topic Re: SecureXL PXL ... in General Topics https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46795#M9062 <P>Do you have any rule for Microsoft CIFS-Traffic something like the all_dce_rpc service?</P><P>These kind of traffic isnβ€˜t accelerated.</P> Wed, 13 Mar 2019 17:09:33 GMT Wolfgang 2019-03-13T17:09:33Z SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46782#M9053 <P>quick one chaps:</P> <P><EM>Accelerated conns/Total conns : 1287/12967 (9%)</EM><BR /><EM>Accelerated pkts/Total pkts&nbsp;&nbsp; : 14781656997/19848761750 (74%)</EM><BR /><EM>F2Fed pkts/Total pkts&nbsp;&nbsp; : 372423984/19848761750 (1%)</EM><BR /><EM>PXL pkts/Total pkts&nbsp;&nbsp; : 4694680769/19848761750 (23%)</EM><BR /><EM>QXL pkts/Total pkts&nbsp;&nbsp; : 0/19848761750 (0%)</EM></P> <P>what do you think personally went wrong with my SG so that I've got <STRONG>PXL 23%</STRONG> ?</P> <P>&nbsp;</P> <P>any hints/tips/advise highly appreciated <span class="lia-unicode-emoji" title=":slightly_smiling_face:">πŸ™‚</span></P> Wed, 13 Mar 2019 16:19:27 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46782#M9053 Jerry 2019-03-13T16:19:27Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46784#M9054 <P>What blades are enabled on this GW?</P> Wed, 13 Mar 2019 16:28:45 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46784#M9054 Daniel_Taney 2019-03-13T16:28:45Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46785#M9055 just FW and VPN not a single other one <span class="lia-unicode-emoji" title=":slightly_smiling_face:">πŸ™‚</span> it is a ClusterXL A/S mode R80.10 recent take. Wed, 13 Mar 2019 16:30:57 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46785#M9055 Jerry 2019-03-13T16:30:57Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46786#M9056 <P>also see enclosed <span class="lia-unicode-emoji" title=":slightly_smiling_face:">πŸ™‚</span></P> Wed, 13 Mar 2019 16:41:15 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46786#M9056 Jerry 2019-03-13T16:41:15Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46787#M9057 <P>What are the main types of traffic going through this FW? For example, could there be a high amount of VoIP or NAT'd traffic passing through?</P><P>What model Appliance is the GW running on? If you look at <STRONG>netstat -ni&nbsp;</STRONG>do you see a large amount of RX-DRP on any Interfaces?</P><P>&nbsp;</P> Wed, 13 Mar 2019 16:44:24 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46787#M9057 Daniel_Taney 2019-03-13T16:44:24Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46788#M9058 <P>Daniel,</P> <P>&nbsp;</P> <P>1. data rather than voice, no SIP really pass-through though</P> <P>2. appliance 5600 in A/S HA</P> <P>3. see below, although I don't believe that traffic wise there is something wrong I"m rather thinking about the fwaccell itself that some rules malform secureXL processing with fwk_x</P> <P>&nbsp;</P> <P>Kernel Interface table<BR />Iface&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MTU Met&nbsp;&nbsp;&nbsp; RX-OK RX-ERR RX-DRP RX-OVR&nbsp;&nbsp;&nbsp; TX-OK TX-ERR TX-DRP TX-OVR Flg<BR />Mgmt&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1500&nbsp;&nbsp; 0 11494072815&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 24103977662&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />Sync&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1500&nbsp;&nbsp; 0 138483134&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 375625940&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01&nbsp;&nbsp;&nbsp; 1500&nbsp;&nbsp; 0 61789690671&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 48260619502&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 3708121712&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 172286544&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 12412525&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp; 7472255&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 282997295&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 24901857&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 40214932&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp; 3581429&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 27668543605&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 76275452&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 326260080&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 378986686&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 210683847&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp; 4968650&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 17659464745&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 54373736&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0&nbsp; 1824139&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 654386&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 228405787&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 34088098&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 124398097&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 32073865&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 794263868&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp; 3945996&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth1-01.x&nbsp; 1500&nbsp;&nbsp; 0 4759642177&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 236294641&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1500&nbsp;&nbsp; 0 2888482568&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 2453482378&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1500&nbsp;&nbsp; 0 84601735&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 27402403&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />eth8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1500&nbsp;&nbsp; 0 1268296181&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 2475779489&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 BMRU<BR />lo&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 16436&nbsp;&nbsp; 0&nbsp; 5167245&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp; 5167245&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0 LRU</P> Wed, 13 Mar 2019 16:48:45 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46788#M9058 Jerry 2019-03-13T16:48:45Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46789#M9059 btw. no SIM affinity in use <span class="lia-unicode-emoji" title=":slightly_smiling_face:">πŸ™‚</span> no point, it's not VSX. Wed, 13 Mar 2019 16:49:57 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46789#M9059 Jerry 2019-03-13T16:49:57Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46790#M9060 hm, also one more thing to add to the bucket:<BR /><BR />drop-reasons I've got 97% as "monitored spoofed" <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> very weak design though network wise ... cpview rocks! Wed, 13 Mar 2019 16:52:54 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46790#M9060 Jerry 2019-03-13T16:52:54Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46791#M9061 <P>I think that means Anti-Spoofing is set to detect on an Interface. Do you have any Anti-Spoofing events in your fw logs?</P> Wed, 13 Mar 2019 16:56:12 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46791#M9061 Daniel_Taney 2019-03-13T16:56:12Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46795#M9062 <P>Do you have any rule for Microsoft CIFS-Traffic something like the all_dce_rpc service?</P><P>These kind of traffic isnβ€˜t accelerated.</P> Wed, 13 Mar 2019 17:09:33 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46795#M9062 Wolfgang 2019-03-13T17:09:33Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46812#M9067 yes they do have lots of SMB/CIFS but ... so many really? <BR /><BR />ps. that was a quizz btw. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">πŸ™‚</span> Wed, 13 Mar 2019 18:46:46 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46812#M9067 Jerry 2019-03-13T18:46:46Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46826#M9074 <P>You found more informations to PXL here:</P> <P><A href="https://community.checkpoint.com/t5/General-Topics/R80-x-Security-Gateway-Architecture-Logical-Packet-Flow/m-p/41747?collapse_discussion=true&amp;inactive=false&amp;q=logical%20packet&amp;search_type=thread" target="_self">R80.x Security Gateway Architecture (Logical Packet Flow)</A></P> <P><A href="https://community.checkpoint.com/t5/General-Topics/R80-x-Security-Gateway-Architecture-Content-Inspection/td-p/41665" target="_self">R80.x Security Gateway Architecture (Content Inspection)</A></P> Wed, 13 Mar 2019 20:23:41 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46826#M9074 HeikoAnkenbrand 2019-03-13T20:23:41Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46827#M9075 <P>&nbsp;</P> <P>&nbsp;</P> Wed, 13 Mar 2019 20:27:19 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46827#M9075 HeikoAnkenbrand 2019-03-13T20:27:19Z Re: SecureXL PXL ... https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46882#M9092 Cheers Heik0, as usual spot-on <span class="lia-unicode-emoji" title=":slightly_smiling_face:">πŸ™‚</span> Thu, 14 Mar 2019 08:39:11 GMT https://community.checkpoint.com/t5/General-Topics/SecureXL-PXL/m-p/46882#M9092 Jerry 2019-03-14T08:39:11Z