Clarification Needed on fwaccel stat

[RemoteUser]

Hi,
What does this indicate? It's not very clear to me do we need to make any changes?
Thanks a lot!

Accept Templates : disabled by Firewall
Layer Policy Security disables template offloads from rule #xxxx
Throughput acceleration still enabled.
Drop Templates : disabled
NAT Templates : disabled by Firewall
Layer Policy Security disables template offloads from rule #xxxx
Throughput acceleration still enabled.
LightSpeed Accel : disabled

[G_W_Albrecht]

Did you read sk32578: SecureXL Mechanism ?

[RemoteUser]

Hi 
Yes, but what is mean disables template offloads from rule #xxxx?
It's affects something or not?

[Lesley]

Remove rule #xxxx if it is not needed, or move it all the way down in rulebase.

Most of the time rule contains traceroute or ALL_DCE_RPC ports for Windows

Show the relevant rule. After this rule no performance optimization. All rules below #xxxx

[the_rock]

I would say if anyone on this planet can explain this perfectly, its  @Timothy_Hall 

Andy

[Timothy_Hall · Accepted solution]

@RemoteUser even if fwaccel stat reports "Accept templates: enabled",  the "Accelerated conns/Total conns" part of fwaccel stats -s may always report zero, and fwaccel templates -s may perennially report zero as well.  This can be diagnosed with the fwaccel templates -R option added in R81.20, which will report a high percentage of "Prevented by Policy rules". 

This situation is not the end of the world, and simply means that for the start of every new connection, a full rulebase lookup against the Firewall blade will always be required in the F2F/slowpath, with no accept template formation or matching possible.  This is generally caused by at least one of the following situations being present:

1) In your first layer (ordered mode), or top/parent layer (non-sub-rules for inline mode), you have any blade other than Firewall enabled.   If you do this the templating rate will always be zero, as enabling any other blades in that top/first layer makes matching against entities other than IP addresses and port numbers possible, which accept templating cannot handle.

2) Use of services in a rule with "Protocol Signature" set in their Advanced Properties; this option is never enabled by default.  Utilization of these services in the policy will need to invoke Medium Path streaming to complete that first rulebase lookup for a new connection, which causes dramatically more CPU overhead and is wholly incompatible with the use of accept templates.

[Chris_Atkinson]

What is the rule# relative to the policy size?

Commonly this would be due to a specific objects like DCOM, RPC, DCE, snmp-readonly, rip-response which are optimally put lower in the rule base but other potential reasons are documented in sk32578.

You can move the rule lower down or remove offending object to improve templating.

[RemoteUser]

this is the rule, maybe this service it's the root cause:

[RemoteUser]

What happens to the rules that come after this one? This is what I want to understand?

[the_rock]

Hey bro,

Make sure this is enabled (what I attached)

Andy

[RemoteUser]

That's in my cluster it's not enable..
What is the purpose of this?

[the_rock]

• Firewall Policy Optimization

  Enable or disable firewall drop optimization to improve gateway resource consumption during periods of heavy traffic load. Let SecureXL handle traffic that the firewall policy determines should be dropped.

  Not enabling this option means that only Allowed connections are off loaded to SecureXL, leaving the gateway to handle connections that should be dropped or rejected. For more, see:

  • sk90861
  • sk90941

[RemoteUser]

so nowadays it would always seem better to enable it....
thanks a lot

[the_rock]

Yes, I would, 100%

[the_rock]

Also, can you send output of below?

Andy

[Expert@R82:0]# fwaccel templates
The templates table is empty
[Expert@R82:0]# fwaccel templates -s

Total number of templates: 0
[Expert@R82:0]#

[_Val_]

The main outcome is that your policy has a rule with one of the SecureXL limitations affecting acceleration with templates. Below that rule, templates will not be applied. Depending on how many rules are in your rulebase and how high that limiting rule is placed in your policy, it may negatively affect the performance of your GW. From reading the discussion, I see that the DCE-RPC service is most probably the root cause.

The recommendation is to see if you can remove or edit this rule to overcome the limitation (for example, change DCE to ANY)  or push it as deep as possible in your rulebase. 

[RemoteUser]

I put in disable the rule affected.
I have one question... If under the rule affected i have a lot vpn s2s, it's possible that those rule may be affected or not?

[_Val_ · Accepted solution]

After disabling the rule and re-installing the policy, check fwaccel stat again to see if there is any other issue with templates. 

[RemoteUser]

After disabling the rule, now it's semmes ok

[_Val_]

Now, you get your answer 🙂

[the_rock]

Great job bro!

Andy