topic dynamic balancing, question for adding new SND core in Firewall and Security Management

dynamic balancing, question for adding new SND core

Wolfgang — Mon, 13 Jan 2025 12:48:37 GMT

Following Dynamic Balancing of CoreXL Instances an automatic assignment of SNDs is possible. But how it works, I don’t get it ☹

################################################################

Add a CoreXL SND instance.

This change stops a CoreXL Firewall instance and moves it to another CPU core.

This change is possible only under these conditions:

a. Average difference in CPU utilization between CoreXL Firewall and SND instances is greater than 10%.

b. CoreXL Firewall instances consume the CPU cores at less than 40%.

c. There is an available CPU core.

################################################################

Please, can someone give more details and explain the conditons when a new SND will be added.

„Average difference in CPU utilization“, to get this point…… Average of all SND cores and all CoreXL cores ?

Paragraph b. „CoreXL Firewall instances consume the CPU cores at less than 40%“ Less 40% of what ? number of cores, CPU utilization of all CoreXL cores ?

Re: dynamic balancing, question for adding new SND core

PhoneBoy — Mon, 13 Jan 2025 21:15:22 GMT

It's the aggregate average usage of CoreXL/worker instances versus the aggregate average usage of SND/SecureXL instances.
If the aggregate average of all CoreXL/worker instances is at least 40%, we do not take a CoreXL/Worker instance for SND as that will likely make things worse.

Re: dynamic balancing, question for adding new SND core

Timothy_Hall — Mon, 13 Jan 2025 23:17:21 GMT

sk164155 will answer all your questions, an adjustment will not be made unless there is LESS than 60% utilization (or 40% idle) on the type of cores being examined (SND or FW Instance), see variables in that SK such as SUPER_INST_ADD_FW_LOAD & DMD_WAKEUP_FW_LOAD which are set to 60.

Generally unless there is at least 40% idle "headroom" on the type of CPUs being examined, a split adjustment or initiating Hyperflow will probably not happen. The goal of Dynamic Split and Hyperflow is to let traffic and elephant flows move as fast as they want, but only if a headroom of 40% idle can be maintained to respect the "mice" connections and keep them from getting stomped by a couple of big mean elephants or even by the overall traffic load.

Re: dynamic balancing, question for adding new SND core

Chris_Atkinson — Tue, 14 Jan 2025 00:49:16 GMT

Tagging @AmitShmuel in case further clarification is needed on any areas.

Re: dynamic balancing, question for adding new SND core

Wolfgang — Tue, 14 Jan 2025 12:41:39 GMT

Thanks @Timothy_Hall you're right Dynamic Balancing for IPv4 CoreXL Instances answers all.