topic MTU issue in Firewall and Security Management

MTU issue

Simply_sachin — Fri, 24 Sep 2021 08:57:44 GMT

Dear Checkmates...

Currently 20 GWs managed with single management Server R81 on VM in our Setup. Considering business

criticality, We plan to build redundant management server in other business unit and the same has been done.

Now the problem starts as below:

While Sync the backup file from primary to DR location:

I) never sync completes

2) Drop the session due to time-out error.

3) Slow data transfer

So we are struggling and unable to build secondary management server.

Check point Team telling MTU issue with ISP,but ISP refusing the MTU issue because of file transfer between other than management is server is normal.

Please share your ideas and views on this if anybody come across this issue.

Advance thanks..

Re: MTU issue

Chris_Atkinson — Fri, 24 Sep 2021 11:59:00 GMT

An MTU issue should be easily shown with pings and df-set from any machine not just the Check Point Mgmt, also is there a VPN involved?

Re: MTU issue

Timothy_Hall — Fri, 24 Sep 2021 12:10:23 GMT

What Jumbo HFA level are you using for R81? There have been many, many Management HA stability and performance fixes in those.

Also R81.10 claims to have significant Management HA sync performance and stability fixes; it is not clear whether only some of or all of these improvements have been back-ported into the R81 Jumbo HFAs.

Re: MTU issue

the_rock — Fri, 24 Sep 2021 15:41:06 GMT

Put it this way, so you can consider your options...

Based on past experience, it is known that larger MTU sizes typically provide better overall performance than smaller MTU sizes. Larger MTU sizes reduce the number of packets needed to transfer a large amount of data. ... In general, using fewer packets typically reduces the overhead and improves overall performance.

Re: MTU issue

Chris_Atkinson — Sat, 25 Sep 2021 01:24:06 GMT

Also need to consider an MTU mismatch (fragmentation).

Re: MTU issue

the_rock — Sat, 25 Sep 2021 11:54:55 GMT

Yes sir, thats a very good point...indeed, fragmentation can affect VPN performance big time.