topic Re: Difference between Dynamic dispatcher and Dynamic Balancer in Firewall and Security Management

Difference between Dynamic dispatcher and Dynamic Balancer

jadhavvishal219 — Fri, 19 May 2023 08:43:04 GMT

What is the difference between CoreXL Dynamic Dispatcher and Dynamic Balancing for CoreXL? Have read sk105261 and sk164155 but not getting the exact point there. Please someone help

Re: Difference between Dynamic dispatcher and Dynamic Balancer

G_W_Albrecht — Fri, 19 May 2023 08:59:06 GMT

It is rather easy:

The dispatcher is executed when a packet should be forwarded to a CoreXL FW instance ... and is in charge of selecting the CoreXL FW instance that will inspects the packet. (sk105261)
Dynamic Balancing (Dynamic Split) is a performance-enhancing daemon that balances the load between CoreXL SNDs and CoreXL Firewalls. It dynamically changes the split between CoreXL SNDs and CoreXL Firewalls and does not require a reboot or cause an outage. (sk164155)

So the first is dispatching packets to FW instances while the second can change the number of SND / FW instances on the fly.

Re: Difference between Dynamic dispatcher and Dynamic Balancer

Paresh_Keny — Fri, 19 May 2023 11:10:18 GMT

The dispatcher concept is clear but I am little confused here, "second can change the number of SND / FW instances on the fly."

What does this sentence mean exactly. Does the CoreXL instances increases automatically if required?

for ex- if I have 2 CoreXL SND and 6 CoreXL FW, with Dynamic balancing these numbers will change to handle the process?

Thank you for response.

Re: Difference between Dynamic dispatcher and Dynamic Balancer

PhoneBoy — Fri, 19 May 2023 12:35:14 GMT

Actually, one or more CoreXL instance will be used as an SND.
For example, an 8 core gateway will start out with a 2/6 split and might change to a 3/5 or 4/4 split depending on your network traffic/system load.

Couple rules:

The maximum CoreXL instances won’t change. For example, in an 8 core system, you will never have more than 6 FWKs.
The number of SNDs will never exceed the number of FWKs.
There are some thresholds and such for when an FWK is reallocated to ensure it doesn’t make things worse

Re: Difference between Dynamic dispatcher and Dynamic Balancer

the_rock — Fri, 19 May 2023 12:43:55 GMT

You can also refer to below posts

https://community.checkpoint.com/t5/Security-Gateways/Dynamic-balancing-vs-dynamic-dispatcher/td-p/133847

https://community.checkpoint.com/t5/Maestro/Difference-between-the-Secure-Network-Distributor-SND-and-CoreXL/td-p/63369

Andy

Re: Difference between Dynamic dispatcher and Dynamic Balancer

AmitShmuel — Sat, 20 May 2023 11:42:38 GMT

The number of SNDs is determined by the number of available NIC IRQs, so, depending on system load, it is possible to exceed the number of FWs.