VSX on Check Point 9300/9400 Appliances

[HeikoAnkenbrand]

Recently, I heard through informal discussions among German SEs that using Check Point 9300 and 9400 appliances with VSX may not be the most optimal setup. The reason seems to be tied to the way energy-efficient cores and performance cores are distributed asynchronously within these platforms.

It is easy to imagine that such a mixed-core architecture could potentially lead to imbalances in performance when running demanding VSX environments. As VSX relies heavily on predictable CPU behavior across virtual systems, heterogeneous cores may introduce unexpected issues in processing consistency, latency, or throughput.

Appliance	Performance cores	Efficient cores	Cores / Virtual cores
9300	6	4	10 / 16
9400	6	8	14 / 20

Questions:

• Has Check Point made any official statement regarding this specific scenario?

• Are there any known limitations or best practices for running VSX on 9300/9400 appliances with this CPU architecture?

• What would be the recommended configuration to ensure stable and reliable operation in production environments?

[Chris_Atkinson]

There is only some limited / inconclusive discussion from other community members here to my knowledge:

https://community.checkpoint.com/t5/General-Topics/VSX-UPPAK-issues/m-p/258287

[HeikoAnkenbrand]

Thanks for the info, @Chris_Atkinson.

My question is whether it makes sense to use the 9300/9400 in a VSX environment.

The problem is that when I assign, for example, 3 CoreXL instances to a virtual system via SmartConsole, it can happen that one E-core and two P-cores are used. This is highly suboptimal.

That’s why I’ve always statically assigned either E-cores or P-cores to the virtual systems. That works fine.

The only issue is that when it happens automatically, it leads to performance problems.

[Chris_Atkinson]

Understood but given the use case can be anything from MDPS like deployments to those much more complex / advanced it might be more subjective.

[HeikoAnkenbrand]

Is there an official statement from Check Point on this topic, or should I contact the German Partner SEs?

[PhoneBoy]

Your best bet is to reach out to your local Check Point office, yes.