topic Re: Connections/sec in Firewall and Security Management

Connections/sec

iSu10 — Fri, 29 May 2020 20:14:45 GMT

Using a Check Point GW 6400... in the specs it has:

Connections/sec = 90,000

Concurrent connections = 2/4/8

What happens to the UDP and TCP packet 90,000+1 ?

Re: Connections/sec

PhoneBoy — Sat, 30 May 2020 00:18:28 GMT

Just to explain the two numbers:
Concurrent connections refer to the number of connections where state can be maintained and are expressed in millions.
This is mostly a function of available memory.
Connections per second is a function of what the hardware is able to actually pass traffic on.
If you exceed the threshold, packets will get delayed and/or dropped at the hardware level before they are processed in software.
Note that not every connection passes packets every second.

That said, these numbers only apply under ideal conditions.

Re: Connections/sec

MartinTzvetanov — Mon, 01 Jun 2020 11:08:48 GMT

6400 has 3 models : Base/Plus/Max with 8/16/32 GB of RAM respectfully.
Concurrent connections = 2/4/8 means Base model gets 2 Millions of Concurrent connections, Plus gets 4 M and Max gets 8 M.

Re: Connections/sec

iSu10 — Mon, 01 Jun 2020 16:23:24 GMT

Is there a way or command that I can run to view these numbers live on our current FW? We have 4600 and 4800 running R77.30

We are looking to upgrade but want to make sure we go with the right sizing without going too 'overkill'.

Re: Connections/sec

Timothy_Hall — Mon, 01 Jun 2020 16:58:41 GMT

Yep just run cpview and that live connection data is right on the Overview screen, you might need to scroll down slightly.

Re: Connections/sec

iSu10 — Mon, 01 Jun 2020 17:28:12 GMT

Got it, but does cpview have a way to see, averages and max points? Any tricks recommended here?

Re: Connections/sec

Timothy_Hall — Mon, 01 Jun 2020 17:33:10 GMT

Not directly, but run cpview in historical mode with -t. Use + and - to step forward/back in time while on the Overview screen, and you should be able to get a pretty good idea of these values over time. Also try looking around in the System reports on the Gateway & Servers tab of SmartConsole, especially the Firewall History report.