topic Re: R82 SecureXL Flowchart - non accelerated packets in General Topics

R82 SecureXL Flowchart - non accelerated packets

HeikoAnkenbrand — Wed, 26 Nov 2025 08:53:09 GMT

To gain a better understanding of SecureXL processing in R82, I analyzed SK179432 and SK32578 to determine which packets are not accelerated. The resulting diagram (also available as a PDF) provides an overview of which packets are processed by SecureXL and which are not. This overview is based on R82 and may differ in other versions.

Download PDF: SecureXL.pdf

Version:
1.0a initial version 11/06/2025
1.0b error fixed 11/07/2025
1.0c additional information from 11/26/2025
@Timothy_Hall, @Thomas_Eichelbu
added

Re: R82 SecureXL Flowchart - non accelerated packets

PhoneBoy — Thu, 06 Nov 2025 15:59:45 GMT

Possible some of this will change in R82.10 also.

Re: R82 SecureXL Flowchart - non accelerated packets

the_rock — Thu, 06 Nov 2025 16:11:40 GMT

Awesome!

Re: R82 SecureXL Flowchart - non accelerated packets

HeikoAnkenbrand — Thu, 06 Nov 2025 20:34:14 GMT

I will provide a separate version for R82.10 if necessary.

Re: R82 SecureXL Flowchart - non accelerated packets

HeikoAnkenbrand — Fri, 07 Nov 2025 07:31:13 GMT

I’ve fixed a small error.

Re: R82 SecureXL Flowchart - non accelerated packets

Ingard — Mon, 10 Nov 2025 08:13:30 GMT

Are there any other SKs in which limitations of the performance pack are documented?

Re: R82 SecureXL Flowchart - non accelerated packets

Timothy_Hall — Mon, 10 Nov 2025 14:26:48 GMT

Not an SK, but identifies all known situations where traffic cannot be accelerated at all and remains F2F/slowpath:

https://community.checkpoint.com/t5/General-Topics/Be-Your-Own-TAC-Part-Deux-EMEA-Advanced-Gateway-Troubleshooting/m-p/245011

Re: R82 SecureXL Flowchart - non accelerated packets

Thomas_Eichelbu — Tue, 11 Nov 2025 09:48:26 GMT

STATS for HA Appliance
[Expert@XXXXX:0:ACTIVE]# fwaccel stats -s
Accelerated conns/Total conns : 487/7876 (6%)
LightSpeed conns/Total conns : 0/7876 (0%)
Accelerated pkts/Total pkts : 17176169292/18377243141 (93%)
LightSpeed pkts/Total pkts : 0/18377243141 (0%)
F2Fed pkts/Total pkts : 1201073849/18377243141 (6%)
F2V pkts/Total pkts : 119253995/18377243141 (0%)
CPASXL pkts/Total pkts : 7303913309/18377243141 (39%)
PSLXL pkts/Total pkts : 3846916101/18377243141 (20%)
UDP IS XL pkts/Total pkts : 3738203439/18377243141 (20%)

ISP in LS

ISP link table
------------------------------------
|Name |Status|Role |
------------------------------------
|ISP1 |OK |Load Sharing|
|ISP2 |OK |Load Sharing|
------------------------------------
[Expert@XXXXX:0:ACTIVE]# fw tab -t connections -z | grep ISP | grep 443 | more
0 10.X.X.138 57861 3.120.221.108 443 6 TCP Estab. 7193/7200 N/A ISP redundancy 135 42.19KB 12m46s 7s
0 10.X.X.127 57904 95.101.35.41 443 6 TCP Estab. 7173/7200 N/A ISP redundancy 21.22K 29.68MB 2h43m0s 27s
0 10.X.X.10 65048 104.17.141.192 443 6 TCP None 4/5 N/A ISP redundancy 13 2.91KB 1m41s 1s
0 10.X.X.71 59406 52.98.241.194 443 6 TCP Estab. 7132/7200 N/A ISP redundancy 503 349.41KB 2m51s 1m8s
0 10.X.X.60 47920 213.153.59.88 443 6 TCP Estab. 2456/7200 N/A ISP redundancy 22 6.62KB 1h27m24s 1h19m4s
0 10.X.X.21 53249 52.123.244.49 443 6 TCP Estab. 5351/7200 N/A ISP redundancy 10 2.20KB 30m49s 30m49s

STATS for LW Appliance
[Expert@XXXXX:0:ACTIVE]# fwaccel stats -s
Accelerated conns/Total conns : 66/14845 (0%)
LightSpeed conns/Total conns : 0/14845 (0%)
Accelerated pkts/Total pkts : 9464872527/25360471464 (37%)
LightSpeed pkts/Total pkts : 0/25360471464 (0%)
F2Fed pkts/Total pkts : 15895598937/25360471464 (62%)
F2V pkts/Total pkts : 168358271/25360471464 (0%)
CPASXL pkts/Total pkts : 6124577560/25360471464 (24%)
PSLXL pkts/Total pkts : 1518327241/25360471464 (5%)
UDP IS XL pkts/Total pkts : 1445088274/25360471464 (5%)

so what u say.
so in HA we go at least Medium Path.
in LS all F2F 😞

Re: R82 SecureXL Flowchart - non accelerated packets

HeikoAnkenbrand — Tue, 11 Nov 2025 12:41:11 GMT

I think the information in the SK179432 and SK32578 is not 100% accurate.
I notice slight deviations in practice. However, the information should be fine as a general guideline.

I think so too; it depends on which mode (UPPAK, KPPAK vs. USFW, KSFW ) the firewall is running in.
There are indeed some behavioral differences that I notice in practice.

There are also slight behavioral differences in the Performance Pack when using the different clustering options ClusterXL HA/LS (as you, @Thomas_Eichelbu , illustrated well above), ElasticXL and Maestro (for example, with corrected packets).

The 39xx appliances, which don’t have an Intel CPU, are also interesting.

Re: R82 SecureXL Flowchart - non accelerated packets

the_rock — Tue, 11 Nov 2025 12:23:57 GMT

Looks both were updated on November 6th.

Re: R82 SecureXL Flowchart - non accelerated packets

Timothy_Hall — Tue, 11 Nov 2025 13:02:01 GMT

Appliance model number and output of fwaccel stat?

If you are in UPPAK mode, it wouldn't surprise me that old features, such as ISP Redundancy, must remain F2F/slowpath regardless of the Load Sharing or Primary/Backup setting.

Re: R82 SecureXL Flowchart - non accelerated packets

Thomas_Eichelbu — Tue, 11 Nov 2025 14:17:52 GMT

Hello,

well all output was made on "Check Point 3800"
R82 HFA 39

Re: R82 SecureXL Flowchart - non accelerated packets

HeikoAnkenbrand — Fri, 14 Nov 2025 07:22:45 GMT

Hi @Thomas_Eichelbu,

Your firewall is operating in KPPAK mode (see picture).

The following is only a guess:
Check Point is focusing heavily on developing the UPPAK mode. Even in, for example R81.20 with different JHFs, a difference in behavior can be observed. I believe the functions described in the SKs are therefore not 100% accurate. I have also noticed that in KPPAK, after installing a JHF, the behavior of the firewall changed. But with R82.10, there will only be the UPPAK anyway.

Re: R82 SecureXL Flowchart - non accelerated packets

HeikoAnkenbrand — Wed, 26 Nov 2025 08:54:09 GMT

Additional information (version 1.0c) from @Timothy_Hall, @Thomas_Eichelbu added.