topic Re: Drop optimization in General Topics

Drop optimization

Gacki — Fri, 24 Nov 2023 09:26:20 GMT

What is enable drop optimization checkpoint in firewall

Re: Drop optimization

Chris_Atkinson — Fri, 24 Nov 2023 12:07:26 GMT

It's intended to help with the resource utilization of dropping heavy traffic, please see:

https://support.checkpoint.com/results/sk/sk90861

Also some previous discussion on this topic:

https://community.checkpoint.com/t5/General-Topics/Drop-optimization/td-p/34855

Re: Drop optimization

Timothy_Hall — Fri, 24 Nov 2023 16:00:49 GMT

When it comes to having the firewall efficiently drop floods of traffic, I've always been partial to the SecureXL Penalty Box. Good logging and easy to understand: sk112454: How to configure Rate Limiting rules for DoS Mitigation (R80.20 and higher)

The "Optimized Drops" feature to dynamically form drop templates always seemed a bit clunky to me as it couldn't offload drop templates for complex objects such as Dynamic Objects, and those specific drops still had to happen on a Firewall Worker Instance core. The logging and monitoring was also not very good. However in R81.20 the Optimized Drops feature got some updates to make it more compatible with SecureXL, and also improved the monitoring/logging. Haven't had a chance to try it yet but looks promising: sk175006: Firewall Drop Templates in R81.20 and higher

Re: Drop optimization

the_rock — Fri, 24 Nov 2023 19:22:06 GMT

I been running it in R81.20 labs, its pretty good.

Cheers,

Andy