SecureXL User Space Mode (UPPAK) and BFD

[Jones]

I got this message today when configuring my 9700 appliances:

RTGRTG0019  SecureXL is in User Space mode, BFD is not supported. Consult SK179432 for more details.

I'm running R81.20 on JHF99.

When will BFD be supported in SecureXL User Space?

[Chris_Atkinson]

In latest JHFs I believe it is possible to activate it if you start in KPPAK mode then move to UPPAK.

Please clarify further with TAC as needed.

[Jones]

If this is supported by Check Point I'll give it a try.

[Chris_Atkinson]

You can seek an official statement of support from TAC.

Believe the blocking error will be removed in a future JHF per PRJ-60023

[Jones]

It's working now indeed. I'll contact support about this. Thank you Chris.

[Timothy_Hall]

Was not aware of this particular UPPAK limitation, thanks for bringing it to the attention of the community.

[Chris_Atkinson]

From a documentation perspective it's only outlined here currently for awareness:

https://sc1.checkpoint.com/documents/Appliances/100G_Ports_AdminGuide/Content/Topics-100G-Card-AG/Kn...

[Timothy_Hall]

Yes but the UPPAK limitations are also separately described in Section 4 of sk32578: SecureXL Mechanism.  These two lists do not always seem to contain the same information which I found quite confusing while preparing my "Be your Own TAC Part Deux" presentation.  It would be nice if these two lists could be unified into a single authoritative source.

[Chris_Atkinson]

Agreed, I already requested the SK referenced in the error above be updated.

[lolith]

Hello,

Even on latest JHF_take 99, you cannot switch back to UPPAK when using BFD. We were hit with this- sk183181

and we change the secureXL to KPPAK and in between had to configure BFD. But now since sk183181 is released, thought the issue is fixed and could change it back to UPPAK, but BFD config dont allow it back. Does anyone know how can we remove the config for BFD from gaia clish:
"set ip-reachability-detection bfd detect-multiplier 3", i tried different keywords, but nothing works.

Any suggestion is greatly appreciated.

Regards,

Lolith

[Chris_Atkinson]

Your order of operations is a little unclear. Note the process above was starting with T99 not some previous configuration.

Did you try the "default" key word with that command or setting the value to 10?

If the problem persists please contact TAC for assistance.

[lolith]

Hello Chris,

What I meant to say, due to this bug under sk183181, we have to change it to KPPAK to stablise our environment when we were on JHF_98. Then in between we enabled BFD. Now since take 99 was released, we were hoping to change it back to UPPAK, but it won't allow us to change it to UPPAK when this BFD config is present. 

I will give it a shot with default. But still the BFD won't be supported in UPPAK mode as per design I believe.

Regards,

Lolith

[Chris_Atkinson]

This limitation will be formally removed in the near future, this thread described a work around in the interim.

[Chris_Atkinson · Accepted solution]

Now solved - PRJ-60023 in JHF T101 for R81.20