topic Appliances 5900 R80.10 and bonding interfaces limited throughput in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/Appliances-5900-R80-10-and-bonding-interfaces-limited-throughput/m-p/33493#M2717 <HTML><HEAD></HEAD><BODY><P>Hi guys,</P><P></P><P>I have a clusterxl with two appliances 5900 and Gaia OS R80.10.</P><P>Network is configured with 2 bond interfaces 802.3ad layer 3+4, each bond has 4 ethernet aggregated, each bond has more vlan interfaces configured, about 10 in internal bond and 3 on external bond. All ethernet interfaces are connected to cisco switch with LACP configured, 2 groups.</P><P>No QoS is configured, no IPS is configured only security policies with about 50 rules.</P><P>My test is simple I trying to transfer data beetween vlan on internal bond and my speed is about 3Gbps and somethings more, the same test on external bond I got 3Gbps.</P><P>When I trying to transfer data beetween vlan on internal bond and vlan on external bond, I reach the limit of ethernet interface 1Gbps. Why?</P><P>In my test I have used different source address and destination address so also TCP ports all different</P><P>While my test is executing I can see in cpview the throughput on each interfaces, I can see the traffic is balanced beetween they but the sum don't go over 1Gpbs when I use vlans on both bond interfaces, but when the vlan is on same bond interface I see more interfaces reach the limit of 1Gbps so the sum on bond interface is over the 1Gbps and I got 3Gbps and more of throughput.</P><P></P><P>Suggestions?</P><P>Thanks</P></BODY></HTML> Sat, 06 Oct 2018 07:30:00 GMT Giovanni_Nervi 2018-10-06T07:30:00Z Appliances 5900 R80.10 and bonding interfaces limited throughput https://community.checkpoint.com/t5/Firewall-and-Security-Management/Appliances-5900-R80-10-and-bonding-interfaces-limited-throughput/m-p/33493#M2717 <HTML><HEAD></HEAD><BODY><P>Hi guys,</P><P></P><P>I have a clusterxl with two appliances 5900 and Gaia OS R80.10.</P><P>Network is configured with 2 bond interfaces 802.3ad layer 3+4, each bond has 4 ethernet aggregated, each bond has more vlan interfaces configured, about 10 in internal bond and 3 on external bond. All ethernet interfaces are connected to cisco switch with LACP configured, 2 groups.</P><P>No QoS is configured, no IPS is configured only security policies with about 50 rules.</P><P>My test is simple I trying to transfer data beetween vlan on internal bond and my speed is about 3Gbps and somethings more, the same test on external bond I got 3Gbps.</P><P>When I trying to transfer data beetween vlan on internal bond and vlan on external bond, I reach the limit of ethernet interface 1Gbps. Why?</P><P>In my test I have used different source address and destination address so also TCP ports all different</P><P>While my test is executing I can see in cpview the throughput on each interfaces, I can see the traffic is balanced beetween they but the sum don't go over 1Gpbs when I use vlans on both bond interfaces, but when the vlan is on same bond interface I see more interfaces reach the limit of 1Gbps so the sum on bond interface is over the 1Gbps and I got 3Gbps and more of throughput.</P><P></P><P>Suggestions?</P><P>Thanks</P></BODY></HTML> Sat, 06 Oct 2018 07:30:00 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Appliances-5900-R80-10-and-bonding-interfaces-limited-throughput/m-p/33493#M2717 Giovanni_Nervi 2018-10-06T07:30:00Z Re: Appliances 5900 R80.10 and bonding interfaces limited throughput https://community.checkpoint.com/t5/Firewall-and-Security-Management/Appliances-5900-R80-10-and-bonding-interfaces-limited-throughput/m-p/33494#M2718 <HTML><HEAD></HEAD><BODY><P>How many concurrent connections are you running during the test? Have you checked cpview output?</P><P>Possibly you are using hide NAT when traffic goes from internal to external and if you have only one IP to hide behind - that would put a limit of ~50000 concurrent connections. Maybe you have reached that limit. Hard to say without having more info - concurrent connections, connection rate, etc. If you could share your cpview in both cases (when it runs 3Gbps and 1Gbps) it would help</P><P>Do you use some traffic generator for tests? I.e IXIA - do you see any special session setup failures?</P></BODY></HTML> Mon, 08 Oct 2018 07:28:25 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Appliances-5900-R80-10-and-bonding-interfaces-limited-throughput/m-p/33494#M2718 Kaspars_Zibarts 2018-10-08T07:28:25Z