Re: Questions about User Mode and Kernel Mode

jslimma_soloiro

Hello everyone,

I have a question about which mode the cluster is working in. I will share my scenario with you.

My environment has a VSX (VSLS) cluster with 2 (two) VSs. I am on version R81.20 JHF 92. My appliance model is 9400 with 20 CPUs. My main VS has 14 dedicated CPU cores.

I am facing a performance problem in this main VS, where we have peaks of ~80% CPU and in some cases there is low network performance.

I was checking the acceleration section and came across the following information in cpview:

UPPAK Status Off (!)

I checked the SecureXL status and it shows the following information:

* WARNING: (null).
* Disabled at: Tue Feb 25 08:41:35 2025
*Refer to sk179432 for more information.

Accept Templates : enabled
Drop Templates : enabled
NAT Templates : enabled
LightSpeed Accel : disabled

[Expert@fw1]#

I noticed that the SecureXL operating mode is "Kernel Mode".

I checked the firewall CLI to make sure which mode is active and I saw that it was User Mode.

[Expert@fw1]# cpprod_util FwIsUsermode
1

1 = User Mode Firewall
0 = Kernel Mode Firewall

I also ran the fwaccel stat command on vs 0 and it showed the following information:

* WARNING: SecureXL User Space Mode was disabled. Reason: .
* Disabled at: Tue Feb 25 08:41:35 2025
*Refer to sk179432 for more information.

Accept Templates : enabled
Drop Templates : disabled
NAT Templates : enabled

The result above informs that User Space mode has been disabled but does not explain why.

I would like your help to better understand this information.

Timothy_Hall

I believe this is because you have a feature enabled that UPPAK does not support (sk179432 and sk32578 section 4) or the usim daemon has crashed repeatedly. Anything in these directories?

/var/log/dump/usermode/usim*
/var/log/usim_crash/crash_list

Attend my Gateway Performance Optimization R81.20 course
CET (Europe) Timezone Course Scheduled for July 1-2

jslimma_soloiro

Hi @Timothy_Hall

I took a look at the two SKs you sent and did not identify any incompatibility with the enabled features. All the functions active in the gateway are supported.

Regarding the directories, I did not find any information:

ls -lha /var/log/dump/usermode/usim*
ls: cannot access /var/log/dump/usermode/usim*: No such file or directory

ls -lha /var/log/usim_crash/crash_list
ls: cannot access /var/log/usim_crash/crash_list: No such file or directory

Do you have any other suggestions to consider?

Timothy_Hall

Strange that it is not reporting the reason UPPAK is disabled, does the date it was disabled roughly correlate with when the system was first booted up? Curious to know if it disabled UPPAK around boot time (which I would assume means an incompatible feature was detected) or if UPPAK was enabled originally then got disabled (which could be due to instability).

Anything interesting in /var/log/usim_x86.elg, /var/log/messages, or $FWDIR/log/fwk.elg around the time it was reported as disabled?

Attend my Gateway Performance Optimization R81.20 course
CET (Europe) Timezone Course Scheduled for July 1-2

jslimma_soloiro

Strange that it's not reporting the reason UPPAK is disabled, does the date it was disabled roughly correlate to when the system was first booted? Curious if it disabled UPPAK close to the time of boot (which I assume means an incompatible feature was detected) or if UPPAK was originally enabled and then disabled (which could be due to instability).

Anything interesting in /var/log/usim_x86.elg, /var/log/messages or $FWDIR/log/fwk.elg around the time it was reported as disabled?

Hi @Timothy_Hall

I've attached a printout of the /var/log/usim_x86.elg and $FWDIR/log/fwk.elg files. At the end of the /var/log/usim_x86.elg file there seems to be some memory issue.

Timothy_Hall

Hmm not sure those log files are useful, there is little documentation for the guts of UPPAK right now and you must have a Quantum Force or Lightspeed appliance to enable UPPAK (can't do it in VMware) so looks like it is time to get in touch with TAC. Hopefully showing them this thread will help speed things along.

Attend my Gateway Performance Optimization R81.20 course
CET (Europe) Timezone Course Scheduled for July 1-2

jslimma_soloiro

I have opened a ticket with TAC and now i´m just waiting for a feedback.

Chris_Atkinson

Just to clarify a point you'll see a table at the end of sk167052

KPPAK/UPPAK are different things from KSFW/USFW.

CCSM R77/R80/ELITE

jslimma_soloiro

Ok @Chris_Atkinson

I understand that it´s different and now i´m waiting for a feedback from TAC.

Thanks

PhoneBoy

USFW effectively moves the firewall workers to userspace.
While we introduced USFW in the R80.x timeframe, it's been used for VSX since R75.40.
It's not the issue here.

UPPAK moves SecureXL itself into userspace.
For a detailed discussion, listen here: https://community.checkpoint.com/t5/CheckMates-Go-Cyber-Security/S07E03-What-is-UPPAK/ba-p/245115/ju...
While it is expected to be the default mode/supported everywhere in upcoming versions, it is not supported everywhere in all situations currently.
Please review this SK for details: https://support.checkpoint.com/results/sk/sk32578

Are you a member of CheckMates?

Questions about User Mode and Kernel Mode