topic Re: What "set vsx on/off" actually does under hood? in Firewall and Security Management

What "set vsx on/off" actually does under hood?

Firewallteam_DE — Mon, 14 Oct 2019 13:20:10 GMT

Hello Guys

I am having trouble finding what does turning on/off vsx mode does to firewall cluster.

I have 2 members fully configured in cluster VSLS mode, running coreXL, few virtual-systems on it and soon in production. In many guides theres suggestion to turn off vsx mode before applying some commands which otherwise cannot be accepted. I only understand that vsx mode is "interface and routes configuration protection". But is there anything beyond human factor protection in CLI?

Subsequently, I have this problem:

automatic affinity on one cluster member is working fine, and it doesn't on another:

eth1-01 : 8
eth1-02 : 8
eth1-03 : 0
eth1-04 : 8
eth2-01 : 0
eth2-04 : 8
eth2-05 : 0
eth2-08 : 8
eth3-01 : 0
eth3-02 : 0

eth1-01 : 0
eth1-02 : 0
eth1-03 : 0
eth1-04 : 0
eth2-01 : 0
eth2-04 : 0
eth2-05 : 0
eth2-08 : 0
eth3-01 : 0
eth3-02 : 0

some CP article suggests checking "fw ctl multik get_mode" to see if dynamic dispatcher is on, but this command cannot be run in vsx mode:

Option not supported in VSX mode.

Edit: (there are 2 cores for vs:0 in my setup) after restarting and re-entering default affinity mode (automatic) all interfaces are assigned core 0 (I expected even distribution between cores 0, 8). There is no traffic passing interfaces yet.

Thank you

Tomas

Re: What "set vsx on/off" actually does under hood?

G_W_Albrecht — Wed, 09 Oct 2019 14:07:25 GMT

Before risking my VSX VSLS configuration i would rather involve TAC !

Re: What "set vsx on/off" actually does under hood?

Kaspars_Zibarts — Wed, 06 Nov 2019 22:00:48 GMT

Here's link to my cpx presentation on the subject of VSX optimisation

https://community.checkpoint.com/t5/Member-Exclusive-Content/VSX-performance-optimisation-pdf/m-p/41513

Hard to answer without having full details of the system.

As for vsx off - yes it's mainly to protect system from making silly mistakes in areas that are owned my management i.e routing and interfaces. You will learn to survive without it 🙂 can't remember last time I turned vsx off

Re: What "set vsx on/off" actually does under hood?

Chris_Atkinson — Wed, 06 Nov 2019 23:06:28 GMT

Which GW version are you utilising?
Dynamic dispatcher is available only from R80.20 and above for VSX mode.

Re: What "set vsx on/off" actually does under hood?

Kaspars_Zibarts — Thu, 07 Nov 2019 05:20:15 GMT

And be careful not to mix up two things - affinity for SXL or interfaces and affinity for for fw workers. Your original post mixed two together. Try printing both types with fw ctl affinity -l and we can take it from there