R80.40 automatically changes the number of CoreXL SNDs, Firewall instances and the Multi-Queue

[HeikoAnkenbrand]

An extract from the readme with information about R80.40:

CUT>>

CoreXL and Multi-Queue

• Support for automatic allocation of CoreXL SNDs and Firewall instances that does not require a Security Gateway reboot.
• Improved out of the box experience - Security Gateway automatically changes the number of CoreXL SNDs and Firewall instances and the Multi-Queue configuration based on the current traffic load

<<<CUT

Do you have any information on how the algorithms will work?
According to which criteria will the distribution take place?

How will this work with a ClusterXL?

[Timothy_Hall]

Great questions Heiko, I'm assuming this is all predicated on the new Gaia 3.10 kernel and USFW being enabled in R80.40...

[HeikoAnkenbrand]

Any news here from Check Point?

[Tsvika_Gilman]

That's an interesting question. I would prefer a manual configuration if I didn't know how it works.

[Chen_Muchtar · Accepted solution]

Hi Heiko,

Addressing your question per algorithm concept:

Essence:

• Changing CoreXL split between FW workers and SND on the fly based on CPU utilization

Deciding keys:

1. The average utilization of CoreXL SNDs and FWs are regularly sampled
2. If either CoreXL SNDs or FWs utilization is higher than the other, perform an estimate of utilization post “migrating” a CPU to the other group
   Note: when SMT is on, change is doubled

Flows:

1. If more SNDs are needed
   1. Find least utilized CoreXL FW instance
   2. Stop dispatching new connections to the least utilized CoreXL FW instance
   3. Move the CoreXL FW instance to the CPU of next least utilized CoreXL FW instance
   4. Turn on a new MQ queue on the “evicted” CPU
      Note: Eligible CoreXL SNDs must have a MQ queue ready

2. If more FWs are needed
   1. Choose the last “stopped” CoreXL FW instance
   2. Turn off MQ queue from the CPU it originally occupied
   3. Move the chosen CoreXL FW instance to the original CPU it occupied
   4. Start dispatching new connections to that CoreXL FW instance
      Note: No more than the maximum number of FWs can be added

General

• Supported on OS 3.10 (USFW/Kernel); Check Point appliances with 8 cores or more; VSX is currently a limitation
• Supported on Cluster HA; VSLS is currently a limitation
  
  

For  further questions / feedback / suggestions for enhancements etc. – pls don’t hesitate to contact me directly - chenmu@checkpoint.com