topic Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel) in General Topics

R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

HeikoAnkenbrand — Sun, 28 Mar 2021 19:03:22 GMT

The Fast Acceleration (picture 1 green) feature lets you define trusted connections to allow bypassing deep packet inspection on R80.20 JHF103 and above gateways. This feature significantly improves throughput for these trusted high volume connections and reduces CPU consumption.

The CLI of the gateway can be used to create rules that allow you to bypass the SecureXL PSLXL path to route all connections through the fast path.

Tip 1

Use this function to exclude IP's or networks from deep inspection.

Picture 1

Here you can see the complete packet flow in detail : R80.x - Security Gateway Architecture (Logical Packet Flow)
I will update the document to this new function in the next few days.

Feature Attributes:

Configured from the gateway's CLI.
Can be turned On / Off, Off is the default.
Rules can be added / deleted by demand.
Configuration (State / rules) survive reboot.
Maintain rule hit count (does not survive reboot).
Every configuration change done by the user is logged in $FWDIR/log/fw_fast_accel.log file.

Feature Usage:

fw ctl fast_accel <option>

Option	Explanation
add	Add a connection
delete	Delete a connection
enable	Set feature state to on
disable	Set feature state to off
show_table	Display the rules configured by the user
show_state	Display the current feature state
reset_stats	Reset the statistics collected by the feature
--help/-h	Display help message

To create fast_accel rules, read more in this sk156672 - SecureXL Fast Accelerator (fw fast_accel) for R80.20 and above.

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Morten__ — Wed, 04 Mar 2020 12:52:59 GMT

What about VSX support? Is it fully supported in VSX? And how is it enabled in VSX - per VS? Or is it enabled in VS0 and then configured per VS?

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

HeikoAnkenbrand — Mon, 07 Sep 2020 05:25:41 GMT

Article with new pictures and text revised for R80.40.

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Wolfgang — Thu, 01 Oct 2020 04:58:32 GMT

@Morten__

yes, it's supported with VSX. You have to enable and define rules for each VS.

Wolfgang

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Kaspars_Zibarts — Fri, 28 May 2021 08:32:22 GMT

Has anyone managed to get it to work on VSX? Trying hard but keep getting 0 hit count. R80.30 T219.

It's enabled on a specific VS

there is definitely traffic between those hosts

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

_Val_ — Fri, 28 May 2021 08:51:58 GMT

What does "fw -vs <vsid> ctl get int fw_fast_accel_is_initialized" say?

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

_Val_ — Fri, 28 May 2021 08:53:24 GMT

Also, does the same traffic cross any other VSs on the same box?

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Kaspars_Zibarts — Fri, 28 May 2021 09:01:51 GMT

[Expert@vsx:0]# fw -vs 10 ctl get int fw_fast_accel_is_initialized
fw_fast_accel_is_initialized = 1

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Kaspars_Zibarts — Fri, 28 May 2021 09:06:06 GMT

actually no, it's one physical interface to another on the same VS

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Kaspars_Zibarts — Fri, 28 May 2021 09:13:38 GMT

sorry have to blur out actual IPs but you will have to trust that they match fast accelerator rule 🙂

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

_Val_ — Fri, 28 May 2021 09:48:59 GMT

I understand. Please go to TAC for more analysis on that.

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Kaspars_Zibarts — Fri, 28 May 2021 10:49:11 GMT

Thanks @_Val_ will do!

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Wolfgang — Fri, 28 May 2021 11:27:12 GMT

@Kaspars_Zibarts We are using fast_accel rules on R80.40 take 118 with VSX. No problems seen. Traffic hits the rules and connections are really faster then without (database replications and VMware-backup).

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Kaspars_Zibarts — Fri, 28 May 2021 11:34:40 GMT

Did you need to enable it on VS0? Or just actual VSx you want to use it on?

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

genisis__ — Fri, 28 May 2021 12:12:04 GMT

Kaspars - works for me. We are running R80.40 with JHFA102

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Wolfgang — Fri, 28 May 2021 11:35:53 GMT

We enabled this in one specific VS only.

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

genisis__ — Fri, 28 May 2021 12:14:55 GMT

Silly question is Take 118 stable and has there been any improvement in performance with this?

I got told by a TAC engineer that Jumbos upto Take 102 should be migrated to 118 as there are a number of stability issues fixed in this.

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Timothy_Hall — Tue, 01 Jun 2021 12:40:36 GMT

If the traffic has to go F2F for some reason, the fast_accel will not work. However your fwaccel conns output suggests that this traffic is not in the F2F path, because if it was it wouldn't show up at all in the output. Your first fast_accel rule is for port 2029 while the actual traffic is port 2049, but I assume it should still match the second fast_accel rule.

I have a hazy recollection that NFS traffic cannot be handled directly by SecureXL (same as CIFS) and that may preclude using fast_accel in this case. Can you try doing a fast_accel for some port other than 2049 or 445 that is not F2F path and see if that works?

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Kaspars_Zibarts — Tue, 01 Jun 2021 06:30:27 GMT

Thanks Tim! Especially for spotting the typo! I'll need to try again haha And I'll play around with my other VSX that runs R80.40 just to make sure I'm setting up all correctly

Re: R80.x - Performance Tuning Tip - SecureXL Fast Accelerator (fw ctl fast_accel)

Dale_Lobb — Mon, 07 Jun 2021 22:22:51 GMT

I also have had issues getting fast_accel to work with some traffic. I've had a TAC case open for a few weeks on this.

First, there is a direct conflict in statements made in sk156672:

1) "The Fast Acceleration feature lets you define trusted connections to allow bypassing deep packet inspection."

2) "Fast Accel enforces only rule base that does not require deep packet inspection.

I've been told by TAC that I need to have a global exception for the traffic for all inspection blades before the traffic can be added to the fast_accel table. What I do not understand is: Why is this necessary? If I totally bypass inspection by all blades, why is the traffic not then carried by the SecureXL SND cores? Why does it still show up on my FW worker cores if there is no inspection involved? Why do I even need fast_accel then?