topic Facing Latency/disconnection issue due to mirror traffic on 1200R device in Spark Firewall (SMB)

Facing Latency/disconnection issue due to mirror traffic on 1200R device

Happy__ — Mon, 10 Aug 2020 08:32:26 GMT

Hi Team,

We are facing latency/disconnection issues in the network when we connect the mirror port on the firewall monitored interface.

We created a bridge group between DMZ & LAN3 interfaces on firewalls. We have one monitored interface connected with the switch mirror interface. Due to mirror traffic, we are facing a latency issue, when we connect the mirror port interface on the LAN2 firewall interface the RX of interface increase rapidly and TX of DMZ increases rapidly.

I attached the network topology diagram.

Re: Facing Latency/disconnection issue due to mirror traffic on 1200R device

Happy__ — Mon, 10 Aug 2020 08:33:06 GMT

Re: Facing Latency/disconnection issue due to mirror traffic on 1200R device

PhoneBoy — Fri, 14 Aug 2020 18:29:01 GMT

What blades are active here?

Do you know how much traffic the mirror port is sending to the gateway?

Re: Facing Latency/disconnection issue due to mirror traffic on 1200R device

Happy__ — Wed, 19 Aug 2020 04:05:03 GMT

Only FW blade is enabled, Don't know the exact amount of traffic.

Re: Facing Latency/disconnection issue due to mirror traffic on 1200R device

PhoneBoy — Wed, 19 Aug 2020 04:12:07 GMT

There’s almost no point in using a mirror port with just firewall active.
Also, it’s more difficult to process mirror port traffic, generally speaking.
Might be worth posting the output of the Super Seven commands for SMB: https://community.checkpoint.com/t5/SMB-Appliances-and-SMP/Super-Seven-Performance-Assessment-Commands-SMB-Edition/td-p/73078

Re: Facing Latency/disconnection issue due to mirror traffic on 1200R device

Happy__ — Wed, 19 Aug 2020 04:17:56 GMT

We will use the IPS blade letter once the traffic becomes stable.

Re: Facing Latency/disconnection issue due to mirror traffic on 1200R device

John_Fleming — Thu, 20 Aug 2020 22:08:42 GMT

You have to be very careful with those boxes. The 1200R has a single core and I would think a traffic mirror would send a lot of data through to the CPU to process the traffic. I would also assume this isn't creating a network loop but i can say for sure from past exp that if you plug 2 ports in from a vswitch into the same vlan it will create a loop on the firewall and make the CPU instantly go crazy which then prevents the firewall from doing anything.