Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 

R80.x - Performance Tuning Tip - Management Data Plane Separation

Management Data Plane Separation allows a security gateway to have isolated management and data networks. The network system of each domain (plane) is independent and includes interfaces, routes, sockets, and processes. This has the performance advantage that some processes run separately from the firewall core daemon. Thus it reduces the load on the firewall processes, e.g. during the policy installation.

The management plane is a domain whose purpose is to access, provision, and monitor the gateway. This includes:
      - Routing separation
      - Resource Separation
                 - Access:                         SSH, FTP, and more
                 - Provisioning:               Policy installation, GAIA Portal, RestAPI's, and more
                 - Monitoring:                  Logs, SNMP, and more

When resource separation is enabled, the security gateway will separat the management instance. Here is an example:

Mgmt
instance

CPU core 0

SND


CPU core 1

SND


CPU core 2

CoreXL
instance

CPU core 3

CoreXL
instance

CPU core 4

CoreXL
instance

CPU core 5

CoreXL
instance

CPU core 6

CoreXL
instance

CPU core 7


This feature can be enabled with the following minimum requirements:
      - R80.30 kernel 3.10 and JHF 136 or higher
      - R80.20SP JHF 194 or higher
      - To enable this option, at least 4 cores and 3 CoreXL FW instances are required.


TIP 1

To configure Management Data Plane Separation or if you need more information take a look at this SK138672.

TIP 2
This can also help if a gateway or a ClusterXL member goes into CUL freeze mode (SK92723) during policy installation through high CPU load on cluster member or single gateway.

7 Replies
Explorer

Is this also possible with R80.10 or R80.20 and the latest JHF?

Unfortunately not.

Tags (1)
Admin
Admin

3.10 kernel is required for that functionality, so no

0 Kudos
Reply
Participant

We use this with R80.30 and kernel 3.10.
Since we have been using it we have no problems with high CPU usage when installing policies.

Participant

Does this not reduce a core license?

0 Kudos
Reply
Collaborator

One has to die one death

0 Kudos
Reply
Explorer

In sk138672, we can found this :

Setting the 'sync' interface. When you use Routing Separation and ClusterXL, you must set the Sync interface on the Management Plane. The interface is used for ClusterXL synchronization between members.

and this :

The use of logical interfaces is not supported on management interface (Alias, Bridge, VPN Tunnel, 6in4 Tunnel, PPPoE, Bond, VLAN)

 

So, if I understand correctly,

- It's mandatory to put the sync interface in the management plane

- Management plane doesn't support bonding

 

So if my sync interface is a bond, I can't use management place, correct ?

0 Kudos
Reply