Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
HeikoAnkenbrand
Champion Champion
Champion

Update R80.20+ Security Gateway Architecture (Logical Packet Flow)

Chapter

More interesting articles:

- R80.x Architecture and Performance Tuning - Link Collection
- Article list (Heiko Ankenbrand)

Flowchart news in R80.20 and above


SecureXL has been significantly revised in R80.20
. This has also led to some changes in "fw monitor". There are new fw monitor chain (SecureXL) objects that do not run in the virtual machine.

Now SecureXL works in part in user space. The SecureXL driver takes a certain amount of kernel memory per core and that was adding up to more kernel memory than Intel/Linux was allowing. The packet flow in R80.20+ is a little bit different from the flow lower than R80.20. Now it is possible to use async SecureXL and other new functions. This figure shows the new features with the reinjection of SecureXL packages. SecureXL supportes now also Async SecureXL with Falcon cards. That's new in acceleration high level architecture (SecureXL on Acceleration Card): Streaming over SecureXL, Lite Parsers, Scalable SecureXL, Acceleration stickiness...

More informations here: R80.x Security Gateway Architecture (Logical Packet Flow)

Whats new in R80.20+:

Now there are several SecureXL instances possible. As a result, packets are reinjected with the new SecureXL ID into the correct SecureXL instance again after they have been allowed by access template or rule set. After the packet has been reinjected, the SecureXL ID is added to the SecureXL connetion table and the packet is forwarded to the correct SecureXL instance. Therefore the flow is slightly different to older version before R80.20. This new mechanism also offers the possibility to transfer packets into a new SecureXL instance on Falcon cards.

accel_path_d_1.PNG

PXL vs. PSLXL - Technology name for combination of SecureXL and PSL. PXL was renamed to PSLXL in R80.20. This is from my point of view the politically correct better term.

For the new acceleration Falcon card architecture with R80.20+ and SecureXL offloading read this article:

R80.x Security Gateway Architecture (Acceleration Card Offloading):

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
17 Replies
PhoneBoy
Admin
Admin

"fort he" typo in the middle of the diagram.
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

THX @PhoneBoy,

I'll change tomorrow in the next version.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Daniel_Hainich
Collaborator

there is also "thw" in top securexl matching.
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

Hi @PhoneBoyHi @Daniel_Hainich 

THX is changed.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Ziv_Zander
Explorer

Typos aren't a problem. The content is important.

And I think that is brilliant information from @HeikoAnkenbrand.

HeikoAnkenbrand
Champion Champion
Champion

I also added the paths (Slow Path, Medium Path and Fast Path)  marked in color.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

Now there are several SecureXL instances possible. As a result, packets are reinjected with the new SecureXL ID into the correct SecureXL instance again after they have been allowed by access template or rule set. After the packet has been reinjected, the SecureXL ID is added to the SecureXL connettion table and the packet is forwarded to the correct SecureXL instance. Therefore the flow is slightly different to older version before R80.20. This new mechanism also offers the possibility to transfer packets into a new SecureXL instance on Falcon cards.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
F__Rahama
Participant

Why packets reinjection with the neu SecureXL ID into the correct SecureXl instance is needed?

0 Kudos
Timothy_Hall
Legend Legend
Legend

Starting in R80.20 there can be more than one instance of SecureXL present on the gateway, but the only way you can have this situation is if a Falcon card is present (which is essentially another instance of SecureXL running on the card itself).  If a packet is received by the "wrong" instance of SecureXL on a gateway, it is forwarded to the correct instance and the packet is counted as a "correction" in the output of commands like fwaccel stats -s.

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
HeikoAnkenbrand
Champion Champion
Champion

Yes @Timothy_Hall  describes this well, from R80.20 there are correction flows. They forward the packet to the correct SecureXL instance. 

Through reinjection, the packet is tagged with the correct SecureXL ID and then forwarded to the appropriate SecureXL instance. This is now also described in the new R80.30 document Performance Tuning R80.30 Administration Guide.

 

 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

Here is a picture from a LAB appliance with corrected packet flow:

SexureXL_correction.PNG

 
 
➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
James_Heueck
Participant

Great info.

Bidwell_Britta
Participant

Nice update.

Vitaly_C_
Participant

😀

Tsvika_Gilman
Contributor

Nice informaton update!

0 Kudos
R2D2
Participant

Is this CCSE exam relevant?

0 Kudos
_Val_
Admin
Admin

Technically speaking, no. However, this helps with understanding of technology. That said, I advise you to stick with official documentation and course textbooks for certification

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events