CPAC-4-10/25F-D driver used?

[dj0Nz]

Good morning Mates,

does anyone of you know which driver runs the CPAC-4-10/25F-D (non-accelerated) line card and if it fully supports RSS?
Thank you.

Regards,
Michael

[jorgeluiznim · Accepted solution]

Hi @dj0Nz ,

I don't have an authoritative FRU-to-driver mapping for that specific card to quote you, so I won't guess at the driver name. But this is quick to pin down on the box, and there's a nuance on the RSS side that's probably the more important half of your question.

Confirming the driver:

ethtool -i <interface>          # driver name + version + firmware
lspci -nn | grep -i ethernet    # actual controller/chipset behind it

ethtool -i gives you the definitive answer in one line, and lspci -nn tells you the underlying silicon (useful because the same Check Point part number can front different controllers across appliance generations).

On the RSS question — this is where it gets interesting. On Gaia, RSS is delivered through Multi-Queue, and the Performance Tuning Administration Guide documents the supported drivers with their maximum RX queues:

Driver Max RX queues

igb	2–16 (varies by model)
ixgbe	16
i40e	64
i40evf	4
mlx5_core	60
ena / virtio_net / vmxnet3	auto-configured

Worth noting: ice and bnxt do not appear in that documented list. So if ethtool -i comes back with ice (plausible for a 25G Intel E810-based card), the honest answer to "does it fully support RSS" is that it isn't in the documented Multi-Queue support matrix for that guide version — which is exactly the kind of thing worth confirming with TAC or your SE before you size anything around it. If it comes back i40e or mlx5_core, you're on documented ground with the queue maximums above.

Checking what's actually active:

mq_mng --show -v                # Check Point Multi-Queue state per interface
ethtool -l <interface>          # pre-set max vs. current combined/RX queues
ethtool -x <interface>          # RSS indirection table
fw ctl affinity -l -r -v        # how queues map to CPU cores

Since R81, Multi-Queue is enabled by default on all supported interfaces — so mq_mng --show -v is effectively your yes/no: if the interface shows up with queues, the driver is being treated as supported; if it's absent or shows a single queue, that tells you the answer regardless of what the datasheet implies.

One thing that would help anyone answering more precisely: which appliance model and Gaia version are you on? The card is listed for the 9000/19000/29000 series, and the supported-driver matrix does shift between versions, so both matter here.

References: Performance Tuning Administration Guide (Multi-Queue Requirements and Limitations) and the Check Point Line Cards documentation.

Hope this helps!

Best regards,
Jorge Dias Junior

[Bob_Zimmerman · Accepted solution]

It's an E810 running net_ice.

[Expert@SomeFirewall]# fw ver
This is Check Point's software version R82 - Build 026

[Expert@SomeFirewall]# cpinfo -y fw1 2>&1 | grep HOTFIX_R82_JUMBO_HF_MAIN
	HOTFIX_R82_JUMBO_HF_MAIN	Take:  107

[Expert@SomeFirewall]# clish -c "show asset network"
Number of line cards: 3
Line card 1 model: CPAC-8-1/10F-D
Line card 1 type: 8 ports 1/10GbE Fiber Rev 1.0
Line card 3 model: CPAC-4-10/25F-D
Line card 3 type: 4 ports 10/25GbE Fiber Rev 1.0
Line card 4 model: CPAC-8-1/10F-D
Line card 4 type: 8 ports 1/10GbE Fiber Rev 1.0
 
[Expert@SomeFirewall]# ethtool -i eth3-01
driver: net_ice
version: DPDK 20.11.7.4.0 (11 Jun 25)
firmware-version: 4.30 0x8001b94f 1.3415.0
expansion-rom-version: 
bus-info: 0000:b1:00.1
supports-statistics: yes
supports-test: no
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: yes

[Expert@SomeFirewall]# lspci -nn -s "$(ethtool -i eth3-01 | grep bus-info | cut -d' ' -f2)"
b1:00.1 Ethernet controller [0200]: Intel Corporation Device [8086:1593] (rev 02)

[Expert@SomeFirewall]# mq_mng --show -v
Total 80 cores. Available for MQ 32 cores: Dynamic-Balancing enabled: 0,40,1,41,2,42,3,43,4,44,20,60,21,61,22,62,23,63,24,64,5,45,25,65,6,46,26,66,7,47,27,67
i/f             driver          driver mode     state           mode (queues)   cores           
                                                                actual/avail                    
------------------------------------------------------------------------------------------------
Mgmt            net_ixgbe       DPDK            Up              Dynamic (16/32) 0,40,1,41,2,42,3,43,4,
                                                                                44,20,60,21,61,22,62
Sync            net_i40e        DPDK            Up              Dynamic (16/32) 0,40,1,41,2,42,3,43,4,
                                                                                44,20,60,21,61,22,62
eth3-01         net_ice         DPDK            Up              Dynamic (16/32) 0,40,1,41,2,42,3,43,4,
                                                                                44,20,60,21,61,22,62
eth3-02         net_ice         DPDK            Up              Dynamic (16/32) 0,40,1,41,2,42,3,43,4,
                                                                                44,20,60,21,61,22,62
eth3-03         net_ice         DPDK            Up              Dynamic (16/32) 0,40,1,41,2,42,3,43,4,
                                                                                44,20,60,21,61,22,62
eth3-04         net_ice         DPDK            Up              Dynamic (16/32) 0,40,1,41,2,42,3,43,4,
                                                                                44,20,60,21,61,22,62
...

[Expert@SomeFirewall]# ethtool --show-channels eth3-01
Channel parameters for eth3-01:
Pre-set maximums:
RX:		0
TX:		0
Other:		0
Combined:	0
Current hardware settings:
RX:		0
TX:		0
Other:		0
Combined:	0

[Expert@SomeFirewall]# ethtool --show-rxfh-indir eth3-01
RX flow hash indirection table for eth3-01 with 32 RX ring(s):
    0:      0     0     0     0     0     0     0     0
    8:      0     0     0     0     0     0     0     0
...
RSS hash key:
c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b:c2:2b
RSS hash function:
    Operation not supported

[Expert@SomeFirewall]# fw ctl affinity -l -r -v | grep eth3-01
Interface eth3-01: is in user mode

[dj0Nz]

Hi,

thank you very much, both of you. Based on your information, I decided to go for the CPAC-8-1/10F-D which uses the i40e driver and RSS support is documented. Background: I'm designing a setup where the customer will use multiple GRE tunnels with ECMP-balanced traffic at up to 4 Gbps line rate, so RSS (and R82.10 of course) might be important.

Your input helped a lot, thank you, again. 😄