topic Re: R80.x Security Gateway Architecture (Acceleration Card Offloading) in General Topics

R80.x Security Gateway Architecture (Acceleration Card Offloading)

HeikoAnkenbrand — Fri, 22 May 2020 17:04:33 GMT

Introduction

R80.20 and above offer many technical innovations regarding R77 and R80.10. I will look at the new Falcon Acceleration Cards in this article.

SecureXL is a software acceleration product installed on security gateways and new acceleration cards. Performance Pack uses SecureXL technology and other innovative network acceleration techniques to deliver wire-speed performance for security gateways. SecureXL is implemented either in software or in hardware:

SAM cards on Check Point 21000 appliances
ADP cards on IP Series appliances
Falcon cards (new in R80.20) on different appliances

The SecureXL device minimizes the connections that are processed by the INSPECT driver.

Chapter

More interesting articles:

- R80.x Architecture and Performance Tuning - Link Collection
- Article list (Heiko Ankenbrand)

New acceleration Falcon architecture

The new acceleration Falcon architecture with R80.20+:

Low Latency
High Connections Rate
SSL Boost
Deep Inspection Acceleration
Modular Connectivity
Multible Acceleration modules
Falcon 1G (8x1 GbE), 10G (4x10 GbE) and 40G (2x40 GbE)
Compatible with 5900, 15000 & 23000 Appliance Series

What’s new in acceleration high level architecture:

SecureXL on Acceleration Card (AC)
Streaming over SecureXL
Lite Parsers
Async SecureXL
Scalable SecureXL
Acceleration stickiness
Policy push acceleration

SecureXL architecture on Acceleration Card

R80.20 SecureXL adds support for Falcon cards to offloading from appliance to acceleration card leaving the appliance to do more.

Following features are offloaded to the acceleration card:

SecureXL
Streaming
TLS encryption und decryption
Parsers
Pattern Matching

Following features are working on the host (appliance):

Contexts
Blades (incl. user space)
Rule base
Headers
And more complex logic

The following flowchart shows the new offloaded features of falcon architecture in pink.

Streaming – serves an important function in the NGTP software architecture. The streaming process creates an ordered packet stream and directly performs a number of security functions on the stream. NGTP can assemble packets into a stream in two ways, passive or active, depending on the nature of the traffic. Each has advantages and disadvantages. The passive mode (PSL) gives little opportunity for modifying the traffic stream. In contrast, the active mode can modify the connection. Active mode essentially proxies the TCP connection and is necessary when performing HTTPS inspection. Active streaming (CPAS) also facilitates timing and buffering when inspecting content such as large files. Keeping the goals of integrated, high security effectiveness and performance in mind, Check Point chose to provide the option to do passive and active streaming, which provides the best balance of security and optimized performance based on actual usage conditions.

Pattern Matcher - Security modules each have a distinct function and they register with the CMI to receive particular context types.

Parsers - Protocols include HTTP, SMTP, DNS, IMAP, Citrix, and many others. Protocol parser instances register with the streaming engine in order to receive ordered streams of data, both client-to-server (C2S) as well as server-to-client (S2C) streams.

TLS encoder/decoder - encrypt and decrypt TLS sessions.

Acceleration Card Path

R80.20 acceleration cards provide three new acceleration flows:

Host path
Buffer path
Inline path

Host Path - For non acceleration connections (eg. local connections) and connections on non acceleration card interface.

Buffer path - For HTTP requests, HTTP response headers and TLS handshakes.

Inline path - For HTTP response body (until 1^st tier match) and TLS bulk encryption/ decryption.

References

R&D meeting Israel

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Pablo_Montega — Fri, 12 Oct 2018 14:49:18 GMT

Are Falcon cards available for pruchase?

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Kim_Moberg — Fri, 12 Oct 2018 15:25:39 GMT

Awsome Heiko.

Technical functional descriptions provide one with better understanding of how it works. Keep up with these articles.

Looking forward to see the performance of those cards. Soon the be installed in EA program.

By the way. The 5800 appliance also support the falcon card.

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

PhoneBoy — Sat, 13 Oct 2018 08:42:39 GMT

Not yet, but check with your local office about participating in the Early Availability program for them.

Note that some of the details here about what the Falcon cards will support in the end may change, but a lot of the architecture to support these cards is present in R80.20.

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Rolf_Kaschek — Sat, 13 Oct 2018 10:17:42 GMT

Yes it is an intresting overview. Dose this mean that SecureXL is used on the Falcon cards?

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

HeikoAnkenbrand — Sat, 13 Oct 2018 10:26:06 GMT

Yep, SecureXL runs on acceleration card and host.

Regards,

Heiko

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Sandro_Gerdel — Sun, 21 Oct 2018 07:21:59 GMT

Which appliance is supported for falcon cards.

Cheers,

Sandro

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

HeikoAnkenbrand — Sun, 21 Oct 2018 14:42:35 GMT

Hi Sandro,

see this article:

Falcon Modules and R80.20

Regards,

Heiko

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Don_Paterson — Wed, 23 Jan 2019 10:23:39 GMT

Any idea when these cards will be available or any updates?

Will they be supported in VSX (R80.20 and 64-bit instances)?

Thanks,

Don

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

PhoneBoy — Wed, 23 Jan 2019 10:46:00 GMT

The cards are in EA now and are expected to be released in the near future.

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Don_Paterson — Wed, 23 Jan 2019 10:53:09 GMT

Thank you. Can customers still join? I am talking to a customer who is very interested in these cards.

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Don_Paterson — Thu, 24 Jan 2019 15:46:52 GMT

Is the card slated to be supported for VSX in the first GA release?

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

PhoneBoy — Fri, 25 Jan 2019 01:25:54 GMT

Customers can still join the EA, yes--check with your local office.

And, as near as I can tell, they should support VSX.

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

HeikoAnkenbrand — Sat, 09 Mar 2019 19:51:29 GMT

Compatible with 5900, 15000 & 23000 Appliance Series

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

HeikoAnkenbrand — Sat, 09 Mar 2019 19:54:56 GMT

I'm testing it on a customer right now.
Is it possible to view the SecureXL settings on the Falcan card? Are there special CLI commands for this?

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Vato_Chantladze — Sun, 12 May 2019 11:34:18 GMT

Hi!

Great post!

The really interesting part is that R80.30 supports additional cipher suites what R80.20 does not. But in case you want to remain OS version but want to upgrade SSL offloading capabilities only, will it be possible to upgrade Falcon drivers for the new cipher suites?

Vato

Re: R80.x Security Gateway Architecture (Acceleration Card Offloading)

Daniel_Taney — Wed, 15 May 2019 19:03:11 GMT

Does anyone know if the current GA release of R80.30 supports these cards natively? Or will the functionality have to be added later via HFA?

I thought I had read that some HFA for R80.20 introduced support for them. Wasn't sure if this "made it" to R80.30?