topic Re: PrioQ on Dual core platforms in Firewall and Security Management

PrioQ on Dual core platforms

Juan_ — Thu, 22 Oct 2020 16:05:10 GMT

Hi Guys,

Have been considering enabling PrioQ on an appliance that suffers from spikes from time to time.

Reading PrioQ SK came across the following limitation:

Dual core limitation

What is this queue? is it safe to disable?

Also, is it not a better core disposition 1 SND and 1 FW for dual core platforms?

What's your take?

Thanks!

Re: PrioQ on Dual core platforms

Timothy_Hall — Fri, 23 Oct 2020 13:55:32 GMT

As I stated in my book, 2-core firewalls are between a bit of a rock and a hard place. The only documentation I've seen for variable fwmultik_sync_processing_enabled being set to 0 states that "This limits the CPU to handle fewer stack functions simultaneously.. ". The other related kernel parameters are:

fwmultik_sync_processing_limited = 0
fwmultik_sync_processing_max = 2048

I guess setting fwmultik_sync_processing_enabled to 0 limits parallel processing or CPU monopolization by a Firewall Worker? Not really sure...

Here are the relevant pages from my book covering how to handle 2-core firewalls:

Re: PrioQ on Dual core platforms

Juan_ — Fri, 23 Oct 2020 14:02:09 GMT

Thank you Tim!

Got your book recently from Shadowpeak. Great read 🙂

I will probably consult the TAC.

Appreciate your reply.