- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Hi All,
It owuuld be great help if you can help me in providing a document which will give me in detail information of multi core vpn in r80.X.
Different vpn types and on different cores.
Regards,
shavat Zalpuri
@Tal_Paz-Fridman gave you the authoritative SK articles for the multicore IPSec VPN feature, and below is an excerpt about it from my Max Power book. Generally the only direct way you'd even suspect multicore VPN was active would be when taking a capture with fw monitor which would show the new e & E capture points as originally discussed here: https://community.checkpoint.com/t5/Logging-and-Reporting/fw-monitor-inspection-point-e-or-E/m-p/128...
R80.10: MultiCore IPSec VPN & Route-based VPNs
While the vast majority of network connections can be efficiently balanced across the
available Firewall Worker cores (Run the fw ctl multik stat command and look at
the Connections column to see this in action), there is one glaring exception on R77.30
gateway and earlier: IPSec VPN handling. By default on R77.30, all IPSec-based and
SSL VPN-based encryption and decryption can only take place on the lowest-numbered
Firewall Worker core ( fw_0 ).
I’m pleased to report though that the single-core IPSec VPN limitation in R77.30
gateway has at long last been resolved in R80.10+. IPSec VPN traffic is now balanced
across all Firewall Worker cores by default on R80.10+ gateway. The commands vpn
tu tlist and vpn tu mstats can be used to monitor the state of this new capability.
While it is technically possible to switch off this MultiCore IPSec feature by setting the
kernel variable enable_ipsec_multi_core to zero on R80.10+, doing so is not
supported as explicitly stated here: sk118097: MultiCore Support for IPsec VPN in
R80.10 and above.
You can use the following SKs
Advanced Technical Reference Guide: VPN Core
HTH
Tal
@Tal_Paz-Fridman gave you the authoritative SK articles for the multicore IPSec VPN feature, and below is an excerpt about it from my Max Power book. Generally the only direct way you'd even suspect multicore VPN was active would be when taking a capture with fw monitor which would show the new e & E capture points as originally discussed here: https://community.checkpoint.com/t5/Logging-and-Reporting/fw-monitor-inspection-point-e-or-E/m-p/128...
R80.10: MultiCore IPSec VPN & Route-based VPNs
While the vast majority of network connections can be efficiently balanced across the
available Firewall Worker cores (Run the fw ctl multik stat command and look at
the Connections column to see this in action), there is one glaring exception on R77.30
gateway and earlier: IPSec VPN handling. By default on R77.30, all IPSec-based and
SSL VPN-based encryption and decryption can only take place on the lowest-numbered
Firewall Worker core ( fw_0 ).
I’m pleased to report though that the single-core IPSec VPN limitation in R77.30
gateway has at long last been resolved in R80.10+. IPSec VPN traffic is now balanced
across all Firewall Worker cores by default on R80.10+ gateway. The commands vpn
tu tlist and vpn tu mstats can be used to monitor the state of this new capability.
While it is technically possible to switch off this MultiCore IPSec feature by setting the
kernel variable enable_ipsec_multi_core to zero on R80.10+, doing so is not
supported as explicitly stated here: sk118097: MultiCore Support for IPsec VPN in
R80.10 and above.
SK article content is copyrighted and cannot be posted here or sent privately. Please contact your Check Point SE to determine your support status and they should be able to help you.
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY