topic Re: What is UPPAK, KPPAK vs. USFW, KSFW in General Topics

What is UPPAK, KPPAK vs. USFW, KSFW

HeikoAnkenbrand — Thu, 30 Oct 2025 12:03:56 GMT

In recent years, I have repeatedly noticed confusion regarding the following terms: KSFW, USFW, UPPAK, and KPPAK, which sometimes led to incorrect modules being switched. Therefore, I’ve written a short summary that may help you identify which firewall modules are currently active and how you can switch between them.

SecureXL Performance Pack

SecureXL is a software acceleration product installed on Security Gateways. SecureXL network acceleration techniques deliver wire-speed performance for Security Gateways. Performance Pack is a software acceleration product installed on Security Gateways. Performance Pack uses SecureXL technology and other innovative network acceleration techniques to deliver wire-speed performance for Security Gateways. SecureXL is implemented either in software or in hardware.

UPPAK - User Space Performance Pack

SecureXL runs as processes in the user space. This mode increases performance and unlocks more advanced features in SecureXL. This is the default mode on the supported Check Point appliances after you install R81.20 Jumbo Hotfix Accumulator Take 38 or above.

KPPAK - Kernel Space Performance Pack

SecureXL runs as a kernel module in the kernel space.

Viewing the Current SecureXL Mode	# fwaccel stat
Changing the Current SecureXL Mode	# cpconfig -> Check Point SecureXL -> Change SecureXL Mode # reboot Important - In cluster, this can cause a failover.
More informatios	- R82 Performance Tuning Administration Guide - Configuring SecureXL - R81.20 Performance Tuning Administration Guide - Configuring SecureXL ATRG: SecureXL for R80.20 and higher (sk153832) - SecureXL Mechanism (sk32578)

CoreXL Firewall instances

CoreXL is a performance-enhancing technology for Security Gateways on multi-CPU-core processing platforms. CoreXL enhances Security Gateway performance by enabling the processing CPU cores to concurrently perform multiple tasks.

CoreXL provides almost linear scalability of performance, according to the number of processing CPU cores on a single machine. The increase in performance is achieved without requiring any changes to management or to network topology.

On a Security Gateway with CoreXL enabled, the Firewall instance is replicated multiple times. Each replicated copy, or FW instance, runs on one processing CPU core. These FW instances handle traffic concurrently, and each FW instance is a complete and independent FW inspection.

USFW - User Space Firewall

User Space Firewall (USFW) is the infrastructure in which CoreXL Firewall instances run in the user space. This mode is available from R80.30 with Gaia kernel 3.10.

KSFW - Kernel Space Firewall

Kernel Space Firewall (KSFW) is the infrastructure in which CoreXLClosed Firewall instances run in the kernel.

Viewing the current firewall instance mode	# fwmode -s
Changing the current firewall instance mode	# cpconfig -> Check Point CoreXL -> Change firewall mode or # fwmode -k (for kernel space) # fwmode -u (for user space) # reboot Important - In cluster, this can cause a failover.
More informations	- R82 Performance Tuning Administration Guide - CoreXL Firewall Mode - R81.20 Performance Tuning Administration Guide - CoreXL Firewall Mode - User Space Firewall (USFW) support in R80.30 3.10 and higher (sk167052) - ATRG: CoreXL (sk98737)

Important

Only the following combinations are supported.

	SecureXL - User Space Mode (UPPAK)	SecureXL - Kernel Space Mode (KPPAK)
Firewall User Space Mode (USFW)	Supported	Supported
Firewall Kernel Space Mode (KSFW)	Not supported	Supported

This sk179432 explains that there is a functional difference between UPPAK and KPPAK modes. Therefore, when switching between them, it’s important to carefully review the features currently in use on the firewall to ensure compatibility and avoid any unexpected behavior.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

the_rock — Mon, 27 Oct 2025 17:16:12 GMT

Such a great explanation Heiko.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

PhoneBoy — Tue, 28 Oct 2025 01:09:47 GMT

In R82.10, it will be only USFW and UPPAK 🙂

Re: What is UPPAK, KPPAK vs. USFW, KSFW

emmap — Tue, 28 Oct 2025 02:07:55 GMT

Only other point I'd make is that if you suspect you have a 'user mode' issue, 99% of the time it'll be a UPPAK thing, so set that to KPPAK but leave USFW on.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

HeikoAnkenbrand — Tue, 28 Oct 2025 09:59:16 GMT

Hi @PhoneBoy , thanks for the info.

Luckily, we won’t have to switch back and forth between KSFW/USFW and UPPAK/KPPAK anymore in the future😉

Re: What is UPPAK, KPPAK vs. USFW, KSFW

the_rock — Tue, 28 Oct 2025 11:53:09 GMT

Glad for that 🙂

Re: What is UPPAK, KPPAK vs. USFW, KSFW

HeikoAnkenbrand — Thu, 30 Oct 2025 12:02:17 GMT

I’ll add that to the original article.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

HeikoAnkenbrand — Mon, 03 Nov 2025 06:29:47 GMT

It will become particularly interesting once R82.10 is available and only USFW and UPPAK are supported. At that point, we will no longer have the option to switch back to KPPAK. A major question for me is whether the following features will still be supported with UPPAK in R82.10: DDoS (SecureXL), VXLAN interface, GRE interface, and Bridge interface.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

PhoneBoy — Mon, 03 Nov 2025 17:41:29 GMT

Possible these will not be limitations in R82.10, though I have not seen any confirmation of this.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

JozkoMrkvicka — Mon, 03 Nov 2025 21:07:17 GMT

R82.10 is already in Public EA stage. Maybe some limitations will be solved only in GA, but if someone has some spare appliances supported by R82.10, might be worth to test features mentioned in sk179432 as not currently supported within UPPAK on R82.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

the_rock — Mon, 03 Nov 2025 22:12:42 GMT

Looking forward to it!

Re: What is UPPAK, KPPAK vs. USFW, KSFW

Kevin_Smith777 — Wed, 05 Nov 2025 17:59:28 GMT

In R82.10 GA, DDoS (rate limiting, deny listing, penalty box), VXLAN interface, GRE interface, and Bridges will be supported with UPPAK. For GRE and VXLAN some limitations will remain for Maestro.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

the_rock — Wed, 05 Nov 2025 18:06:40 GMT

Thanks for that!

Re: What is UPPAK, KPPAK vs. USFW, KSFW

HeikoAnkenbrand — Thu, 06 Nov 2025 20:42:24 GMT

Hi @Kevin_Smith777

That sounds, with R82.10, as if SecureXL UPPAK has been significantly improved in many areas. I’m curious to see what awaits us there.

Re: What is UPPAK, KPPAK vs. USFW, KSFW

PhoneBoy — Thu, 06 Nov 2025 21:23:57 GMT

I imagine some of the limitations are related to the fact an older version of DPDK has to be used for the older kernels used prior to R82.10.