topic Re: fast_accel reverts to old entries in Firewall and Security Management

fast_accel reverts to old entries

Daniel_Westlund — Mon, 24 Jun 2024 21:25:52 GMT

I use the fw ctl fast_accel commands to bypass known data transfers from the blades as they spike the CPU. My issue is that the first time I made entries, I added /32 connections. When I realized I could only make 15 entries, I deleted them and added /24 entries. My problem is, about every 3-6 months, my CPU goes up, and when I check fast_accel, it has reverted back to my original /32 entries. When I open a ticket with TAC about this, they have no idea what to do.

Re: fast_accel reverts to old entries

the_rock — Mon, 24 Jun 2024 23:15:04 GMT

Hey @Daniel_Westlund

If thats the case, there is obviously an issue they might not be aware of either. Did you ask them if case can be escalated further, so it can be checked what gives?

Best,

Andy

Re: fast_accel reverts to old entries

Daniel_Westlund — Tue, 25 Jun 2024 14:10:59 GMT

Yes. They are checking with R&D.

Re: fast_accel reverts to old entries

the_rock — Tue, 25 Jun 2024 14:12:56 GMT

Personally, I never had this issue myself, though I only tested on R81.20. What version is this?

Andy

Re: fast_accel reverts to old entries

Daniel_Westlund — Tue, 25 Jun 2024 14:15:26 GMT

At least since R81. Maybe R80.30 sp. But it has survived into R81.10 and R81.20. To see the issue, you'd have to have deleted entries in the past. But it's weird so I wouldn't be surprised if it's rare.

Re: fast_accel reverts to old entries

the_rock — Tue, 25 Jun 2024 14:18:17 GMT

Yeah, I gotcha. Just curious, was there ever any custom fix installed?

Andy

Re: fast_accel reverts to old entries

the_rock — Tue, 25 Jun 2024 14:18:34 GMT

I meant custom fix on top of jumbo?

Re: fast_accel reverts to old entries

Daniel_Westlund — Tue, 25 Jun 2024 14:20:24 GMT

Not with this customer. Also, this is Maestor, but when I check the other SGs, they have the same entries as the SMO.

Re: fast_accel reverts to old entries

the_rock — Tue, 25 Jun 2024 14:32:40 GMT

Not sure if that matters, but I will assume probably not. Anywho, keep us posted on what comes out of all this. Im super curious to know.

Andy

Re: fast_accel reverts to old entries

PhoneBoy — Tue, 25 Jun 2024 15:08:20 GMT

It looks like the configuration is stored in some files that can be monitored (and even restored): https://support.checkpoint.com/results/sk/sk156672
Curious if the timestamp on these files changes when this problem reoccurs as it might provide a clue.

Re: fast_accel reverts to old entries

Daniel_Westlund — Tue, 25 Jun 2024 15:41:18 GMT

Thank you. When you mention the files that could be monitored in that SK, I wonder if you mean $FWDIR/conf/fw_fast_accel_export_configuration? The entries there are the same as my current entries, so maybe if I delete that file and recreate from scratch it won't come back? Also, when I check the log file, it shows where I made the entries that are missing in the current state, so that's interesting. I suppose I could delete the export file, run delete_all, and then create new entries from scratch. I also don't think I entered "g_" when I entered my commands, although I do see the same show_table on the other SGs. But that would be worth a try as well.

Re: fast_accel reverts to old entries

PhoneBoy — Tue, 25 Jun 2024 16:00:42 GMT

For Maestro, you definitely have to do g_fw fast_accel.

Re: fast_accel reverts to old entries

the_rock — Tue, 25 Jun 2024 16:01:24 GMT

Good file to know...was never aware of it before.

Andy