topic Re: Have you ever used more than 3 ports on a QLS250 machine? in Firewall and Security Management

Have you ever used more than 3 ports on a QLS250 machine?

ChoiYunSoo — Thu, 18 May 2023 08:57:08 GMT

I've been having trouble lately

Looks like the 40Gbps card has been discontinued in recent checkpoints

However, I ran into a situation where I needed to use more than 3 ports at 40Gbps.

So I am temporarily trying to import two 40Gbps cards from the QLS250 device and use them.

However, looking at the checkpoint guide document, there seems to be no deployment that imports and uses two or more 40 Gbps.

I will attach a picture below.

Please let us know if you have a case or guide document using 3 ports like the picture below.

Re: Have you ever used more than 3 ports on a QLS250 machine?

G_W_Albrecht — Thu, 18 May 2023 09:31:56 GMT

No - you will need a QLS450 with 2 ConnectX cards ! The QLS650 has 3 and the QLS850 4 ConnectX cards. The term: Alternative supported installation does not really sound like you could have 4 x 100/40 cards. In attached datasheet you can read:

The 4 single-width slots in the QLS250 supports one NVIDIA ConnectX dual-width network card, with 2x 100G QSFP28 ports, supporting an aggregate throughput of 200G of firewall throughput through the ConnectX.

Re: Have you ever used more than 3 ports on a QLS250 machine?

Chris_Atkinson — Thu, 18 May 2023 11:55:49 GMT

Recommend taking the discussion with your local CP SE who can advise on a solution / engage the relevant areas where required to determine the same.

Re: Have you ever used more than 3 ports on a QLS250 machine?

PhoneBoy — Thu, 18 May 2023 17:26:41 GMT

Unfortunately, we had to discontinue CPAC-2-40F-C & CPAC-2-100/25F due to an unforeseen issue with one of our NIC suppliers.
The replacement for this will actually be the Dual-width SmartNIC card offered on the LightSpeed appliances today in standard NIC mode operation (i.e. non-accelerated mode).

The two port limitation for QLS NICs is specific to accelerated mode (meaning all accelerated traffic must be in/out the same NIC).
Since these NICs will not be used in accelerated mode, this limitation should not apply.
However, as noted by @Chris_Atkinson you should confirm with your local Check Point SE.

Re: Have you ever used more than 3 ports on a QLS250 machine?

ChoiYunSoo — Mon, 22 May 2023 01:24:03 GMT

thank you for the help it helped a lot

Re: Have you ever used more than 3 ports on a QLS250 machine?

ChoiYunSoo — Mon, 22 May 2023 01:24:28 GMT

Thanks, I'll discuss with the local SE

Re: Have you ever used more than 3 ports on a QLS250 machine?

ChoiYunSoo — Mon, 22 May 2023 01:26:14 GMT

Even if there is no acceleration problem through the test, it will be difficult to use it in the customer network if there is no manufacturer confirmation.

I'll discuss it with the local SE

thanks for the help

Re: Have you ever used more than 3 ports on a QLS250 machine?

PhoneBoy — Mon, 22 May 2023 21:51:49 GMT

We will have these NICs on the official pricelist in the next few weeks, so this should be a supported configuration.
Best to reach out to your Check Point SE.

Re: Have you ever used more than 3 ports on a QLS250 machine?

ChoiYunSoo — Tue, 23 May 2023 07:55:41 GMT

Is it okay if I ask one more question?

Looking at the answers above or other documentation, it seems that QLS only accelerates the In/Out ports of the same card.

Does the acceleration referred to here refer to the QLS' light speed acceleration? Do you mean acceleration in normal kernel mode?

As I posted above, it is not necessary to use Light Speed acceleration to use the three ports of 'External, Internal, and DMZ'. Acceleration of the existing SecureXL kernel mode is sufficient.

Can I use two 40Gbps cards under these conditions?

Re: Have you ever used more than 3 ports on a QLS250 machine?

PhoneBoy — Tue, 23 May 2023 18:28:34 GMT

Correct, the Quantum Lightspeed specific acceleration only occurs when the traffic goes in and out the same interface.
Otherwise, the interface cards will act like any other interface with respect to SecureXL.