topic Re: Traffic acceleration turn off in General Topics

Traffic acceleration turn off

Mikhail_Demin — Thu, 23 Apr 2020 11:35:53 GMT

What'll happened when i'll perform "fwaccel off"? Gateway just will more slowly process new connections?

Re: Traffic acceleration turn off

Chris_Atkinson — Thu, 23 Apr 2020 11:51:16 GMT

As per sk162492 it will depend on the gateway version.

Re: Traffic acceleration turn off

Mikhail_Demin — Thu, 23 Apr 2020 12:16:07 GMT

Im my case version is 77.30

Re: Traffic acceleration turn off

Chris_Atkinson — Thu, 23 Apr 2020 14:38:43 GMT

It will disable acceleration until turned back on or the gateway is rebooted, are you trying to troubleshoot something in particular?

Typically it is recommend to do this (only temporarily) out of peak times or with headroom to cater for a load increase.

Re: Traffic acceleration turn off

Mikhail_Demin — Thu, 23 Apr 2020 12:35:46 GMT

Yes, i want to perform this for troubleshoot something. Thanks!

Re: Traffic acceleration turn off

Timothy_Hall — Tue, 28 Jan 2025 14:37:29 GMT

If after running fwaccel off you find that whatever issue you have is solved, instead of turning of SecureXL for all traffic permanently via cpconfig, consider excluding the problematic IP address(es) from acceleration as described here:

sk104468: How to disable SecureXL for specific IP addresses

After defining this exclusion everything matching it will always go F2F/slowpath, which has the side effect of making the matched traffic fully visible if using fw monitor.

Re: Traffic acceleration turn off

PhoneBoy — Sun, 26 Apr 2020 01:47:51 GMT

Generally you should not disable SecureXL except for troubleshooting as it will cause a pretty significant performance impact.
If disabling SecureXL solves an issue, then TAC should be involved.
Of course, since you're on an unsupported version now, you'll most likely have to upgrade to resolve the issue.

Re: Traffic acceleration turn off

Daniel_Kavan — Tue, 28 Jan 2025 15:00:07 GMT

I have a TAC case right now where 3 specific IP addresses are involved all over port 8080, so I may use this. This traffic started misbehaving right when we went from 5800 to 9300 appliances. That being said what kind of debugs would be helpful in figuring out why acceleration isn't working for that traffic?

Re: Traffic acceleration turn off

Timothy_Hall — Tue, 28 Jan 2025 14:43:19 GMT

I assume you mean why these connections are misbehaving when partially/fully accelerated, this is not generally something you can troubleshoot easily without TAC as it can involve sim debugs which can easily hurt performance or kill the firewall.

What you could do is get a packet capture with fw monitor -F and also run fw ctl zdebug + drop while trying the problematic accelerated connections. Now put them into the slowpath via sk104468, run the debug commands again with the test traffic and see what is different. However you need to be mindful of the order in which you run these two debugging commands as they can interfere with each other, see here: Max Capture Update 2: Debug Filter Battle -- fw monitor -F vs. fw ctl zdebug + drop