Management General Management Topics Logging and Reporting Multi-Domain Management Policy Management
- Local User Groups
What I notice more and more in the last years is CPAS (Check Point Active Streaming). With increased https, the firewall workers are more and more stressed if https inspection is enabled. Now also CPAS use the SecureXL path in R80.20. CPAS works through the F2F path in R80.10 and R77.30. Now CPASXL is offered in SecureXL path in R80.20. This should lead to a higher performance. "fwaccel stats -s" shows the new path in R80.20. I think PXL was renamed to PSLXL. This is from my point of view the politically correct better term.
Check Point Active Streaming active streaming allow the changing of data and play the role of “man in the middle”. Several protocols uses CPAS, for example: Client Authentication, VoIP (SIP, Skinny/SCCP, H.323, etc.), Data Leak Prevention (DLP) blade, Security Servers processes, etc. I think it's not to be underestimated in tuning.
# fwaccel stats -s
Maybe Check Point can give us more information here.
I had adapt CPASXL and PSLXL to the following article:
thanks for the information, thats an interesting finding. Do you have any idea, what the "F2V" is? Another acceleration path?
I hope that Check Point can add some information here.
Is F2V used for HTTPS inspection as well? I have HTTPS inspection enabled on an R80.20 firewall, but no VPN functions, yet 73% of my packets are hitting F2V:
[Expert@<removed>]# fwaccel stats -s
Accelerated conns/Total conns : 0/6762 (0%)
Accelerated pkts/Total pkts : 136454042/718363754 (18%)
F2Fed pkts/Total pkts : 445455764/718363754 (62%)
F2V pkts/Total pkts : 527371395/718363754 (73%)
CPASXL pkts/Total pkts : 9670829/718363754 (1%)
PSLXL pkts/Total pkts : 126783119/718363754 (17%)
QOS inbound pkts/Total pkts : 0/718363754 (0%)
QOS outbound pkts/Total pkts : 0/718363754 (0%)
Corrected pkts/Total pkts : 0/718363754 (0%)
Not sure how 62% can be F2Fed and 73% be F2V. Must be some sort of overlap, or fuzzy math
F2V is a decryption module in your case. Considering you need to decrypt before making a decision to inspect or not, lower F2F rate makes perfect sense. Some decrypted packages may still be accelerated without any need for further inspection in F2F path
Now you can see in R80.20 the "F2F streaming path" and "medium streaming path" for PSL and CPAS.
# fwaccel stat
I will be a R80.20 fan!
Nice, nice, nice!
I will adapt "inline streaming path" and "medium streaming path" to the following article: