topic Re: SecureXL NAT Template on SMB (1100) gateway in Spark Firewall (SMB)

SecureXL NAT Template on SMB (1100) gateway

listtc — Fri, 28 Feb 2020 12:06:51 GMT

So on a small single core gateway (1130) I have SecureXL running for what its worth but the NAT Template is disabled.

Is it worth turning it on?

Is it worth running SecureXL at all?

Re: SecureXL NAT Template on SMB (1100) gateway

G_W_Albrecht — Fri, 28 Feb 2020 12:18:30 GMT

Usually, you do not use Hide NAT or Static NAT with need of a high session rate on 1100 appliances ! So NAT templates are not necessary. Running SecureXL, on the other hand, can be very valuable - but the performance gain also depends much on the used traffic mix.

Re: SecureXL NAT Template on SMB (1100) gateway

listtc — Fri, 28 Feb 2020 13:00:12 GMT

I have 2 of the 1100s both supporting 20 user offices with general internet behind Hide NAT.
Typically under 3000 connections.
Just trying to do best optimisation for this units until I can replace them

Re: SecureXL NAT Template on SMB (1100) gateway

G_W_Albrecht — Fri, 28 Feb 2020 13:12:41 GMT

I would advise to stay away from NAT templates as long as there are no traffic issues - i would not think that it could gain perceptible performance gains, but when in strong need, it could be tested. With 1100s, you usually just keep SecureXL on and forget all optimization...

Re: SecureXL NAT Template on SMB (1100) gateway

PhoneBoy — Fri, 28 Feb 2020 16:57:35 GMT

Other than avoiding services that can't be accelerated by SecureXL (especially when centrally managed), there's not much in the way of performance optimization you can do on the SMB appliances.

Re: SecureXL NAT Template on SMB (1100) gateway

HristoGrigorov — Fri, 28 Feb 2020 17:32:37 GMT

On a contrary, when centrally managed there are few tricks to optimize SecureXL, especially when HTTPS-I is involved. I managed to optimize SecureXL so much that the load dropped like in half now. What I did was to very carefully read Timothy Hall's posts here about it and then do a little bit of experimentation. 😀 I may write about my finding next week if I have the time...

Re: SecureXL NAT Template on SMB (1100) gateway

listtc — Fri, 28 Feb 2020 18:07:40 GMT

I'm reading Tim Hall's book avidly and going through the whole estate from 13500s to 1130s.
the 1100 need to be retied but in the meantime....

Re: SecureXL NAT Template on SMB (1100) gateway

HristoGrigorov — Fri, 28 Feb 2020 18:17:04 GMT

Yeah, Tim's book is like the holy bible of CheckPoint firewalls. Don't dare to call yourself CPFW admin if you've never read it. 😁

Re: SecureXL NAT Template on SMB (1100) gateway

PhoneBoy — Fri, 28 Feb 2020 18:43:46 GMT

You can still do some level of performance troubleshooting.
I did take Tim's commands and make an SMB version here: https://community.checkpoint.com/t5/SMB-Appliances-and-SMP/Super-Seven-Performance-Assessment-Commands-SMB-Edition/m-p/73078

You certainly can't change the core split because there's not enough cores for that.
And certainly a lot of the stuff unrelated to Check Point is also relevant.

In any case, I'd love to see what you came up with in general.
I'm sure folks would benefit from it, and maybe Tim could borrow a few notes for the next version(s) of his book. 😁