topic Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10? in Firewall and Security Management

Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Jennifer_Wilson — Thu, 09 May 2024 15:52:06 GMT

Anyone seeing any performance improvements upgrading from R81.10 to R81.20?

Especially for Gateways that are quite heavily loaded? and especially if not using HTTPS/TLS Inspection?

Getting a feel if it is worth doing at the moment.

Regards,

Jen.

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

PhoneBoy — Thu, 09 May 2024 16:07:26 GMT

If you do VPN traffic (site-to-site and/or remote access), performance there should be improved.

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

the_rock — Thu, 09 May 2024 16:35:58 GMT

I would say overally, you would see improvements, no matter if you use https inspection.

Andy

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

the_rock — Thu, 09 May 2024 16:57:44 GMT

Here are things I found better from all my testing:

-https inspection

-vpn s2s/ remote access

-updatable objects / geo policy

-memory / cpu handling

-policy install times

Andy

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

caw001 — Fri, 10 May 2024 03:08:21 GMT

If you have a gateway that processes a lot of heavy connections and elephant flow traffic, Hyperflow was introduced in R81.20 to process that traffic more efficiently:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/HyperFlow.htm

https://support.checkpoint.com/results/sk/sk178070

https://www.youtube.com/watch?v=JdWbY5IQL9E

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Jennifer_Wilson — Fri, 10 May 2024 08:20:00 GMT

Dose this work if you don't have any free cores though?
eg. a heavily loaded gateway running at 60-70% on all cores, would any cores be available to split up the processing of an elephant flow under these conditions?

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Henrik_Noerr1 — Fri, 10 May 2024 08:34:47 GMT

We have seen zero change in cpu or memory in any of our some 20 clusters.

Most are open servers, running VSX with 2-50 VS on and only IPS blade is enabled.

Througput ranging from 0-25gbit

/Henrik

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Jennifer_Wilson — Fri, 10 May 2024 08:37:34 GMT

Cheers Phoneboy, but we don't do VPN or remote access on the Gateways.

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

the_rock — Fri, 10 May 2024 11:04:26 GMT

I highly doubt you would see any difference in such a scenario even if you upgrade. Just my personal opinion.

Andy

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Jennifer_Wilson — Fri, 10 May 2024 11:08:14 GMT

Cheers all, had the feeling that was the case.
Will probably leave off for now then.
Regards,
Jen.

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

the_rock — Fri, 10 May 2024 11:09:48 GMT

If I were you, I would still upgrade, because R81.20 is 100% better version.

Andy

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Bob_Zimmerman — Fri, 10 May 2024 16:03:11 GMT

Keep in mind, R81.10 is only supported for another ~14.5 months. R81.20 gets another 16 months on top of that. If it takes longer than 3-4 months to upgrade your environment, it may be a good idea to start now to ensure you don't run out of runway.

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

the_rock — Fri, 10 May 2024 17:06:22 GMT

I 100% agree with that statement.

Andy

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Henrik_Noerr1 — Fri, 10 May 2024 17:55:50 GMT

I would agree with you - and depending the scope of the install base, I would start planning right away to r81.20. We do however see that support dates were extended with r80.40 and r81.10. I would be very surprised if we will not see the same extension with r81.20

As I see it - when a major is released to GA it takes another half year to get the recommended flag. After this date, any serious enterprise would still wait 3-6 jumbo hotfixes until it gets pushed to production - pushing a serious r82 date well into 2025-2026

/Henrik

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

the_rock — Fri, 10 May 2024 17:58:53 GMT

Totally valid points.

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Bob_Zimmerman — Fri, 10 May 2024 19:09:48 GMT

I'm firewall team lead at a Fortune 500. We've had a lot of problems in the past with upgrades getting delayed and delayed and delayed until we're years past the end-of-support date for a particular version, but still running it in production. I've pushed us to get extremely aggressive about deploying new versions. We plan to upgrade some of our environment to R82 as soon as it becomes available (even before it's recommended) specifically because it can take so long to get everything upgraded. We need to have systems running it which we can point to later and say "See, we've been running it here for months and it's fine."

We're about 60% upgraded to R81.20 today, but the tail is extremely long.

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

Henrik_Noerr1 — Fri, 10 May 2024 20:35:12 GMT

Hey Bob,

I am in the exact same position, maybe at a smaller scale with some 500 Virtual Systems which translates to Denmark top 1-3... Ensuring software compliance is tough - but I agree, we are as well jumping on the band wagon on the less critical systems to r82 - simply so we can followup on issues and prepare of any issues

We simply need to progress or stay behind.

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

the_rock — Fri, 10 May 2024 20:53:00 GMT

I think its definitely the mentality of most people managing other major fw vendors, sometimes, not so easy to keep up : - (

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

the_rock — Sat, 11 May 2024 00:04:55 GMT

I wanted to suggest something one customer told me while back. To me personally, this makes sense, but then again, it may not apply in every situation. He told me that what they always do when it comes to upgrades it always do less important firewalls first, so they can get a feel for the version and if all good, move on to more important ones.

Something to think about...

Have a great weekend!

Andy

Re: Anyine seeing any R81.20 performance improvements upgrading from R81.10?

AmitShmuel — Sat, 11 May 2024 17:00:07 GMT

HyperFlow prioritizes total throughput over a single connection, it will only trigger if the overall system utilization is under 60%.