topic Re: SecureXL is enabled, but the traffic is not accelerated in General Topics

SecureXL is enabled, but the traffic is not accelerated

Thecoder — Tue, 24 Apr 2018 11:46:07 GMT

SecureXL is enabled, but the traffic is not accelerated. i restarted securexl.but the result not changed. corexl and ht are active. and we have performance problems.

[Expert@fw1:0]# fwaccel stats -s

Accelerated conns/Total conns : 519/114126 (0%)

Accelerated pkts/Total pkts : 1306379/17442674 (7%)

F2Fed pkts/Total pkts : 11676500/17442674 (66%)

PXL pkts/Total pkts : 4459795/17442674 (25%)

QXL pkts/Total pkts : 0/17442674 (0%)

[Expert@fw1:0]# fwaccel stats -p

F2F packets:

--------------

Violation Packets Violation Packets

-------------------- --------------- -------------------- ---------------

pkt is a fragment 389 pkt has IP options 225

ICMP miss conn 80304 TCP-SYN miss conn 5282924

TCP-other miss conn 7127805 UDP miss conn 1435788

other miss conn 5652 VPN returned F2F 15

ICMP conn is F2Fed 24867 TCP conn is F2Fed 167500203

UDP conn is F2Fed 29421 other conn is F2Fed 0

uni-directional viol 0 possible spoof viol 0

TCP state viol 103953 out if not def/accl 5518

bridge, src=dst 0 routing decision err 87

sanity checks failed 0 temp conn expired 3

fwd to non-pivot 0 broadcast/multicast 0

cluster message 0 partial conn 92673

PXL returned F2F 192634 cluster forward 0

chain forwarding 0 Tmpl no-match range 0

Tmpl no-match time 0 general reason 306

route change 0 inbound zone change 0

outbound zone change 0

Re: SecureXL is enabled, but the traffic is not accelerated

Timothy_Hall — Tue, 24 Apr 2018 12:10:17 GMT

Please post the output of the following commands for further analysis:

fw ver

free -m
netstat -ni
enabled_blades
fwaccel stat
fw ctl multik stat
fw ctl affinity -l -r
fw ctl multik get_mode (R77.30) or fw ctl multik dynamic_dispatching get_mode (R80.10+)
cpstat os -f multi_cpu -o 1
cpconfig (the menu displayed by this command)

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: SecureXL is enabled, but the traffic is not accelerated

Joshua_Hatter — Tue, 24 Apr 2018 13:06:38 GMT

Also might be useful to have #fwaccel conns

Re: SecureXL is enabled, but the traffic is not accelerated

Thecoder — Tue, 24 Apr 2018 18:42:11 GMT

fw ver
This is Check Point's software version R80.10 - Build 056
[Expert@fw1:0]# free -m
total used free shared buffers cached
Mem: 64207 35142 29064 0 903 12673
-/+ buffers/cache: 21565 42641
Swap: 32765 0 32765
[Expert@fw1:0]# netstat -ni
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
Mgmt 1500 0 118199136 0 0 0 1672154958 0 0 0 BMRU
bond100 1500 0 125776735 0 0 0 1903103776 0 0 0 BMmRU
eth1-01 1500 0 6990601996 0 0 0 7257672547 0 0 0 BMRU
eth1-02 1500 0 2708488932 0 0 0 2616334278 0 0 0 BMRU
eth2-01 1500 0 5308103110 0 127382 127382 5964648490 0 0 0 BMRU
eth2-02 1500 0 4477011 0 0 0 4658400 0 0 0 BMRU
eth3-01 1500 0 0 0 0 0 0 0 0 0 BMU
eth3-03 1500 0 303419 0 0 0 299866 0 0 0 BMsRU
eth3-04 1500 0 125473320 0 0 0 1902803949 0 0 0 BMsRU
lo 16436 0 17779742 0 0 0 17779742 0 0 0 LRU
[Expert@fw1:0]# enabled_blades
fw vpn cvpn urlf av appi ips identityServer SSL_INSPECT anti_bot ThreatEmulation mon vpn
[Expert@fw1:0]# fwaccel stat
Accelerator Status : on
Accept Templates : enabled
Drop Templates : enabled
NAT Templates : enabled
NMR Templates : enabled
NMT Templates : enabled

Accelerator Features : Accounting, NAT, Cryptography, Routing,
HasClock, Templates, Synchronous, IdleDetection,
Sequencing, TcpStateDetect, AutoExpire,
DelayedNotif, TcpStateDetectV2, CPLS, McastRouting,
WireMode, DropTemplates, NatTemplates,
Streaming, MultiFW, AntiSpoofing, Nac,
ViolationStats, AsychronicNotif, ERDOS,
McastRoutingV2, NMR, NMT, NAT64, GTPAcceleration,
SCTPAcceleration
Cryptography Features : Tunnel, UDPEncapsulation, MD5, SHA1, NULL,
3DES, DES, CAST, CAST-40, AES-128, AES-256,
ESP, LinkSelection, DynamicVPN, NatTraversal,
EncRouting, AES-XCBC, SHA256

cpconfig
This program will let you re-configure
your Check Point products configuration.

Configuration Options:
----------------------
(1) Licenses and contracts
(2) SNMP Extension
(3) PKCS#11 Token
(4) Random Pool
(5) Secure Internal Communication
(6) Disable cluster membership for this gateway
(7) Enable Check Point Per Virtual System State
(8) Enable Check Point ClusterXL for Bridge Active/Standby
(9) Hyper-Threading
(10) Disable Check Point SecureXL
(11) Check Point CoreXL
(12) Automatic start of Check Point Products

(13) Exit

cpstat os -f multi_cpu -o 1

Processors load
---------------------------------------------------------------------------------
|CPU#|User Time(%)|System Time(%)|Idle Time(%)|Usage(%)|Run queue|Interrupts/sec|
---------------------------------------------------------------------------------
| 1| 1| 13| 86| 14| ?| 74156|
| 2| 0| 16| 84| 16| ?| 74164|
| 3| 25| 49| 26| 74| ?| 74169|
| 4| 20| 50| 30| 70| ?| 74175|
| 5| 19| 51| 30| 70| ?| 74180|
| 6| 21| 50| 29| 71| ?| 74187|
| 7| 27| 42| 31| 69| ?| 74194|
| 8| 15| 60| 25| 75| ?| 74199|
| 9| 16| 56| 28| 72| ?| 74204|
| 10| 22| 44| 34| 66| ?| 74210|
| 11| 23| 45| 32| 68| ?| 74216|
| 12| 25| 37| 38| 62| ?| 74222|
| 13| 27| 37| 36| 64| ?| 74226|
| 14| 22| 47| 31| 69| ?| 74232|
| 15| 19| 48| 33| 67| ?| 74240|
| 16| 24| 41| 35| 65| ?| 74246|
| 17| 5| 5| 90| 10| ?| 74252|
| 18| 16| 11| 74| 26| ?| 74255|
| 19| 22| 49| 29| 71| ?| 74261|
| 20| 20| 52| 27| 73| ?| 74266|
| 21| 14| 64| 22| 78| ?| 74272|
| 22| 23| 46| 31| 69| ?| 74276|
| 23| 24| 45| 32| 68| ?| 74281|
| 24| 23| 48| 30| 70| ?| 74287|
| 25| 18| 55| 27| 73| ?| 74292|
| 26| 22| 45| 33| 67| ?| 74299|
| 27| 23| 43| 33| 67| ?| 74306|
| 28| 26| 40| 34| 66| ?| 74313|
| 29| 24| 46| 30| 70| ?| 74321|
| 30| 22| 45| 33| 67| ?| 74325|
| 31| 25| 40| 35| 65| ?| 74331|
| 32| 21| 46| 33| 67| ?| 74335|
---------------------------------------------------------------------------------

Processors load
---------------------------------------------------------------------------------
|CPU#|User Time(%)|System Time(%)|Idle Time(%)|Usage(%)|Run queue|Interrupts/sec|
---------------------------------------------------------------------------------
| 1| 0| 13| 87| 13| ?| 54603|
| 2| 0| 15| 85| 15| ?| 54608|
| 3| 20| 52| 27| 73| ?| 54612|
| 4| 25| 49| 26| 74| ?| 54617|
| 5| 23| 47| 30| 70| ?| 54620|
| 6| 23| 46| 31| 69| ?| 54624|
| 7| 22| 51| 26| 74| ?| 54629|
| 8| 26| 44| 30| 70| ?| 54635|
| 9| 25| 46| 30| 70| ?| 54641|
| 10| 17| 56| 27| 73| ?| 54647|
| 11| 26| 43| 32| 68| ?| 54654|
| 12| 27| 41| 32| 68| ?| 54660|
| 13| 27| 45| 29| 71| ?| 54664|
| 14| 23| 50| 27| 73| ?| 54669|
| 15| 19| 53| 28| 72| ?| 54673|
| 16| 15| 63| 21| 79| ?| 54679|
| 17| 0| 2| 98| 2| ?| 54684|
| 18| 0| 3| 97| 3| ?| 54690|
| 19| 18| 55| 27| 73| ?| 54694|
| 20| 23| 48| 29| 71| ?| 54700|
| 21| 12| 67| 20| 80| ?| 54706|
| 22| 31| 32| 37| 63| ?| 54710|
| 23| 27| 37| 36| 64| ?| 54714|
| 24| 21| 51| 28| 72| ?| 54719|
| 25| 18| 54| 27| 73| ?| 54724|
| 26| 22| 52| 26| 74| ?| 54730|
| 27| 27| 41| 32| 68| ?| 54737|
| 28| 23| 47| 30| 70| ?| 54742|
| 29| 30| 40| 30| 70| ?| 54744|
| 30| 25| 43| 32| 68| ?| 54748|
| 31| 25| 47| 28| 72| ?| 54752|
| 32| 22| 50| 29| 71| ?| 54756|
---------------------------------------------------------------------------------

Processors load
---------------------------------------------------------------------------------
|CPU#|User Time(%)|System Time(%)|Idle Time(%)|Usage(%)|Run queue|Interrupts/sec|
---------------------------------------------------------------------------------
| 1| 0| 13| 87| 13| ?| 25536|
| 2| 0| 14| 86| 14| ?| 25541|
| 3| 21| 49| 29| 71| ?| 25545|
| 4| 21| 46| 33| 67| ?| 25549|
| 5| 25| 41| 35| 65| ?| 25551|
| 6| 23| 49| 28| 72| ?| 25554|
| 7| 24| 44| 32| 68| ?| 25559|
| 8| 21| 51| 28| 72| ?| 25564|
| 9| 18| 52| 30| 70| ?| 25569|
| 10| 25| 43| 32| 68| ?| 25576|
| 11| 25| 40| 36| 64| ?| 25580|
| 12| 24| 43| 33| 67| ?| 25587|
| 13| 20| 45| 35| 65| ?| 25591|
| 14| 19| 53| 27| 73| ?| 25599|
| 15| 17| 52| 32| 68| ?| 25603|
| 16| 24| 39| 37| 63| ?| 25609|
| 17| 0| 2| 98| 2| ?| 25616|
| 18| 0| 1| 99| 1| ?| 25623|
| 19| 24| 44| 32| 68| ?| 25631|
| 20| 20| 50| 30| 70| ?| 25639|
| 21| 22| 51| 27| 73| ?| 25646|
| 22| 26| 39| 36| 64| ?| 25652|
| 23| 23| 42| 36| 64| ?| 25657|
| 24| 23| 45| 32| 68| ?| 25662|
| 25| 17| 51| 32| 68| ?| 25667|
| 26| 21| 41| 38| 62| ?| 25673|
| 27| 25| 40| 35| 65| ?| 25679|
| 28| 23| 41| 36| 64| ?| 25686|
| 29| 25| 41| 35| 65| ?| 25692|
| 30| 19| 45| 36| 64| ?| 25700|
| 31| 18| 53| 30| 70| ?| 25706|
| 32| 24| 42| 34| 66| ?| 25710|
---------------------------------------------------------------------------------

Processors load
---------------------------------------------------------------------------------
|CPU#|User Time(%)|System Time(%)|Idle Time(%)|Usage(%)|Run queue|Interrupts/sec|
---------------------------------------------------------------------------------
| 1| 9| 20| 71| 29| ?| 57968|
| 2| 5| 15| 80| 20| ?| 57977|
| 3| 26| 47| 27| 73| ?| 57984|
| 4| 29| 41| 31| 69| ?| 57991|
| 5| 13| 65| 22| 78| ?| 57999|
| 6| 28| 44| 29| 71| ?| 58004|
| 7| 20| 55| 25| 75| ?| 58009|
| 8| 19| 54| 28| 72| ?| 58017|
| 9| 20| 51| 29| 71| ?| 58027|
| 10| 19| 50| 30| 70| ?| 58034|
| 11| 22| 44| 35| 65| ?| 58044|
| 12| 23| 39| 39| 61| ?| 58052|
| 13| 21| 48| 32| 68| ?| 58059|
| 14| 25| 42| 33| 67| ?| 58066|
| 15| 17| 56| 27| 73| ?| 58073|
| 16| 20| 52| 27| 73| ?| 58078|
| 17| 1| 5| 95| 5| ?| 58082|
| 18| 0| 7| 93| 7| ?| 58089|
| 19| 24| 48| 28| 72| ?| 58097|
| 20| 23| 49| 28| 72| ?| 58103|
| 21| 19| 49| 32| 68| ?| 58110|
| 22| 28| 41| 31| 69| ?| 58119|
| 23| 26| 43| 31| 69| ?| 58126|
| 24| 25| 44| 32| 68| ?| 58133|
| 25| 22| 48| 31| 69| ?| 58138|
| 26| 20| 51| 28| 72| ?| 58143|
| 27| 24| 43| 34| 66| ?| 58149|
| 28| 21| 47| 32| 68| ?| 58156|
| 29| 24| 42| 35| 65| ?| 58162|
| 30| 22| 47| 31| 69| ?| 58171|
| 31| 17| 52| 30| 70| ?| 58178|
| 32| 19| 49| 33| 67| ?| 58184|
---------------------------------------------------------------------------------

Processors load
---------------------------------------------------------------------------------
|CPU#|User Time(%)|System Time(%)|Idle Time(%)|Usage(%)|Run queue|Interrupts/sec|
---------------------------------------------------------------------------------
| 1| 36| 33| 30| 70| ?| 61929|
| 2| 63| 29| 8| 92| ?| 61936|
| 3| 26| 48| 27| 73| ?| 61942|
| 4| 27| 46| 27| 73| ?| 61949|
| 5| 27| 45| 28| 72| ?| 61953|
| 6| 19| 58| 24| 76| ?| 61959|
| 7| 24| 52| 24| 76| ?| 61965|
| 8| 25| 49| 26| 74| ?| 61972|
| 9| 21| 52| 27| 73| ?| 61978|
| 10| 21| 53| 26| 74| ?| 61982|
| 11| 13| 68| 19| 81| ?| 61989|
| 12| 29| 43| 29| 71| ?| 61993|
| 13| 27| 44| 30| 70| ?| 61999|
| 14| 24| 46| 30| 70| ?| 62006|
| 15| 23| 49| 28| 72| ?| 62012|
| 16| 19| 55| 26| 74| ?| 62019|
| 17| 26| 28| 46| 54| ?| 62024|
| 18| 26| 24| 50| 50| ?| 62031|
| 19| 30| 49| 21| 79| ?| 62036|
| 20| 28| 45| 27| 73| ?| 62042|
| 21| 27| 47| 26| 74| ?| 62048|
| 22| 25| 46| 29| 71| ?| 62055|
| 23| 26| 46| 28| 72| ?| 62061|
| 24| 23| 55| 22| 78| ?| 62068|
| 25| 26| 45| 29| 71| ?| 62075|
| 26| 23| 51| 26| 74| ?| 62082|
| 27| 19| 45| 36| 64| ?| 62089|
| 28| 29| 43| 28| 72| ?| 62096|
| 29| 29| 41| 31| 69| ?| 62102|
| 30| 18| 57| 25| 75| ?| 62107|
| 31| 26| 42| 32| 68| ?| 62110|
| 32| 19| 52| 29| 71| ?| 62115|
---------------------------------------------------------------------------------

Processors load
---------------------------------------------------------------------------------
|CPU#|User Time(%)|System Time(%)|Idle Time(%)|Usage(%)|Run queue|Interrupts/sec|
---------------------------------------------------------------------------------
| 1| 14| 44| 42| 58| ?| 55755|
| 2| 2| 24| 73| 27| ?| 55761|
| 3| 25| 40| 35| 65| ?| 55765|
| 4| 18| 47| 34| 66| ?| 55770|
| 5| 21| 44| 35| 65| ?| 55774|
| 6| 22| 39| 39| 61| ?| 55779|
| 7| 19| 51| 30| 70| ?| 55785|
| 8| 23| 39| 39| 61| ?| 55789|
| 9| 25| 37| 38| 62| ?| 55791|
| 10| 16| 53| 31| 69| ?| 55797|
| 11| 26| 34| 40| 60| ?| 55803|
| 12| 24| 35| 40| 60| ?| 55808|
| 13| 20| 40| 40| 60| ?| 55813|
| 14| 21| 40| 39| 61| ?| 55818|
| 15| 19| 41| 40| 60| ?| 55823|
| 16| 20| 42| 37| 63| ?| 55830|
| 17| 23| 31| 46| 54| ?| 55835|
| 18| 92| 8| 0| 100| ?| 55839|
| 19| 22| 45| 34| 66| ?| 55844|
| 20| 18| 50| 32| 68| ?| 55851|
| 21| 23| 43| 34| 66| ?| 55854|
| 22| 29| 35| 36| 64| ?| 55858|
| 23| 25| 34| 41| 59| ?| 55861|
| 24| 22| 45| 32| 68| ?| 55866|
| 25| 25| 38| 37| 63| ?| 55870|
| 26| 23| 41| 36| 64| ?| 55874|
| 27| 24| 39| 37| 63| ?| 55879|
| 28| 26| 35| 39| 61| ?| 55884|
| 29| 22| 41| 38| 62| ?| 55889|
| 30| 19| 46| 35| 65| ?| 55892|
| 31| 15| 52| 33| 67| ?| 55898|
| 32| 19| 44| 38| 62| ?| 55902|
---------------------------------------------------------------------------------

Processors load
---------------------------------------------------------------------------------
|CPU#|User Time(%)|System Time(%)|Idle Time(%)|Usage(%)|Run queue|Interrupts/sec|
---------------------------------------------------------------------------------
| 1| 25| 41| 34| 66| ?| 58551|
| 2| 13| 24| 64| 36| ?| 58557|
| 3| 22| 39| 40| 60| ?| 58561|
| 4| 15| 46| 39| 61| ?| 58564|
| 5| 19| 39| 42| 58| ?| 58567|
| 6| 12| 52| 37| 63| ?| 58572|
| 7| 17| 48| 35| 65| ?| 58575|
| 8| 18| 45| 37| 63| ?| 58579|
| 9| 26| 38| 36| 64| ?| 58583|
| 10| 20| 50| 29| 71| ?| 58587|
| 11| 26| 39| 35| 65| ?| 58593|
| 12| 26| 38| 36| 64| ?| 58600|
| 13| 26| 37| 37| 63| ?| 58605|
| 14| 25| 36| 40| 60| ?| 58609|
| 15| 21| 47| 32| 68| ?| 58613|
| 16| 24| 38| 38| 62| ?| 58618|
| 17| 29| 31| 40| 60| ?| 58622|
| 18| 91| 9| 0| 100| ?| 58626|
| 19| 20| 42| 38| 62| ?| 58632|
| 20| 14| 53| 34| 66| ?| 58638|
| 21| 19| 41| 41| 59| ?| 58642|
| 22| 16| 49| 36| 64| ?| 58646|
| 23| 23| 34| 44| 56| ?| 58650|
| 24| 20| 38| 42| 58| ?| 58655|
| 25| 27| 39| 34| 66| ?| 58659|
| 26| 21| 44| 35| 65| ?| 58664|
| 27| 24| 38| 37| 63| ?| 58668|
| 28| 25| 43| 33| 67| ?| 58672|
| 29| 26| 36| 38| 62| ?| 58675|
| 30| 23| 44| 33| 67| ?| 58680|
| 31| 28| 36| 36| 64| ?| 58684|
| 32| 25| 41| 34| 66| ?| 58690|

Re: SecureXL is enabled, but the traffic is not accelerated

_Jelle — Tue, 24 Apr 2018 19:23:43 GMT

Hi,

Since when did you have the performance problems (Is there something changed in the environment)?

Which blades are there enabled? (enter enabled_blades in expert mode)

Show the ouput of the "sar" command

Look at the output of fwaccel conns and compare them to the following rules:

• The first packet of any new TCP or UDP session, unless there is a template
• Connections destined to or from the Security Gateway
• Connections that require Security servers
• Connections that have a Handler (ICMP, FTP,)
• Some IPS features (IP, ID, TTL)
• Multicast packets

Best luck with the troubleshooting!

Sounds like an interesting but yet irritating problem...

Greetz,

Jelle

Re: SecureXL is enabled, but the traffic is not accelerated

Thecoder — Wed, 25 Apr 2018 07:20:49 GMT

we opened strict inspection and ips profile. enabled_blades commands applied in expert mode

i attached sar log file to original post.

Re: SecureXL is enabled, but the traffic is not accelerated

Martin_Valenta — Wed, 25 Apr 2018 11:01:22 GMT

Well if you have enabled NGTP blades you cannot expect much to be accelarated. All NGTP traffic goes to PXL. You can verify that once you disable those blades, all will go to Accelerated path

Re: SecureXL is enabled, but the traffic is not accelerated

Thecoder — Wed, 25 Apr 2018 11:05:33 GMT

i disabled ips and threat prevention for test. but the result not changed. not accelerated.

Re: SecureXL is enabled, but the traffic is not accelerated

Martin_Valenta — Wed, 25 Apr 2018 11:09:44 GMT

and with expert command: fwaccel off/on ?

Re: SecureXL is enabled, but the traffic is not accelerated

Thecoder — Wed, 25 Apr 2018 11:10:58 GMT

yes

Re: SecureXL is enabled, but the traffic is not accelerated

Martin_Valenta — Wed, 25 Apr 2018 11:12:27 GMT

fwaccel stat - shows what?

Re: SecureXL is enabled, but the traffic is not accelerated

Thecoder — Wed, 25 Apr 2018 11:22:48 GMT

result of fwaccel stat not changed. accelerated conn=%0

Re: SecureXL is enabled, but the traffic is not accelerated

Martin_Valenta — Wed, 25 Apr 2018 11:25:22 GMT

That would mean that traffic passed throw gateway cannot be accelarated. What kind of services are passing firewall?

Re: SecureXL is enabled, but the traffic is not accelerated

G_W_Albrecht — Wed, 25 Apr 2018 11:28:10 GMT

sk98348: Best Practices - Security Gateway Performance

Re: SecureXL is enabled, but the traffic is not accelerated

Thecoder — Wed, 25 Apr 2018 11:33:16 GMT

yes, traffic passed throw gateway but not accelarated. our top protocol http,https,vpn,imap,pop3,sql,kerboros,naspter,dns,echo-request

Re: SecureXL is enabled, but the traffic is not accelerated

Markus_Genser — Wed, 25 Apr 2018 14:10:22 GMT

Do you use ISP redundancy with load sharing?

Re: SecureXL is enabled, but the traffic is not accelerated

Danny_Olson — Wed, 25 Apr 2018 20:48:03 GMT

Yeah, you can only accelerate traffic, or inspect it but not both. I have similar stats (below), and no traffic being accelerated, but we average 50MB of throughput going though the box (on a 12600), so we can get away with it. I have FW, VPN, APP/URLF, IA, AV, AB, IPS. What amount of throughput are you seeing though the box? Are you seeing the performance issues all the time, or just certain times? Do you have high connection rate? Dynamic dispatcher address a lot of issues. Are you seeing drops/overruns? Maybe your SND/Dispatcher ratio could use some adjusting?

Accelerated conns/Total conns : 49/37356 (0%)
Accelerated pkts/Total pkts : 3376791/195771942 (1%)
F2Fed pkts/Total pkts : 11224710/195771942 (5%)
PXL pkts/Total pkts : 181170441/195771942 (92%)
QXL pkts/Total pkts : 0/195771942 (0%)

Re: SecureXL is enabled, but the traffic is not accelerated

PhoneBoy — Wed, 25 Apr 2018 21:50:54 GMT

Even with all the blades enabled, you shouldn't see the amount of F2F traffic you're seeing.

Re: SecureXL is enabled, but the traffic is not accelerated

Timothy_Hall — Thu, 26 Apr 2018 02:16:08 GMT

Networker Networker‌ you didn't post the output of fw ctl affinity -l -r, but based on the CPU behavior it would appear you have a 2/30 split of SND/IRQ cores to Firewall Workers. The low RX-DRP rate reported by netstat seems to indicate that the SND/IRQ cores are servicing the network ring buffers adequately.

However I'm noticing a lot of user/process space CPU usage on the Firewall Worker cores and given you have HTTPS Inspection enabled, I'd guess that the wstlsd process assigned to each worker core in the cause. All traffic that is subject to HTTPS Inspection will go F2F. Selecting "Categorize HTTPS Sites" without enabling full-fledged HTTPS Inspection will also cause this to a lesser degree. Please review your HTTPS Inspection policy, you should NEVER use the object "Any" in the source or destination fields as it will pull all kinds of traffic into F2F.

The only other blade you have enabled that can cause major trips up into process space through F2F is Threat Emulation via the dplu and ted processes. I'd say your next step is to identify via top what processes are eating process/user space CPU time on the worker cores (2-31) and that should get you going in the right direction.

In regards to the zero templating rate (Accelerated conns/Total conns) noted by another poster, this is caused by enabling the anti-bot blade and is noted in the second edition of my book. Also if you have anything other than "Firewall" selected in your first policy layer (Network) that will also crater the SecureXL templating rate to zero. Doesn't matter all that much performance-wise though due to the new Column-based rulebase matching feature in R80.10.

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: SecureXL is enabled, but the traffic is not accelerated

Thecoder — Thu, 26 Apr 2018 09:15:16 GMT

hi Timm

i attached new log file about your requests. https inspection active on fw. i saw that there are many wstlsd process in result of top command. And we have two access policy layers:security and application. firewall layer is only opened in security layer.