topic Re: SecureXL mode in Firewall and Security Management

SecureXL mode

Moudar — Thu, 25 Sep 2025 09:01:09 GMT

I got a new 9400 gateway running 81.20 take 113.

After changing from User mode to kernel mode using cpconfig:

fwmode -s shows: User mode

Fwaccel stat shows: KPPAK

We are moving from 6500 running in kernel mode to 9400.

My plan is to use save configuration on 6500 and load configuration on 9400.

But 9400 seems refusing kernel mode or maybe it is so in that new gateway?

Choosing kernel-mode because we have a stable environment with 6500 running in kernel-mode

Does 9400 running user mode or kernel mode according to the above information?

any ideas!

Re: SecureXL mode

Timothy_Hall — Thu, 25 Sep 2025 12:33:36 GMT

"fwmode -s shows: User mode" indicates that USFW is set, which means your Firewall Worker Instances run in User Space. This has been the default for some time, and there are not many good reasons to set kernel mode for your workers, as it will interfere with features such as Dynamic Split and Hyperflow.

"Fwaccel stat shows: KPPAK" means that SecureXL is running in kernel space. In R81.20 and R82, by default, only Quantum Force 3900/9XXX/19XXX/29XXX appliances, as well as Lightspeed appliances, utilize UPPAK by default. For the moment, you can set them back to use KPPAK, but this option will go away in R82.10, and UPPAK will become the default for all gateways, regardless of model or open hardware in that version.

Re: SecureXL mode

the_rock — Thu, 25 Sep 2025 12:47:37 GMT

You can force it to load the config with below command in clish:

set clienv on-failure continue

save config

Andy

Re: SecureXL mode

Moudar — Thu, 25 Sep 2025 13:02:56 GMT

so if our 6500 is running kernel mode and the new 9400 is running user mode on both firewall and securexl,

moving the configuration from 6500 to 9400 will run smoothly and we do not need to do anything? Or we need to do some tweaks so that everything works?

Re: SecureXL mode

the_rock — Thu, 25 Sep 2025 13:04:35 GMT

Hey brother,

Just me personally, I would NOT assume that risk, better be sure and confirm with TAC.

Andy

Re: SecureXL mode

Timothy_Hall — Thu, 25 Sep 2025 13:14:39 GMT

The 9400 will use UPPAK by default. Prior to the replacement, familiarize yourself with the limitations of UPPAK in Section 4 here:

sk32578: SecureXL Mechanism

Note that some limitations listed here are included for completeness but have already been resolved. Please refer to the far right column to see which version may have resolved the issue, and ensure you are using the latest Recommended Jumbo HFA. If any of these limitations are show-stoppers or you encounter problems, you may need to set your 9400 back to KPPAK mode. Keep in mind that constantly high CPU utilization on your SND cores is expected behavior in UPPAK mode.

Re: SecureXL mode

the_rock — Thu, 25 Sep 2025 23:54:37 GMT

As Tim said though, by default it would use user mode.

Andy

Re: SecureXL mode

emmap — Fri, 26 Sep 2025 03:21:54 GMT

What does fwmode -s show on your 6500s? You should keep USFW on the 9000s, and the config should transfer over like for like, but with any hardware swap it's a good time to review the config and only copy over the stuff that you need. I would 'show configuration' on the old setup and copy/paste in only the stuff that is needed to the new gear.

Re: SecureXL mode

Moudar — Fri, 26 Sep 2025 10:16:44 GMT

6500 shows:

[Expert@fw02:0]# fwmode -s Firewall is Kernel mode

so you mean 9400 should never use kernel mode even if 6500 is kernel mode?

I used save configuration and load configuration and I will double check the config again line by line

Re: SecureXL mode

the_rock — Fri, 26 Sep 2025 12:37:21 GMT

From my R82 fw:

[Expert@CP-GW:0]# fwmode -s
Firewall is User mode
[Expert@CP-GW:0]# uname -a
Linux CP-GW 4.18.0-372.9.1cpx86_64 #1 SMP Thu Aug 28 16:01:06 IDT 2025 x86_64 x86_64 x86_64 GNU/Linux
[Expert@CP-GW:0]#

Re: SecureXL mode

Lesley — Sat, 27 Sep 2025 18:42:00 GMT

By default, Quantum Force Appliances (9800, 9700, 9400, 9300, 9200, and 9100) run SecureXL in the User Space (UPPAK) Mode:
- When the appliance runs the dedicated R81.20 Factory Image.
- When the appliance runs the R81.20 Jumbo Hotfix Take 54 and higher.
Quantum Force Appliances in a Standalone deployment (9800, 9700, 9400, 9300, 9200, and 9100) run SecureXL in Kernel Mode (KPPAK).

How to change:

https://sc1.checkpoint.com/documents/Appliances/100G_Ports_AdminGuide/Content/Topics-100G-Card-AG/SecureXL-Configuration.htm?tocpath=_____5