R80.40 - Dynamic split of CoreXL

[HeikoAnkenbrand]

What is new in R80.40 EA.

A new interesting function for performance tuning has been included in R80.40. Dynamic split of CoreXL changes the assignment of  CoreXL SND's and CoreXL firewall workers automatically without reboot.

How does this magic happens?

• Adding and removing a CoreXL firewall worker
• Adding and removing a CoreXL SND
• Balance between CoreXL SND and CoreXL firewall worker
• Work in ClusterXL environments
• A reboot is not necessary
  

Pre-requisites:

• GAIA 3.10 kernel (USFW/Kernel
• only Check Point appliances with 8 cores or more
• VSX is currently a limitation
• currently supported on ClusterXL HA
• currently VSLS is a limitation

How does it work?

Suppose we have two SND's and 6 CoreXL firewall workers. If no CoreXL SND's and CoreXL firewall workers are overloaded, nothing happens (picture 1).

Now, let's assume the CoreXL SNDs are overloaded (picture 2), a mathematical formula is used to calculate that a further CoreXL SND is added. In this case a CoreXL firewall worker 5 will not get any new connections (picture 3) and the connections are distributed to another CoreXL firewall worker for example to the CoreXL firewall worker 4. If there are no more connections running through this CoreXL firewall worker on core two, the core will be used for a new CoreXL SND instance (picture 4) . Now our appliance has three SND's and 5 CoreXL firewall workers.

It also works the other way round.

Picture 1 - nothing overloaded


Picture 2 - SND's overloaded

Picture 3 - CoreXL firewall worker stops the processing and distributes the connections.

Picture 4 - new SND is added

CLI Commands

In ClusterXL, you must configure all the Cluster Members in the same way. The dynamic_split command controls the Dynamic Split of CoreXL Firewall and SND instances on the local Security Gateway, or ClusterXL Member.

For more information, see R80.40 Performance Tuning Administration Guide - Chapter CoreXL.

Run these commands in the Expert mode

# dynamic_split

                            -o disable                 -> Disables the CoreXL Dynamic Split. Requires a reboot.
                            -o enable                  -> Enables the CoreXL Dynamic Split. Requires a reboot
                            -o start                      -> Starts the CoreXL Dynamic Split after it was stopped. This change survives the reboot-
                            -o stop                       -> Stops the CoreXL Dynamic Split. This change does not survive the reboot.
                            -p                                -> Show status

Copyright by Heiko Ankenbrand  1994-2020

[HeikoAnkenbrand]

A small update of the article with pictures.

[rolf]

Nice info!

[HeikoAnkenbrand]

Update: CLI CommandsCLI CommandsCLI Commands

[phlrnnr]

Is this enabled by default in R80.40?  Or does it have to be turned on?

[Ilya_Yusupov]

@phlrnnr  - It have to be turned on.

[HeikoAnkenbrand · Accepted solution]

I did a cluster update to R80.40 today and have it enabled on with 16 core.

Unfortunately I cannot test it, because the cores only had a utilisation of about 10%:-)

In ClusterXL, you must configure all the Cluster Members in the same way. The dynamic_split command controls the Dynamic Split of CoreXL Firewall and SND instances on the local Security Gateway, or ClusterXL Member.

For more information, see R80.40 Performance Tuning Administration Guide - Chapter CoreXL.

Run these commands in the expert mode

# dynamic_split

                            -o disable                 -> Disables the CoreXL Dynamic Split. Requires a reboot.
                            -o enable                  -> Enables the CoreXL Dynamic Split. Requires a reboot
                            -o start                      -> Starts the CoreXL Dynamic Split after it was stopped. This change survives the reboot-
                            -o stop                       -> Stops the CoreXL Dynamic Split. This change does not survive the reboot.

                            -p                                -> Show status

[HeikoAnkenbrand]

I added that to the original article.

[Florian_Winterb]

What are the correct steps?

first -> enable

second -> start

[Harry_Morgan]

If this function is activated for r80.40 with 8 cores by default?

[HeikoAnkenbrand]

Yes, it is enabled with 8 and more cores by default.

[HristoGrigorov]

Any study on how efficient actually is this CoreXL split ? Also, do you know how often is current load evaluated and re-assignment made ?