topic Re: ipsec latency smb1570 in Spark Firewall (SMB)

ipsec latency smb1570

Thowtes — Thu, 13 Apr 2023 19:27:09 GMT

Hello,

i have a problem (probably) with high latency over IPSec (Site2Site) between SMB1570 (remote) and Mikrotik RB1100 (central).

When i try to add esxi host on remote site to vcenter on central branch, it always fails. Only host behind SMB1570 have this issue, so i think it is related to Checkpoint and/or this IPSec.

I tried some configurations with MTU, but no success.

Any idea, please?

Thank you.

Re: ipsec latency smb1570

PhoneBoy — Fri, 14 Apr 2023 00:48:51 GMT

It's most likely an MTU/fragmentation issue.
For a discussion of this topic in general, see: https://support.checkpoint.com/results/sk/sk98074
To confirm the issue, I recommend taking some packet captures.

If your SMB appliance is locally managed (i.e. without SmartCenter), not sure it is possible to configure MSS Clamping, which is probably how you'd resolve this.
Recommend engaging with the TAC: https://help.checkpoint.com

Re: ipsec latency smb1570

Chris_Atkinson — Fri, 14 Apr 2023 00:55:46 GMT

As @PhoneBoy suggests you're probably looking at something like the following:

sk121114: "Fragmentation needed" error on dropped packets sent through tunnel on Quantum Spark Appliances (checkpoint.com)

Re: ipsec latency smb1570

Thowtes — Fri, 14 Apr 2023 06:27:58 GMT

Thank you,

but i found first issue on 2nd step - no .conf file in dir:

[Expert@fw]# cp -v $FWDIR/modules/fwkern.conf{,_BKP} cp: can't stat '/opt/fw1/modules/fwkern.conf': No such file or directory [Expert@fw]# pwd /opt/fw1/modules [Expert@fw]# ls -la drwxr-xr-x 2 root root 4096 Feb 23 14:19 . drwxr-xr-x 3 root root 4096 Feb 23 14:19 .. -rw-r--r-- 1 105 80 500440 Nov 22 09:58 adp.o -rw-r--r-- 1 105 80 49280288 Nov 22 09:58 fw.o -rw-r--r-- 1 105 80 46326416 Nov 22 09:58 fwv6.o -rw-r--r-- 1 105 80 13251656 Nov 22 09:58 sim.o -rw-r--r-- 1 105 80 13049208 Nov 22 09:58 simv6.o -rw-r--r-- 1 105 80 25984 Nov 22 09:58 vpnt.o

Running version:

The current firmware version is R81.10 (996000575)

I've found also this cmd in some topic, but not working:

[Expert@fw]# fw ctl get int fw_clamp_tcp_mss fw_clamp_tcp_mss = 0 [Expert@fw]# fw ctl set int fw_clamp_tcp_mss 1 Set operation failed: failed to get parameter fw_clamp_tcp_mss

Thank you for help.

Re: ipsec latency smb1570

PhoneBoy — Fri, 14 Apr 2023 14:46:12 GMT

Sounds like fw_clamp_tcp_mss can not be set "on the fly" meaning the only way is by specifying it in fwkern.conf.
If this file does not exist, it must be created.