https://community.checkpoint.com/t5/General-Topics/VXLAN-Perfomance-optimation-question/m-p/261280#M44186 <P>In the past, I noticed that VXLAN requires fast packet processing, as higher packet latency can cause problems. </P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="VXLAN_dhglkdfgh.png" style="width: 541px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/31935i7848601B0CA9E916/image-dimensions/541x271?v=v2" width="541" height="271" role="button" title="VXLAN_dhglkdfgh.png" alt="VXLAN_dhglkdfgh.png" /></span><BR /><BR />Therefore, I decided to enable SecureXL using the parameter sim_enable_vxlan = 1 (set the value of the SecureXL kernel parameter sim_enable_vxlan to one in the $PPKDIR/conf/simkern.conf) to speed up packet handling within the tunnel.<BR />In addition, I enabled Fast Acceleration for these address ranges to ensure that traffic always uses the Fastpath.<BR />I also created exclusions for IPS, Anti-Bot, and other similar blades for these network segments so that no traffic in these segments is inspected by those engines.</P> <P><STRONG>Are there any other optimization options to further improve VXLAN packet throughput through the firewall?</STRONG></P> <P>Info:<BR /><A href="https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG/VXLAN-Interfaces.htm" target="_self">- R82 Gaia Administration Guide - Configuring VXLAN Interfaces</A>&nbsp;<BR /><A href="https://support.checkpoint.com/results/sk/sk156672" target="_blank" rel="noopener">- sk156672: SecureXL Fast Accelerator (fw fast_accel)</A><BR /><A href="https://support.checkpoint.com/results/sk/sk170014" target="_self">- sk170014: Virtual Extensible LAN (VXLAN) Configuration Guide</A><BR /><BR /></P> Wed, 29 Oct 2025 11:46:05 GMT HeikoAnkenbrand 2025-10-29T11:46:05Z https://community.checkpoint.com/t5/General-Topics/VXLAN-Perfomance-optimation-question/m-p/261280#M44186 <P>In the past, I noticed that VXLAN requires fast packet processing, as higher packet latency can cause problems. </P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="VXLAN_dhglkdfgh.png" style="width: 541px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/31935i7848601B0CA9E916/image-dimensions/541x271?v=v2" width="541" height="271" role="button" title="VXLAN_dhglkdfgh.png" alt="VXLAN_dhglkdfgh.png" /></span><BR /><BR />Therefore, I decided to enable SecureXL using the parameter sim_enable_vxlan = 1 (set the value of the SecureXL kernel parameter sim_enable_vxlan to one in the $PPKDIR/conf/simkern.conf) to speed up packet handling within the tunnel.<BR />In addition, I enabled Fast Acceleration for these address ranges to ensure that traffic always uses the Fastpath.<BR />I also created exclusions for IPS, Anti-Bot, and other similar blades for these network segments so that no traffic in these segments is inspected by those engines.</P> <P><STRONG>Are there any other optimization options to further improve VXLAN packet throughput through the firewall?</STRONG></P> <P>Info:<BR /><A href="https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG/VXLAN-Interfaces.htm" target="_self">- R82 Gaia Administration Guide - Configuring VXLAN Interfaces</A>&nbsp;<BR /><A href="https://support.checkpoint.com/results/sk/sk156672" target="_blank" rel="noopener">- sk156672: SecureXL Fast Accelerator (fw fast_accel)</A><BR /><A href="https://support.checkpoint.com/results/sk/sk170014" target="_self">- sk170014: Virtual Extensible LAN (VXLAN) Configuration Guide</A><BR /><BR /></P> Wed, 29 Oct 2025 11:46:05 GMT https://community.checkpoint.com/t5/General-Topics/VXLAN-Perfomance-optimation-question/m-p/261280#M44186 HeikoAnkenbrand 2025-10-29T11:46:05Z https://community.checkpoint.com/t5/General-Topics/VXLAN-Perfomance-optimation-question/m-p/261403#M44214 <P>I found the reason why enabling SecureXL didn’t provide any performance benefit. The following SK explains that the UPPAK mode doesn’t support VXLAN. I’ve now switched SecureXL to KPPAK mode, and everything is working perfectly.<BR /><BR /><A href="http://Software https://support.checkpoint.com/results/sk/sk179432" target="_self">Software Releases for Quantum LightSpeed Appliances QLS / MLS and Quantum Force Appliances 9000, 19000, 29000</A>&nbsp;<BR /><BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="UPPAK_645645.jpg" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/31953iE96615295715E43C/image-size/large?v=v2&amp;px=999" role="button" title="UPPAK_645645.jpg" alt="UPPAK_645645.jpg" /></span></P> Thu, 30 Oct 2025 11:51:09 GMT https://community.checkpoint.com/t5/General-Topics/VXLAN-Perfomance-optimation-question/m-p/261403#M44214 HeikoAnkenbrand 2025-10-30T11:51:09Z