topic Re: R80.40 automatically changes the number of CoreXL SNDs, Firewall instances and the Multi-Queue in General Topics

R80.40 automatically changes the number of CoreXL SNDs, Firewall instances and the Multi-Queue

HeikoAnkenbrand — Tue, 03 Sep 2019 15:26:31 GMT

An extract from the readme with information about R80.40:

CUT>>

CoreXL and Multi-Queue

Support for automatic allocation of CoreXL SNDs and Firewall instances that does not require a Security Gateway reboot.
Improved out of the box experience - Security Gateway automatically changes the number of CoreXL SNDs and Firewall instances and the Multi-Queue configuration based on the current traffic load

<<<CUT

Do you have any information on how the algorithms will work?
According to which criteria will the distribution take place?

How will this work with a ClusterXL?

Timothy_Hall — Tue, 03 Sep 2019 15:29:09 GMT

Great questions Heiko, I'm assuming this is all predicated on the new Gaia 3.10 kernel and USFW being enabled in R80.40...

HeikoAnkenbrand — Thu, 05 Sep 2019 19:12:48 GMT

Any news here from Check Point?

Tsvika_Gilman — Fri, 06 Sep 2019 05:53:54 GMT

That's an interesting question. I would prefer a manual configuration if I didn't know how it works.

Chen_Muchtar — Mon, 09 Sep 2019 20:15:48 GMT

Hi Heiko,

Addressing your question per algorithm concept:

Essence:

Changing CoreXL split between FW workers and SND on the fly based on CPU utilization

Deciding keys:

The average utilization of CoreXL SNDs and FWs are regularly sampled
If either CoreXL SNDs or FWs utilization is higher than the other, perform an estimate of utilization post “migrating” a CPU to the other group
Note: when SMT is on, change is doubled

Flows:

General

Supported on OS 3.10 (USFW/Kernel); Check Point appliances with 8 cores or more; VSX is currently a limitation
Supported on Cluster HA; VSLS is currently a limitation

For further questions / feedback / suggestions for enhancements etc. – pls don’t hesitate to contact me directly - chenmu@checkpoint.com