69598302 (0%)

As you can see accelerated packets is fine but accelerated conn remain to 0%

What could be the reason of this poor acceleration rate ?

Already involved TAC & followed this SK https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk32578#Acceleration%20of%20connections%20(templates)

Thank you for your help !

Re: SecureXL - No accelerated connections

_Val_ — Thu, 23 Dec 2021 08:03:28 GMT

Actually, your thoughput acceleration rate is very good, 98% packets are accelerated. It is just your template acceleration rate is low. May be nature of the traffic, or something else that breaks templating at an early stage. Which version is in use?

Re: SecureXL - No accelerated connections

CP-NDA — Thu, 23 Dec 2021 08:20:07 GMT

Hi @_Val_

Thank you

Indeed Acceleration Rate is very good but Connection rate were flagged by TAC as we are facing big instability & memory leaks issue

We are running on R81.10 T9

Re: SecureXL - No accelerated connections

_Val_ — Thu, 23 Dec 2021 08:52:19 GMT

Can you please share your SR via a personal message? Thanks

Re: SecureXL - No accelerated connections

the_rock — Thu, 23 Dec 2021 11:35:57 GMT

I actually installed jumbo take 14 in my R81.10 lab and I can see that sxl stats are much better. Funny enough, did not see any sxl improvements listed though...

Re: SecureXL - No accelerated connections

CP-NDA — Thu, 23 Dec 2021 11:57:24 GMT

Interesting hoewever I really think we need to identify the root cause with TAC without upgrading as it's getting a "traditional answer"

Re: SecureXL - No accelerated connections

_Val_ — Thu, 23 Dec 2021 12:03:33 GMT

Not really. JHFs contain lots of fixes, memory leaks included. If you are not on the latest GA Jumbo, it is a very good idea to install it.

Re: SecureXL - No accelerated connections

CP-NDA — Thu, 23 Dec 2021 12:06:37 GMT

Indeed but we have multiple case opened since R80.40. TAC always request for upgrade but at the end of the day same issue occured without finding the root cause. So it's very important to understand the cause and fix it definitvely.

We are not trusting upgrade as the single solution for these issues

Re: SecureXL - No accelerated connections

the_rock — Thu, 23 Dec 2021 12:09:30 GMT

I agree 100%. I just installed it since its a lab and quite frankly, I dont care if it breaks, I will just build another one 🙂

Re: SecureXL - No accelerated connections

_Val_ — Thu, 23 Dec 2021 13:13:46 GMT

I respectfully disagree with approach.

Having lates Jumbo is actually helping with eliminating all known and fixed bugs, leaving only new and unknown to be investigated. This literally narrows the investigation field, makes TAC processes more effective, and saves times both to you and your support counterpart.

I would understand if you want to stay behind with more tested and proven good versions, but you are already running the latest and (yet) non generally recommended release. Running it as vanilla version does not make sense.

Re: SecureXL - No accelerated connections

the_rock — Thu, 23 Dec 2021 13:17:16 GMT

Well, we can all agree to disagree...thats what makes this world go round, right? ; ). I see the point you make @_Val_ , but I also logically see the point @CP-NDA makes. I can only speak from my own experience with this and can certainly say that it was not always a winning situation having latest jumbo installed.

Re: SecureXL - No accelerated connections

CP-NDA — Thu, 23 Dec 2021 13:22:15 GMT

It's also very difficult to always find windows maintenance as these upgrade are most of the time disruptive for production environement

After 3 tries and when issues are still occuring we are looking for other suggestion than just an upgrade

I'm also generally ok with proactive upgrade but in this specific case we really need to find other suggestion for the customer even more when previous upgrades were recommended by TAC to solve these issue without success

We usually only installed GA version

Re: SecureXL - No accelerated connections

_Val_ — Thu, 23 Dec 2021 13:29:26 GMT

Well, @the_rock what can I say... Each jumbo has thousands of fixes. It is really unnecessary to reinvent the wheel every time you stumble upon a bug on an outdated version, which is already eliminated.

If you want to get your production systems up and running as fast as possible, I would suggest following support best practices. And if you want to help Check Point debugging the code, you better join our QA team 🙂

The rest is up to you. Remind me your statement above the next time you complain about TAC efficiency, pal 🙂

Re: SecureXL - No accelerated connections

CP-NDA — Thu, 23 Dec 2021 13:30:58 GMT

Understood

Please not that for the moment TAC doesn't suggest the upgrade at the moment and they are still investigating hoewever I've the feeling that they will do this suggestion... For a new issue I'm quite ok with this but with persistent issue I'm expecting more interactions with support.

Re: SecureXL - No accelerated connections

_Val_ — Thu, 23 Dec 2021 13:31:14 GMT

Yes, @CP-NDA you are right, T9 is GA jumbo, my mistake.

Disregard my previous comments, I misread your post and thought you are running the initial release.

Re: SecureXL - No accelerated connections

the_rock — Thu, 23 Dec 2021 13:35:50 GMT

Well, I cant say much more either brother :-). Im not complaining at all, just making a statement, my own opinion. I would not go as far to say each jumbo has thousands of fixes (thats really a huge overstatement), but I can tell you that many times in the past, I had cases where customers did have latest jumbo installed and support approach was exactly the same, really no difference. On the other hand, few TAC people even told me before, which I agree with wholeheartedly, that it wont make much difference installing latest jumbo, unless there is specific fix included. To me, there is lots of logic in that sort of statement.

Anyway, just my 2 cents.

Re: SecureXL - No accelerated connections

CP-NDA — Thu, 23 Dec 2021 13:40:57 GMT

No worries I will keep you updated

Case is escalated and they suggest to clear connections tables

Not easy in a prod environement but we need to progress. Not sure that clearing connection table will improve the situation as we don't see any new connection in the fwaccel stats -s

Re: SecureXL - No accelerated connections

the_rock — Thu, 23 Dec 2021 13:43:25 GMT

Im pretty positive that wont do anything...Im not sure either what clearing conn table would improve here. I mean, you can try, but I would be shocked if it did anything in your case.

Re: SecureXL - No accelerated connections

CP-NDA — Thu, 23 Dec 2021 13:48:38 GMT

I'm also 100% that will not have any impact. We have new connection all the time an number is blocked at 65 since yesterday 😅

I can not reject all TAC recommandation so I will request a downtime to do that and maybe combine this with a new upgrade... It's difficult to explain to a customer when you even don't trust the solution yourself

Re: SecureXL - No accelerated connections

the_rock — Thu, 23 Dec 2021 13:53:16 GMT

Again, agree wholeheartedly with everything you said. The way I look at it is this...if anyone asks you to do something, you are entitled to ask them the reason why, its not much to ask for. If they cant give you a logical reason, that means they dont even believe in what they are asking you to do.

Just my personal opinion, but I believe thats true for anything in life : - )