topic Re: NAT Templates - SecureXL in Firewall and Security Management

NAT Templates - SecureXL

Don_Paterson — Wed, 23 May 2018 16:40:45 GMT

Is it recommended to turn NAT Templates on?

Why is it not on by default?

[Expert@GW:0]# fwaccel stat
Accelerator Status : on
Accept Templates : enabled
Drop Templates : disabled
NAT Templates : enabled
NMR Templates : enabled
NMT Templates : enabled

Re: NAT Templates - SecureXL

Timothy_Hall — Sat, 04 Apr 2020 13:17:16 GMT

NAT Templates can keep the first packet of a new connection from having to be evaluated in the Firewall Path (F2F) for finding a NAT policy rule match (Edit: R80.10 and earlier - in R80.20+ the first packet of a new connection always goes F2F). Can be most advantageous when a large percentage of traffic can be both templated by SecureXL and fully handled in the Accelerated Path. However this situation is not likely these days since the most commonly-used blades (i.e. APCL, URLF, Threat Prevention) will cause the majority of traffic to be handled in the Medium Path (PXL), and also the SecureXL templating rate will drop to zero if Anti-bot is enabled or a blade other than "Firewall" is enabled in the first Access Control layer of a policy package. Quoted from (Edit: the second edition of) my book:

However unless at least 50% of connections are able to be templated (Accelerated conns/Total conns) AND at least 50% of traffic is being handled in the Accelerated Path (Accelerated pkts/Total pkts) as shown by fwaccel stats -s, there is little to gain by enabling NAT Templates and potentially a lot to lose. NAT Templates can only be enabled and disabled via the fwkern.conf file and a firewall reboot, so if problems start to occur after enabling NAT Templates an outage will be required to turn them back off unless you have a firewall cluster. Enabling NAT Templates also seems to increase the likelihood of problems with other parts of the firewall, including SecureXL
randomly disabling itself (Edit: NAT Templates are enabled by default starting in R80.30 regardless of kernel version).

sk113398: Dynamic Dispatcher 'instance mismatch' drops on ports 80 and 443

sk100467: "Accelerator Status : off by Firewall (too many general errors (N) (caller: ...))" in the output of "fwaccel stat" command

sk106709 - SecureXL instability when SecureXL NAT Templates are enabled and Hide NAT is configured on VSX

sk111015 - Traffic outage on ClusterXL after enabling both CoreXL Dynamic Dispatcher and SecureXL NAT Templates

sk117332 - Cluster member with enabled SecureXL crashes during policy installation due to issues in SecureXL NAT Templates

Re: NAT Templates - SecureXL

Don_Paterson — Tue, 29 May 2018 19:55:37 GMT

Thanks Tim.

I am hoping for an internal response (from Tel Aviv).

Why is this not available in the SmartConsole? Optimized drop is.

The cli output message could perhaps be changed from saying disabled by user to something else, for example 'disabled', like the rest of the disabled-by-default options.

Regards,

Don

Re: NAT Templates - SecureXL

PhoneBoy — Fri, 01 Jun 2018 19:37:46 GMT

Tim's answer is pretty accurate, though.

Enabling SecureXL Templates for NAT is not something that can be done on the fly currently.

As a result, having a GUI option to do it doesn't make as much sense.

Re: NAT Templates - SecureXL

Don_Paterson — Mon, 04 Jun 2018 08:30:45 GMT

Thanks Dameon,

It still doesn't make sense to me. Statements like "if problems occur...". What problems?

I still unfortunately see the majority of customer not using much more than the IPS blade, and even that it not that frequently used. Maybe it is a UK thing or the types of customers I am exposed to.

Would still like to know if this is something that FW only customers might be recommended to be using by default (turned on), especially if it is the NAT FW, or if it is a feature that will otherwise possibly be removed, which makes sense if it is something to be weary of, as seems to be the message here.

Just trying to get answers here to be able to answer the questions in the field.

Regards,

Don

Re: NAT Templates - SecureXL

PhoneBoy — Mon, 04 Jun 2018 13:26:40 GMT

Some of the problems that CAN occur are listed in the SK's that Tim mentioned.

The only reasons I would see to enable SecureXL NAT Templates are you're running firewall only and you need to achieve a high session establishment rate with NAT.

(IPS uses PXL/Medium Path)

Otherwise, best to leave it off as is the default.

Re: NAT Templates - SecureXL

Timothy_Hall — Mon, 04 Jun 2018 14:31:58 GMT

What Dameon Welch Abernathy‌ said.

To provide some further insight, NAT templates are still off by default in R80.20 EA (always possibly subject to change for GA of course):

I'm assuming some kind of risk/reward analysis took place inside Check Point when deciding whether NAT templates would be enabled by default. If there were substantial performance gains available, low perceived risk, or both present NAT templates would be enabled by default.

NAT has its own caching mechanism (fwx_cache) in the Firewall Path to help avoid excessive NAT rulebase lookup overhead. In addition SecureXL Accept (connection) templates are not nearly as important as they used to be due to the new Column-based matching mechanism, and also because enabling certain features and policy layer configurations instantly drops the SecureXL templating rate to zero. In my opinion I'd lump NAT templates with Accept templates in this case as "not nearly as important as they used to be", at least on an R80.10+ gateway.

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: NAT Templates - SecureXL

Don_Paterson — Mon, 04 Jun 2018 15:52:08 GMT

Thanks very much both!

Regards,

Don

Re: NAT Templates - SecureXL

HeikoAnkenbrand — Fri, 03 Aug 2018 11:16:00 GMT

Here you can find a flowchart of how NAT is implemented:

R80.x Security Gateway Architecture (Logical Packet Flow)

Regards,

Heiko

Re: NAT Templates - SecureXL

Martin_Raska — Tue, 04 Dec 2018 12:54:02 GMT

Why NAT templates are enabled by default in R80.20 GA?

Re: NAT Templates - SecureXL

_Val_ — Tue, 04 Dec 2018 13:09:44 GMT

By design 🙂

Re: NAT Templates - SecureXL

Don_Paterson — Tue, 04 Dec 2018 13:11:42 GMT

Care to elaborate?

Asking because there is a another thread I started on this (with Tim and Dameon contributing).

Re: NAT Templates - SecureXL

Don_Paterson — Tue, 04 Dec 2018 13:21:54 GMT

Hang on! It's this thread! 🙂

Good question Martin. Lets see how they respond... 😉

Re: NAT Templates - SecureXL

_Val_ — Tue, 04 Dec 2018 13:23:08 GMT

In brief, NAT templates require lots of memory to work with, so before R80.20 they were disabled by default, as SecureXL could only use part of kernel memory.

With R80.20, SecureXL is completely re-done, and some of the magic happens in User Mode now, where memory is plenty. Hence there is no need to disable NAT templates by default anymore.

This is my take on it, but I will ask someone from R&D to comment as well

Re: NAT Templates - SecureXL

Don_Paterson — Tue, 04 Dec 2018 15:11:54 GMT

Thank you sir. While we have your attention 🙂 please can you clarify the Linux Kernel version in R80.20?

I seem to have 3.10.0693cpx86_64 in my new build MDS and the old 2.6.18-92cpx86_64 in a new build gateway (VSX in my case). What's the plan and how is this going to affect (if at all) new open server technology (or maybe not so new anymore).

Had some fun with the new xfs (on the log partition only) and ext3 partitions when resizing an R80.20 server (for more space in /opt). Have already fed back on the relevant SKs (they need more details since the R80.20 deployment uses a mix of the two (xfs and ext2)) and hopefully they will be clarified.

Otherwise all is good... 😉

Thanks,

Don

Re: NAT Templates - SecureXL

PhoneBoy — Tue, 04 Dec 2018 15:36:48 GMT

We plan to support the newer kernel in the gateway in the coming weeks.

I believe we are still looking for EA candidates if you're interested

You only get xfs on R80.20 if you do a fresh install as it requires a complete reformat of the drive.

You don't get xfs if you do an in-place upgrade to R80.20.

Re: NAT Templates - SecureXL

Don_Paterson — Tue, 04 Dec 2018 15:40:14 GMT

Thanks Dameon. From what I see even a fresh install has xfs and ext3 on different partitions.

Will advertise where possible for EA candidates. 🙂

OEM/open server customers are likely to be more interested I guess.

Re: NAT Templates - SecureXL

PhoneBoy — Fri, 07 Dec 2018 23:35:47 GMT

Now of course the new version of R80.20 with the new kernel is released

Not all the possible Open Servers are supported yet, but you can give it a try: https://community.checkpoint.com/community/infinity-general/appliances-and-gaia/blog/2018/12/06/r8020-security-gateway-with-new-gaia-based-on-kernel-310-is-ga-for-cloudguard-and-hp-gen10?sr=search&searchId=84179a44-9fdc-419e-86d0-cbb9c0ef5db8&searchIndex=0‌

Re: NAT Templates - SecureXL

Don_Paterson — Sat, 08 Dec 2018 07:22:52 GMT

Thank you for the prompt update 😄

Will have a play and dissendissethid information further.

Re: NAT Templates - SecureXL

Jaisingh_rathor — Thu, 14 Nov 2019 13:06:28 GMT

Hi Tim,

Thanks for the explanation.

I am still confused about what templates are and how traffic is being accelerated.

Please help