topic Re: Qos policy install problem in Firewall and Security Management

Qos policy install problem

Madmaks — Fri, 20 Sep 2024 11:32:12 GMT

Hi,

I enabled QOS on cluster but when I try to install, I am facing the error message as following Is there any idea?

- Failed to install QoS Policy. QoS is not allowed when SecureXL is in User Mode.

Re: Qos policy install problem

Tal_Paz-Fridman — Fri, 20 Sep 2024 11:47:43 GMT

Are you using version R77.X?

https://support.checkpoint.com/results/sk/sk98229

Re: Qos policy install problem

Madmaks — Fri, 20 Sep 2024 15:44:42 GMT

We are using R81.20 and TAKE76 installed on it. 9100 series two devices working with cluster

Re: Qos policy install problem

AkosBakos — Fri, 20 Sep 2024 19:01:15 GMT

Hi @Madmaks

How many Cores do you have in the Appliance?

KPPAK - Kernel Mode
UPPAK - User Mode

You run SecureXL in UPPAK mode:

https://support.checkpoint.com/results/sk/sk32578

UPPAK does not support the QoS Software Blade.

Re: Qos policy install problem

PhoneBoy — Fri, 20 Sep 2024 19:39:45 GMT

The appliance you're running is likely in UPPAK mode: https://support.checkpoint.com/results/sk/sk153832#TOC05
QoS Blade is not supported in UPPAK mode per: https://support.checkpoint.com/results/sk/sk32578

Re: Qos policy install problem

the_rock — Fri, 20 Sep 2024 19:46:16 GMT

Can you run this command and see?

# cpprod_util FwIsUsermode

Btw, I use user mode on R81.20 lab with qos, no issue.

Andy

Re: Qos policy install problem

Madmaks — Fri, 20 Sep 2024 21:48:10 GMT

Thaks for your ansqers.

So what should I do in this situation? I replaced it from Fortigate and now I can't use QOS.

Re: Qos policy install problem

Madmaks — Fri, 20 Sep 2024 22:00:31 GMT

Result of command is 1

Re: Qos policy install problem

Tal_Paz-Fridman — Fri, 20 Sep 2024 22:02:31 GMT

Upgrade to R82 (which should be out soon). QoS and SecureXL can run together in User Space (UPPAK)

Re: Qos policy install problem

the_rock — Fri, 20 Sep 2024 22:30:57 GMT

Guys,

Are you 100% sure that is correct? I have my doubts and here is why...I am running sxl+user mode+qos in R81.20 lab, jumbo 84, single gw and cluster, no issues at all, polocy works 100% of the time.

Andy

Re: Qos policy install problem

PhoneBoy — Fri, 20 Sep 2024 22:45:59 GMT

That's what the documentation I found says 🙂
However, there's a bug mentioned in Take 79 of the R81.20 JHF that suggests it might work:

PRJ-53481,
PMTR-101681

SecureXL

In some scenarios, when QoS blade is enabled and SecureXL works in User Mode (UPPAK), Security Gateway may crash with the "invalid data" error.

Between that and what @Tal_Paz-Fridman said about R82, @Madmaks, it appears if you upgrade to the recommended JHF (Take 84) on both management and gateway...it should work.
If it doesn't, I suggest engaging the TAC.

Re: Qos policy install problem

the_rock — Fri, 20 Sep 2024 22:59:36 GMT

Hm, right...BUT, it does not say policy install would fail, says gateway might crash. Anyway, @Madmaks , if you do update to jumbo 84, which I would also suggest you do, if any problems after, message me directly, not an issue, happy to show you my lab where this works fine.

Best.

Andy

Re: Qos policy install problem

Madmaks — Sat, 21 Sep 2024 00:14:43 GMT

Thanks everyone for your reply. The_rock if I do, according the result I'll touch you, thanks dude.

Re: Qos policy install problem

the_rock — Sat, 21 Sep 2024 00:25:36 GMT

You got it buddy. Have a fantastic weekend!

Andy

Re: Qos policy install problem

Jones — Tue, 24 Sep 2024 06:55:00 GMT

You can change the SecureXL Mode to Kernel Mode (KPPAK). Go to cpconfig, choose "Check Point SecureXL" to make the change:

Configuring Check Point SecureXL...

===================================

SecureXL is running in Kernel mode.

(1) Change SecureXL Mode

(2) Exit

Enter your choice (1-2) :

With the command "fwaccel stat" you can see the current SecureXL Mode.

With the command "fwmode -s" you can see the current Firewall Mode. You can change this in cpconfig at "Check Point CoreXL".