topic Re: Accelerated drop feature in Firewall and Security Management

Accelerated drop feature

Nick_Doropoulos — Tue, 12 Nov 2019 07:25:23 GMT

Hello,

Can I confirm that the accelerated drop feature as described in sk67861 is supported on R80.20 and R80.30 as well?

Many thanks.

Re: Accelerated drop feature

G_W_Albrecht — Tue, 12 Nov 2019 08:34:36 GMT

YES - According to the sk98348: Best Practices - Security Gateway Performance that is valid for all versions.

Re: Accelerated drop feature

FedericoMeiners — Tue, 12 Nov 2019 13:01:23 GMT

I'm wondering if there is any difference between sim dropcfg and fwaccel dos blacklist, at a high level they seem to do the same 🤔

Re: Accelerated drop feature

Timothy_Hall — Tue, 12 Nov 2019 14:55:17 GMT

Prior to R80.20 there were quite a few different ways to block or limit traffic in SecureXL that were introduced over the years and it ended up becoming a bit of a mishmash. Examples of this were commands sim hlqos, sim dropcfg, fw samp, sim erdos, and sim_dos ctl. It was not always clear which of these should be used in a particular situation, and there were overlaps in functionality between some of them which added to the confusion.

Thankfully, in R80.20+ all these various SecureXL features were simplified and updated into a more clear feature set via the fwaccel dos and fw sam_policy commands. The former command is primarily responsible for blocking and blacklisting in all its various forms, while the latter command is more or less the equivalent to fw samp and allows various rate-limiting and quota options that are efficiently enforced by SecureXL. Much better to use fw sam_policy than the IPS signature "Network Quota" which if enabled will kill practically all acceleration in the firewall.

Re: Accelerated drop feature

FedericoMeiners — Tue, 12 Nov 2019 18:00:28 GMT

Great as always Tim, thanks for the clarification