topic Re: USFW required for which specific gateway features? in Firewall and Security Management

USFW required for which specific gateway features?

Timothy_Hall — Thu, 22 Feb 2024 14:55:12 GMT

What specific R81.20 gateway features require the gateway to be in User Space Firewall (USFW) mode? USFW is indeed the default on all the most recent gateway appliances, which places the Firewall Worker Instances in process space as fwk processes, instead of being traditionally located in the kernel which gets around the previous 40-core limit for CoreXL.

For those R81.20 firewalls still using the older kernel mode (KMFW), which specific features will be unavailable? So far I have:

Hyperflow/pipelining
HTTPS Inspection of TLS 1.3
FutureX HSM support

Any more that I'm missing? Thanks!

Re: USFW required for which specific gateway features?

Lesley — Thu, 22 Feb 2024 15:16:06 GMT

VSX only does USFW:

In VSX Gateways, USFW is the only Firewall mode available.

Stated in: https://support.checkpoint.com/results/sk/sk167052

Maybe there is some more info in this SK that you could use.

Re: USFW required for which specific gateway features?

the_rock — Thu, 22 Feb 2024 15:47:36 GMT

Great reference sk Lesley. I believe its stated below as well.

Best,

Andy

https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-User-Mode-Firewall-vs-Kernel-Mode/td-p/70759