Be Your Own TAC Part Deux EMEA: Advanced Gateway Troubleshooting Commands, Video and Slides

[Alex-]

That was an absolutely fantastic session! And yes, I found out an old single gateway with manual session limit still set. 😀

[JaAnd]

Fantastic peace of extremely useful information. I wish I had seen it before I started working with CP 🙂 I am thrilled to attend to next session by Master Hall and Master Dameon.

[the_rock]

Im sure you are NOT the only one lol

[the_rock]

AWESOME!!

[Henrik_Noerr1]

What a professional presentation. I have never experienced Check Point material presented in such a knowledgeable and yet understandable format.

This was a session for professionals from a professional. Stripped of unnecessary slides - going directly to the core.

More of this please, and @CheckPoint - please throw money towards this concept.

Monthly(?) sessions taking on a subject would be awesome, and well needed between all the other more marketing minded webinars, or even technicals that yet fail to really cater to the professionals working with the product.

Thanks,

Henrik

[the_rock]

100% true and true all over. I could not agree more @Henrik_Noerr1 

We need MORE of this.

Andy

[PhoneBoy]

@Timothy_Hall is definitely a professional's professional. 😉

[SherryB]

This was a fantastic session. thank you for all information and please send me if you have more trainings. 

[Gero_Stolle]

Thank you both for the great session.
Unfortunately, I missed the first part last year and couldn't find a link to it...

Sessions like this are great for understanding principles and functionality.
Once you know how things work, you can delve deeper, analyze errors, and fix them 🙂
    ... Yes, that applies to everything you work with and where you get involved yourself.

I look forward to more content like this. Thanks again, very enlightening

[PhoneBoy]

Last year's session: https://community.checkpoint.com/t5/General-Topics/Be-Your-Own-TAC-EMEA-September-2024-Video-Slides-... 
Note that both of these sessions are the basis for a new series of "Troubleshooting 10x" sessions we will be presenting throughout the year.

[the_rock]

Thanks for that!

[Gero_Stolle]

Yeah, 
hey, I really appreciate that, thank you very much 🙂 

[the_rock]

Sent this to a customer today and this guy has been around CP since late 1990s and his exact quote "Andy, this is GOLD"

Enough said 🙂

Andy

[RemoteUser]

The best!!

[the_rock]

The best x 100

[Timothy_Hall]

Here is a new F2F/slowpath reason (shown by fw tab -t connections -z) that was not included in the presentation.  This new reason was recently brought to my attention by an attendee of my Gateway Performance Optimization Course. The following content was added to the course as a result:

• Reason: Post Sync – This indicates the presence of a so-called "partial connection" that exists in the Firewall Worker state table (fw tab -t connections) but does not exist in the SecureXL state table (fwaccel conns). Most commonly, this is a transitory condition caused by a ClusterXL failover, because only the Firewall Worker state table is synchronized between the cluster members (the SecureXL state table is not). It can also be caused by a policy installation in some cases or by manually cycling the running state of SecureXL with the fwaccel off and fwaccel on commands.

  If no packets have yet been received for this partial connection, it exists exclusively in the Firewall Worker state table, and therefore can only be processed in the F2F/slowpath, as SecureXL has no knowledge of it. Once packets are received for this partial connection, SecureXL forwards these unknown packets to the Firewall Worker, who then "re-injects" the connection state information back into the SecureXL state table, and then, if possible, offloads the connection back into the Medium or Fast path. Prior to this re-injection occurring (assuming it ever does), the total number of packets and bytes reported by fw tab -t connections -z for the partial connection will be zero.

[the_rock]

Amazing Tim, thanks for that.

Andy