Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Leon_Hung
Employee Alumnus
Employee Alumnus
Jump to solution

API performance optimization

When creating new objects, it costs over 10 mins to create around 200 objects.

Is there anyway to improve API performance when creating objects and ploices?

Cheers.

1 Solution

Accepted Solutions
Jim_Oqvist
Employee
Employee

The basic flow of the API is the following

When executing a single command, for example "add host" using the mgmt_cli without calling the login command first. The mgmt_cli executable will in the background preform the following steps. [login] -> [add host using session ID from login] -> [publish] -> [logout].

To control this behavior you can call the login command first, retrieve the session ID, reuse the session ID in all your changes, for example add multiple host objects, publish all your changes at once by reusing the session ID and logout.

If you execute the command mgmt_cli add host with the batch flag [-b] the executable will for example create all 200 hosts in one session and then publish all the changes at the end.

For example by using the batch flag in the executable it took me ~2 minutes with one publish using one command to add 200 hosts on my test machine a R80 management server running in VMware workstation on a Laptop

After publish the hosts are available for the other administrators

View solution in original post

10 Replies
Eugene_Grybinny
Employee Alumnus
Employee Alumnus

Hi Leon,

We will contact you soon to get the details.

0 Kudos
Timothy_Hall
Legend Legend
Legend

I noticed this when bulk-creating objects at a customer site with the R80 mgmt CLI.  Our workaround was to ensure everyone was out of the SmartConsole before starting the bulk object creation from the management CLI.  It ran much faster that way.  I think it has something to do with the fact that a publish occurs after every single object is created, and when multiple administrators are in the SmartConsole it seems to have to stop and wait for the publish to reach all SmartConsoles before moving on to the next object.

--

My book "Max Power: Check Point Firewall Performance Optimization"

now available via http://maxpowerfirewalls.com.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
Jim_Oqvist
Employee
Employee

The basic flow of the API is the following

When executing a single command, for example "add host" using the mgmt_cli without calling the login command first. The mgmt_cli executable will in the background preform the following steps. [login] -> [add host using session ID from login] -> [publish] -> [logout].

To control this behavior you can call the login command first, retrieve the session ID, reuse the session ID in all your changes, for example add multiple host objects, publish all your changes at once by reusing the session ID and logout.

If you execute the command mgmt_cli add host with the batch flag [-b] the executable will for example create all 200 hosts in one session and then publish all the changes at the end.

For example by using the batch flag in the executable it took me ~2 minutes with one publish using one command to add 200 hosts on my test machine a R80 management server running in VMware workstation on a Laptop

After publish the hosts are available for the other administrators

Timothy_Hall
Legend Legend
Legend

I figured there had to be some way to submit a series of transactions from the Management CLI and then publish them all at once (similar to a start...commit in clish) but couldn't figure out how to do it.  Thanks for the clarification.

--

My book "Max Power: Check Point Firewall Performance Optimization"

now available via http://maxpowerfirewalls.com.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
Leon_Hung
Employee Alumnus
Employee Alumnus

Thanks for the clarification.

However, we need to meet the requirement for bulk-installing 5000 objects, within certain time frame.

The result for our lab is 200 objects in 2 minutes.

Do we have recommended number for 5000 objects?

0 Kudos
Leon_Hung
Employee Alumnus
Employee Alumnus

More explanations for my question.

In this project, our competitor can install 5000 objects with 2 minutes through API, because they just rewrite the configuration file.

Do we have similar way to improve API performance?

0 Kudos
Tomer_Sole
Mentor
Mentor

Can your competitor verify that the added objects do not break the policy? Rule Hide Rule? No duplicate IP's? No broken UID references? Generally Check Point chooses reliability over speed. Validating the security configuration is the cause for the time. And we want to assume that adding 5000 new objects is not an every-day case - if it is, perhaps Dynamic Objects might be more suitable.

Let me know your thoughts on this.

Raj_Khatri
Advisor

You may want to follow sk119553 to increase the amount of memory for API depending on your hardware.  By default it is 32-bit with 256MB.  We recently modified to 64-bit with 4GB and performance has improved greatly.

Previously it was very slow for us well at processing.

Robert_Decker
Advisor

Right. The default memory configuration is not enough for big databases.

And for 32-bit env. you may increase to 1GB (max. up to 2GB).

0 Kudos
Antonio_Costa
Participant

Hi,

  Can I restrict a user to NOT be able to use detail-level "full" ?

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events