R80.x Security Gateway Architecture (Logical Packet Flow)

[_Val_]

Says someone spending his R&R time to chart a diagram 🙂 We need more addicts like yourself. Show them the way

[Samuel_Vikander]

Very nice flowchart.

At the moment I am learn for the CCSA.

For the first time I understood all basics and the packet flow.

THX

Samuel

[_Val_]

oh gosh, you have endless talents. This one in hi res too please

[Alexander_Wilke]

Hello,

can you give some more information how often the Dynamic Dispatcher checks the CPU Utilization? is it 60s like it is with the affinity?

In my opinion these timings should be configurable but this is not relevant to this great article. Describes very good what which feature is doing.

Regards

Alexander

[HeikoAnkenbrand]

Hi Alexander,

in the first step you you can found more informations in this SK.

CoreXL Dynamic Dispatcher in R77.30 / R80.10 and above 

Regards,

Heiko

[HeikoAnkenbrand]

Hi Valeri,

Are you in Israel too?

I will bring you the original pictures:-)

Regards,

Heiko

[Melissa_Swan]

Yes, it is very helpful to learn for CCSA and CCSE.

Thake you

[Hong_Kim_Yu]

Thanks yor for the great summary. I also use it to learn for CCSA and CCSE.

Thanks to https://community.checkpoint.com/people/h.ank2614aef2-c5d1-3f73-bbbd-45c59b9e2728 

[Jan_Woegler]

Very nice document.

Thanks,

Jan

[Alexander_Wilke]

Hi,

thanks for the link but it does not answer my question. I want to know how ofther Dynamic Dispatcher checks the CPU load. it is not explicit written how often it checks for the load of a CPU to decide how to dispatch.

There is one sentce which could lead to the assumption that it checks every second but this is not for sure:

Administrator should enable CoreXL Dynamic Dispatcher if:

1. A CoreXL FW instance consumes its CPU core at 85% (and above) even for 1 second.

[karsten_wiborg]

That's a nice one and to be downloaded for offline reference.

Thanks,

Karsten

[Jul_Kapendale]

Great work.

[Malte_Wienberg]

Excellent flowchart!

THX, Malte

[Alit_Yalcin]

Great flowchart!

Alit

[Lars_Skerka]

Hi Hiko,

You describe PXL but there is also active streaming. Where can I find this in your drawing?

Lars

[HeikoAnkenbrand]

Hi Lars,

You can find more information about CPAS here:

R80.x Security Gateway Architecture (Content Inspection) 

CPAS is a "man in the midle" module that works in the inchain and outchain. That's why it's hard to draw it here.

Regards,

Heiko

[Nicholas_Sherid]

This is excellent work

[_Val_]

The following statements are not 100% correct:

>>Inline Streaming Path - is the new name for R80.20+ PSL and CPAS over the F2F path.

>>Medium Streaming Path - is the new name for R80.20+ PXL (new in R80.20 PSLXL) and CPASXL over the medium path.

R80.20 has improved performance, but in this particular case we are just talking on better visibility of how Medium Path is used. Inline is related to Threat Emulation, Medium Streaming term is self explanatory. I would suggest refrain from putting new statements in to the document before they can be backed up with official Check Point documentation. We expect relevant SKs to be updated shortly.

Thank you

[HeikoAnkenbrand]

Thanks, I'll delete that from the document for now.

As I said, Check Point should disclose this information.

You can find my other comment here:

Security Gateway Performance Optimization Excerpt 

Regards,

Heiko

[_Val_]

Already answered there. 

[Sandro_Gerdel]

Excellent work, thx.

[Yael_Haimi]

Great work:-)

[Vivek_Kojoziky]

Yes, great flowchart.

THX,

Vivec

[Mirosław_Zimny]

Only one tiny correction - on slow path (F2F) the first decision block is "Connection Table" (not Tabel).

[Christian_Wagen]

Hi Hiko,

That's a good article series. I could use a lot of useful content in a project.

I gave you 1,000 points.

Many thanks

Christian

[Adi_Skornia]

Nice articel series.

Thanks

Adi

[Ziv_Zander]

Yes it is very nice!

[Pasqual_Woodcoc]

In the drawing the new R80.20 inspection points (id and iD) are missing.

Regards

Pasqual

[Igor_Szkaradkie]

nice

[Eduard_Mammitzs]

great job