topic Re: Fast Accel is not working in QS 1800 in Spark Firewall (SMB)

Fast Accel is not working in QS 1800

JDCasCruz — Thu, 18 Jul 2024 14:25:50 GMT

Hello team,

We are trying to use the Secure XL Fast Accel feature on our 1800 Gateways. For this we followed sk156672, enabled the feature and created a general rule to speed up user traffic to the proxy, installed the policies and nothing happened with the hit count after a few days (attached image).

Can someone help us to know what is wrong?

We're wotking with a Cluster XL with two 1800 in high availability, the OS version is R81.10.10 945. We work only with the FW blade.

Regards.

Re: Fast Accel is not working in QS 1800

G_W_Albrecht — Thu, 18 Jul 2024 14:55:43 GMT

Afaik this is not a GAiA Embedded feature, here we only have Smart Accel:

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/Smart-Accel.htm?Highlight=Smart%20Accel

https://sc1.checkpoint.com/documents/SMB_R81.10.X/CLI/EN/Content/Topics/Configuring-Smart-Accel-Settings.htm?TocPath=Configuring%20Smart%20Accel%20Settings%7C_____0

...and only on locally managed SMBs. As sk156672 does not cover any SMB firmware versions, there is a reason to assume that.

Re: Fast Accel is not working in QS 1800

Timothy_Hall — Thu, 18 Jul 2024 16:26:47 GMT

Also bear in mind that if the traffic has to go F2F/slowpath for some reason, fast-accel will not work. Only Medium Path (passive & active streaming) can be forced into the fastpath with fast-accel. On R81+ standard gateways you can use the command fw tab -u -t connections -z to see what connections are F2F/slowpath and the reason they are being handled there; not sure if this command works on SMB or what the equivalent command would be.

Re: Fast Accel is not working in QS 1800

PhoneBoy — Thu, 18 Jul 2024 16:52:32 GMT

The sk does not explicitly mention if fast_accel is supported on Quantum Spark or not.
@Amir_Ayalon ?

Re: Fast Accel is not working in QS 1800

Amir_Ayalon — Thu, 18 Jul 2024 17:41:46 GMT

Hi Guys

Fast Accel suppose to be supported on Spark.

See screenshot for configuration on locally managed.

on centrally managed it is also suppose to work. if it doesn't please open a Task and we will look into it

thanks

Re: Fast Accel is not working in QS 1800

JDCasCruz — Thu, 18 Jul 2024 17:51:05 GMT

The command works, I am getting a quite reasonable output, where the connections from users to the proxy look like this:

localhost:
Dir Source IP SPort Destination IP DPort PR FW State
--- --------------- ----- --------------- ----- -- ---------------
1 userIP 55923 ProxyIP 8080 6 Link

And also by executing the command “fwaccel conns” I can see the connections from users to the proxy.

Re: Fast Accel is not working in QS 1800

JDCasCruz — Thu, 18 Jul 2024 18:02:55 GMT

This would be bad, but could it be confirmed somehow?

Re: Fast Accel is not working in QS 1800

G_W_Albrecht — Fri, 19 Jul 2024 09:06:28 GMT

Look into https://sc1.checkpoint.com/documents/SMB_R81.10.X/CLI/EN/Content/Topics/Configuring-Smart-Accel-Settings.htm?TocPath=Configuring%20Smart%20Accel%20Settings%7C_____0 for configuration of Smart Accel.

And that is what it is - you can always open an informational SR# with CP TAC, if you need official confirmation, but:

- sk156672 only mentions GAiA systems, not GAiA Embedded

- Smart and Fast Accel on SMB would rather be a kind of overkill, a second Accel function does not make sense, especially on SMB....

Re: Fast Accel is not working in QS 1800

JDCasCruz — Fri, 23 Aug 2024 15:51:36 GMT

Hello,

I did not remember to mention that the cluster is centrally managed and Smart Accel has this note:

Note - This setting only applies to locally managed devices.

So I'm stuck again. Are there any best practice guidelines for improving SMB performance?

Thanks in advance.

Re: Fast Accel is not working in QS 1800

Timothy_Hall — Fri, 23 Aug 2024 16:50:17 GMT

Yep:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/Brief-introduction-to-SMB-performance-tuning/m-p/76780#M3131

Re: Fast Accel is not working in QS 1800

PhoneBoy — Fri, 23 Aug 2024 17:19:14 GMT

fast_accel can certainly be used to accelerate trusted flows (ensure it is processed in fastpath, not medium path).
It looks like you can manually tune the number of CoreXL instances: https://support.checkpoint.com/results/sk/sk174423
If the issue with load is with SND processes, then reducing the number of CoreXL instances might help.