topic Re: Dynamic split not working correctly in Firewall and Security Management

Dynamic split not working correctly

nullform — Mon, 09 Nov 2020 18:32:58 GMT

Hello everyone,

Has anyone experienced some very strange issues with dynamic split on R80.40 with the latest GA take applied ?

I am experiencing some very strange issues with it, and I would like to see if anyone has similar behavior before I open up a ticket with Check Point. The SND CPU's are not increasing even when they get to 80-90% utilization. The platform has 32 CPU's and only 4 are used for SND at any given time, whether the firewall is under utilized or under heavy load...

Has anyone experienced something similar?

Re: Dynamic split not working correctly

Danny — Mon, 09 Nov 2020 19:18:48 GMT

sk164155 mentions a few possible reasons:

Average utilization of SNDs vs FireWall is relatively close (we require 10% difference by default)
FireWalls are utilized more than 40%
All eligible SNDs are already used as SNDs

Besides that, maybe you have any onboard interfaces in use? (sk165516)

Re: Dynamic split not working correctly

AmitShmuel — Mon, 09 Nov 2020 19:25:33 GMT

Hi,

As Danny mentioned, there could be several reasons for this behavior.
Please feel free to contact me directly on amitshm@checkpoint.com, I'll be also happy to jump on and look at the environment.

Regards,
Amit

Re: Dynamic split not working correctly

Timothy_Hall — Tue, 10 Nov 2020 12:54:42 GMT

This doesn't appear to be documented in that SK, but the Dynamic Split Daemon has a logfile where it indicates what it is doing (or not) and why. Checking this file out may provide some insight into what is happening: $FWDIR/log/dsd.elg