topic Re: CoreXL in VSX Question in Firewall and Security Management

CoreXL in VSX Question

tropicanaslim — Tue, 13 Jun 2023 15:07:54 GMT

Hi Checkmates,

We have a plan to enable 2 VSX (WAN&Internet) in the 7000 Series ClusterXL.

Based on a datasheet 7000 has 32 vcore and since the Internet has more traffic so we trying to map 20 vcore for the Internet and the rest for WAN.

Internet : 20 vcore
WAN : 12 vcore

this approach can achieve in 81.10? and i got a challenge from my manager, if suddenly the internet has high traffic, is it possible by automatic some core from WAN to move to Internet?

and what happens if the core sticks to some VS and is already 100% fully utilized? will CP drop the packet, or is the packet waiting in the queue?

is there any degradation performance we will face if we have enabled both coreXL and VSX?

Thanks!

Re: CoreXL in VSX Question

PhoneBoy — Tue, 13 Jun 2023 18:26:03 GMT

The CoreXL setting in VSX only applies to VS0 per: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_VSX_AdminGuide/Topics-VSXG/CoreXL-for-Virtual-Systems.htm
With VSX, each VS is assigned a number of cores.
That core assignment is static and changing it will require downtime.

Re: CoreXL in VSX Question

Bob_Zimmerman — Tue, 13 Jun 2023 21:06:24 GMT

One important and annoying note: the instances may be added stopped. If this happens, you will see output like this:

[Expert@DallasSA]# fw ctl multik stat ID | Active | CPU | Connections | Peak ---------------------------------------------- 0 | Yes | 1 | 3 | 34 1 | No | - | 0 | 0

If your output has rows with "No" in them, you need to manually start the CoreXL workers:

[Expert@DallasSA]# fw ctl multik start Instance 1 started (2 of 2 are active) [Expert@DallasSA]# fw ctl multik stat ID | Active | CPU | Connections | Peak ---------------------------------------------- 0 | Yes | 1 | 4 | 34 1 | Yes | 0 | 5 | 5