Quantum Lightspeed Packet Flow

[HeikoAnkenbrand]

The new Quantum Lightspeed firewalls are much better in performance because they use NVIDIA ASIC's.

Now the question is, how is the packet flow through the NVIDIA interface vs. firewall?
Is SecuerXL already a part of the NVIDIA ASIC's and if so, how does it work technically?

Security Gateway does not support these features when you install a NVIDIA 2-port 100G Card:

- ClusterXL in the Load Sharing mode or Active-Active mode.
- VSX mode
- SecureXL Drop Templates (see sk153832).
- VRRP Cluster.
- Rate Limiting rules for DoS Mitigation configured with the commands 'fwaccel dos deny' and 'fwaccel dos allow' (see sk112454).

These restrictions indicate that the packet flow during acceleration is no longer forwarded to the firewall software (SecureXL or CoreXL) in the case of optimisation but passes directly through the ASIC.

Are there detailed descriptions of the packet flow here?
How is the support for Multi Queueing?
How does the packet flow work ASIC vs. SND?

Nothing is described in the Quantum Lightspeed manuals:
NVIDIA 2-port 100G QSFP28 ConnectX Dual-Width Network Card Administration Guide 
sk176466 - Check Point LightSpeed Appliances  
Check Point LightSpeed Appliances Getting Started Guide
Check Point LightSpeed Appliances Quick Start Guide

[Timothy_Hall]

Yes I'd like to see those answers as well Heiko, and also what processing paths can be completely handled by the NVidia ASICs?  The SXL/Accelerated path is probably a given, but what about the Medium Path (PXL)?  Active Streaming Path (CPAS)?

[HeikoAnkenbrand]

If I have understood correctly, the optimisation only works via the NVidia ASICs if the interface is used on the same network carrier card. Thus, only two interfaces can be used for ASIC acceleration. Traffic over several carrier cards should work as usual.

There are still some unanswered questions here!

[genisis__]

Would I be right is saying only firewall blade is supported...currently?

The one thing that needs to be in ASIC is https inspection.

[Chris_Atkinson]

Correct, today the NVIDIA 2-port 100G Cards support only the Firewall Software Blade on the Security Gateway / Cluster Members per the first link shared by Heiko.

Encryption functions/scenarios are certainly a use case that we're looking at for the next phase.

[HeikoAnkenbrand]

This limits the use somewhat. If we also consider that the following do not work.

Security Gateway does not support these features when you install a NVIDIA 2-port 100G Card:
  -IPv6 traffic (do not enable the IPv6 support in Gaia on the host appliance).
  - ClusterXL in the Load Sharing mode or Active-Active mode.
  - VSX mode.
  - SecureXL Drop Templates (see sk153832).
  - Rate Limiting rules for DoS Mitigation configured with the commands 'fwaccel dos deny' and 'fwaccel dos allow' (see sk112454).
  - Jumbo Frames.
  - NAT64.
  - 802.1Q Tunneling (Q-in-Q).
  - VRRP Cluster.

Bond Interfaces:
  - To create a Bond Interface that accelerates traffic, you must use the physical ports of the same NVIDIA 2-port 100G Card.
  - When you change the state of one physical port in a Bond Interface to down / up, the other physical port in the Bond Interface also changes its state to down / up.

[_Val_]

Documentation is in works, we will provide info later on. Also, a couple of TechTalks are planned for the latests performance features. Till then, please be patient.