topic Re: HealthCheck Point - FW tables limit in Firewall and Security Management

HealthCheck Point - FW tables limit

Michal_Gans — Wed, 07 Dec 2022 13:25:09 GMT

Recently we just run HCP on many SG and many times it ended with "FW tables limit" error.

So I was curious if there is any documentation/description for this tables. I tried to get some from TAC, but it was not useful, they just repeat all over that we need to activate drop templates with disable notification. But we want to know, what it means (it is possible, that we can solve it by some policy optimization or something like that).

For example I have this output from HCP report:

| +---------------------------------------------------------------+ |
| | FW Kernel Tables | |
| +----------------------------+-------------------+------+-------+ |
| | Table Name | Number Of Entries | Peak | Limit | |
| +============================+===================+======+=======+ |
| | tab_name_table | 19290 | 968 | 16384 | |
| +----------------------------+-------------------+------+-------+ |
| | excessive_table | 30906 | 0 | 25000 | |
| +----------------------------+-------------------+------+-------+ |
| | Uncommitted_tab_name_table | 17681 | 61 | 16384 | |
| +----------------------------+-------------------+------+-------+ |
| | nrb_hitcount_table | 4256 | 2 | 2484 | |
| +----------------------------+-------------------+------+-------+

So is there any description about tables: tab_name_table, excessive_table, Uncommitted_tab_name_table, nrb_hitcount_table?

Re: HealthCheck Point - FW tables limit

the_rock — Wed, 07 Dec 2022 14:03:37 GMT

Im so glad you asked this question, because I wondered same thing when I looked at the report last time.

Re: HealthCheck Point - FW tables limit

G_W_Albrecht — Wed, 07 Dec 2022 14:31:21 GMT

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_CLI_ReferenceGuide/Topics-CLIG/FWG/fw-tab.htm?Highlight=fw%20tab

sk98348: Best Practices - Security Gateway Performance

sk65133: Connections Table Format

Re: HealthCheck Point - FW tables limit

Michal_Gans — Wed, 07 Dec 2022 15:52:20 GMT

Thanks for reply. I already checked this articles but I still don't know, what this tables represent or at least what they are related to.

Of course I can make optimization by sk98348 but it would be much easier if I know on what I need to focus on.

Re: HealthCheck Point - FW tables limit

G_W_Albrecht — Wed, 07 Dec 2022 16:05:02 GMT

Enable Drop Templates first. Wait. Then consult hcp again.

Re: HealthCheck Point - FW tables limit

Firewall_Guy — Fri, 09 Dec 2022 23:49:50 GMT

Did you ever get any answers for this? Did enabling Drop Templates help?

Re: HealthCheck Point - FW tables limit

Alexander_Wilke — Fri, 16 Dec 2022 14:19:17 GMT

The most funny part is, that the "number of entries" is higher than the "limit" column and the "peak" column is the lower than the others.

I would not believe anything from this HCP output to be honest.

Re: HealthCheck Point - FW tables limit

Michal_Gans — Wed, 21 Dec 2022 16:49:15 GMT

I did not get any other answer that enable Drop Template. I don't want to enable Drop Template (because log consolidating) without knowing why.

I will open another TAC ticket and try to ask for explanation again.

Re: HealthCheck Point - FW tables limit

the_rock — Wed, 21 Dec 2022 17:25:38 GMT

Im with you there, looks very strange indeed.

Re: HealthCheck Point - FW tables limit

Tal_Ben_Avraham — Sun, 25 Dec 2022 07:49:54 GMT

First note there is a bug in the report where "Number of entries" and "Peak" are mixed.

There is a chance those are cosmetic issues. However, you should open a ticket to support. We seek to have a clear report for all our deployments!

In case this is cosmetic I expect the cosmetic issue to be solved as well.

Uncommitted_tab_name_table \ tab_name_table - this table hold table names.

excessive_table - this table is in charge of some log suppression mechanism

nrb_hitcount_table - this table holds count of rulehits

Re: HealthCheck Point - FW tables limit

Michal_Gans — Thu, 22 Dec 2022 15:14:59 GMT

Thanks for your reply and answers.

Because all / almost all of our Check Point customers have some "problematic" tables (not always the same) in there HCP report, do you think that if I write them all here, you/someone will be able to add same sort of comment as you did for these?

Re: HealthCheck Point - FW tables limit

Tal_Ben_Avraham — Thu, 22 Dec 2022 15:35:04 GMT

I believe the best approach to solving all of those issues is thru support.

You can share. I may not know all tables purpose. I can answer for what I know (and hopefully others can contribute as well).

Re: HealthCheck Point - FW tables limit

the_rock — Thu, 22 Dec 2022 15:40:22 GMT

I actually posted similar question couple months back about whether there was any command to actually run on the firewall that would give info about all the tables and what they are used for, but was not successful in getting that, so I can only assume it does not exist.