Part 6 - CLI Tools

_Val_ · ‎2020-06-22

In this article we will explore the actual commands used to examine the current performance state of a gateway; these commands are safe to run during production. For each command, details will be provided about the general purpose of the command, along with an example of sample output. Interpretation of the results for purposes of performance tuning are beyond the scope of the CP4B series.

Command: show version os kernel
Command Mode: clish
Purpose: Display Gaia kernel version
Sample Output Notes: Results for both kernel 2.6.18 and 3.10 are shown below

gw> show version os kernel
OS kernel version 2.6.18-92cpx86_64

gw> show version os kernel
OS kernel version 3.10.0-957.21.3cpx86_64

Command: show bonding groups
Command Mode: clish
Purpose: Display all bonds and associated physical interfaces
Sample Output Notes: One bond present

gw> show bonding groups

Bonding Interface: 20

Bond Configuration
xmit_hash_policy Not configured
down-delay 200
primary Not configured
mode round-robin
up-delay 200
mii-interval 100
lacp_rate Not configured
Bond Interfaces
eth2
eth3

Command: fwaccel stat
Command Mode: expert
Purpose: Display Display current state of SecureXL (it is enabled by default)
Sample Output Notes: SecureXL currently enabled

[Expert@gw]# fwaccel stat

Accept Templates : enabled
Drop Templates : disabled
NAT Templates : enabled

Command: enabled_blades
Command Mode: expert
Purpose: Display current enabled blades/features on the gateway, which tends to dictate levels of packet acceleration
Sample Output Notes: This information can also be accessed through the SmartConsole on the General tab of a security gateway/cluster object.

[Expert@gw]# enabled_blades

fw vpn urlf av aspm appi ips dlp identityServer anti_bot ThreatEmulation qos mon vpn

Command: fwaccel stats -s
Command Mode: expert
Purpose: Display current SecureXL acceleration statistics
Sample Output Notes: “Accelerated conns/Total conns” line indicates the connection Accept Templating rate; the remaining lines detail processing path percentages in this order: SXL (Accelerated pkts/Total pkts), F2F, F2V, CPASXL, PSLXL, QoS inbound/outbound.

[Expert@gw]# fwaccel stats -s

Accelerated conns/Total conns : 1202/33715 (3%)
Accelerated pkts/Total pkts : 21963285170/50752857993 (43%)
F2Fed pkts/Total pkts : 7415368470/50752857993 (14%)
F2V pkts/Total pkts : 777807714/50752857993 (1%)
CPASXL pkts/Total pkts : 3519180973/50752857993 (6%)
PSLXL pkts/Total pkts : 17855023380/50752857993 (35%)
QOS inbound pkts/Total pkts : 0/50752857993 (0%)
QOS outbound pkts/Total pkts : 0/50752857993 (0%)
Corrected pkts/Total pkts : 0/50752857993 (0%)

Commands: cat /proc/smt_status (2.6.18 kernel), lscpu | grep Thread (3.10 kernel)
Command Mode: expert
Purpose: Display state of Symmetric MultiThreading (SMT), enabled or disabled
Sample Output Notes: Different command needed depending on Gaia kernel version

[Expert@gw]# cat /proc/smt_status (2.6.18 kernel)

0 = SMT off
1 = SMT on

[Expert@gw]# lscpu | grep Thread (3.10 kernel)

1 = SMT off
2+ = SMT on

Command: fw ctl affinity -l -r
Command Mode: expert
Purpose: Display current CoreXL split
Sample Output Notes: SMT is disabled, CoreXL split is the default 2/6. CPUs/Cores 0-1 are Secure Network Dispatchers (SNDs), CPUs/Cores 2-7 are Firewall Workers (Firewall Instances):

[Expert@gw]# fw ctl affinity -l -r

CPU 0: eth2-01 eth2-02
CPU 1: Mgmt eth2-03
CPU 2: fw_5
CPU 3: fw_4
CPU 4: fw_3
CPU 5: fw_2
CPU 6: fw_1
CPU 7: fw_0

Sample Output Notes: SMT is enabled, CoreXL split is the default 2/14. CPUs/Cores 0 & 8 are Secure Network Dispatchers (SNDs), CPUs/Cores 1-7 & 9-15 are Firewall Workers (Firewall Instances):

[Expert@gw]# fw ctl affinity -l -r

CPU 0: eth2-01 eth2-02
CPU 1: fw_13
CPU 2: fw_11
CPU 3: fw_9
CPU 4: fw_7
CPU 5: fw_5
CPU 6: fw_3
CPU 7: fw_1
CPU 8: Mgmt eth2-03
CPU 9: fw_12
CPU 10: fw_10
CPU 11: fw_8
CPU 12: fw_6
CPU 13: fw_4
CPU 14: fw_2
CPU 15: fw_0

Command: netstat -ni
Command Mode: expert
Purpose: Display Gaia network interface counters including errors
Sample Output Notes: RX-OK and TX-OK counters indicate total count of successfully received and transmitted Ethernet frames, respectively. Counters circled in red (RX-ERR, RX-OVR, TX-DRP and TX-OVR) should be zero or nearly zero and not actively increasing. RX-DRP should ideally be less than 0.1%, see screenshot below.

Command: fw ctl multik dynamic_dispatching get_mode
Command Mode: expert
Purpose: Display current state of Dynamic Dispatcher (enabled by default in R80.10+)
Sample Output Notes: State is enabled

[Expert@gw]# fw ctl multik dynamic_dispatching get_mode

Current mode is On

Command: fw ctl multik stat
Command Mode: expert
Purpose: Display current and peak number of connections for each firewall worker to verify connections are well-balanced by the Dynamic Dispatcher
Sample Output Notes: Connections are evenly balanced on a system with a 2/6 CoreXL split:

[Expert@gw]# fw ctl multik stat

ID | Active | CPU | Connections | Peak
-------------------------------------------
0 | Yes    | 7   | 3274        | 29085
1 | Yes    | 6   | 2656        | 33469
2 | Yes    | 5   | 2611        | 33813
3 | Yes    | 4   | 3460        | 31557
4 | Yes    | 3   | 3360        | 28837
5 | Yes    | 2   | 2776        | 34874

Command: cpprod_util FwIsUsermode
Command Mode: expert
Purpose: Display current state of User Space Firewall (USFW), which is enabled by default on most new gateway appliances starting in R80.30; see the following SK for the latest updates: sk167052: Check Point User-Space firewall support for R80.30 3.10 and above
Sample Output Notes: N/A

[Expert@gw]# cpprod_util FwIsUsermode

0 = USFW Disabled
1 = USFW Enabled

Command: fw ctl fast_accel show_table
Command Mode: expert
Purpose: Display traffic whitelisted for forced acceleration by SecureXL (not enabled by default)
Sample Output Notes: No whitelisted traffic defined

[Expert@gw]# fw ctl fast_accel show_table

fw fast_accel: There are no rules in the fast_accel table.

About the author

Performance Optimization Series are written for you by Timothy Hall.

Timothy has continuously worked with Check Point products starting in 1997, been an instructor for official Check Point training classes since 2004, and is the author of the book "Max Power 2020: Check Point Firewall Performance Optimization".