What is UPPAK, KPPAK vs. USFW, KSFW

[HeikoAnkenbrand]

In recent years, I have repeatedly noticed confusion regarding the following terms: KSFW, USFW, UPPAK, and KPPAK, which sometimes led to incorrect modules being switched. Therefore, I’ve written a short summary that may help you identify which firewall modules are currently active and how you can switch between them.

SecureXL Performance Pack

SecureXL is a software acceleration product installed on Security Gateways. SecureXL network acceleration techniques deliver wire-speed performance for Security Gateways. Performance Pack is a software acceleration product installed on Security Gateways. Performance Pack uses SecureXL technology and other innovative network acceleration techniques to deliver wire-speed performance for Security Gateways. SecureXL is implemented either in software or in hardware.

UPPAK - User Space Performance Pack

SecureXL runs as processes in the user space. This mode increases performance and unlocks more advanced features in SecureXL. This is the default mode on the supported Check Point appliances after you install R81.20 Jumbo Hotfix Accumulator Take 38 or above.

KPPAK - Kernel Space Performance Pack

SecureXL runs as a kernel module in the kernel space.

Viewing the Current SecureXL Mode	# fwaccel stat
Changing the Current SecureXL Mode	# cpconfig      -> Check Point SecureXL      -> Change SecureXL Mode # reboot Important - In cluster, this can cause a failover.
More informatios	- R82 Performance Tuning Administration Guide - Configuring SecureXL  - R81.20 Performance Tuning Administration Guide - Configuring SecureXL  ATRG: SecureXL for R80.20 and higher (sk153832)  - SecureXL Mechanism (sk32578)

CoreXL Firewall instances

CoreXL is a performance-enhancing technology for Security Gateways on multi-CPU-core processing platforms. CoreXL enhances Security Gateway performance by enabling the processing CPU cores to concurrently perform multiple tasks. CoreXL provides almost linear scalability of performance, according to the number of processing CPU cores on a single machine. The increase in performance is achieved without requiring any changes to management or to network topology. On a Security Gateway with CoreXL enabled, the Firewall instance is replicated multiple times. Each replicated copy, or FW instance, runs on one processing CPU core. These FW instances handle traffic concurrently, and each FW instance is a complete and independent FW inspection.

USFW - User Space Firewall

User Space Firewall (USFW) is the infrastructure in which CoreXL Firewall instances run in the user space. This mode is available from R80.30 with Gaia kernel 3.10.

KSFW - Kernel Space Firewall

Kernel Space Firewall (KSFW) is the infrastructure in which CoreXLClosed Firewall instances run in the kernel.

Viewing the current firewall instance mode	# fwmode -s
Changing the current firewall instance mode	# cpconfig     -> Check Point CoreXL     -> Change firewall mode or # fwmode -k          (for kernel space) # fwmode -u          (for user space) # reboot Important - In cluster, this can cause a failover.
More informations	- R82 Performance Tuning Administration Guide - CoreXL Firewall Mode  - R81.20 Performance Tuning Administration Guide - CoreXL Firewall Mode - User Space Firewall (USFW) support in R80.30 3.10 and higher (sk167052)  - ATRG: CoreXL (sk98737)

Important

Only the following combinations are supported.

	SecureXL - User Space Mode (UPPAK)	SecureXL - Kernel Space Mode (KPPAK)
Firewall User Space Mode    (USFW)	Supported	Supported
Firewall Kernel Space Mode (KSFW)	Not supported	Supported

This sk179432 explains that there is a functional difference between UPPAK and KPPAK modes. Therefore, when switching between them, it’s important to carefully review the features currently in use on the firewall to ensure compatibility and avoid any unexpected behavior.

[the_rock]

Such a great explanation Heiko.

[PhoneBoy]

In R82.10, it will be only USFW and UPPAK 🙂

[HeikoAnkenbrand]

Hi @PhoneBoy , thanks for the info.

Luckily, we won’t have to switch back and forth between KSFW/USFW and UPPAK/KPPAK anymore in the future😉

[the_rock]

Glad for that 🙂

[emmap]

Only other point I'd make is that if you suspect you have a 'user mode' issue, 99% of the time it'll be a UPPAK thing, so set that to KPPAK but leave USFW on.

[HeikoAnkenbrand · Accepted solution]

This sk179432 explains that there is a functional difference between UPPAK and KPPAK modes. Therefore, when switching between them, it’s important to carefully review the features currently in use on the firewall to ensure compatibility and avoid any unexpected behavior.

I’ll add that to the original article.

[HeikoAnkenbrand]

It will become particularly interesting once R82.10 is available and only USFW and UPPAK are supported. At that point, we will no longer have the option to switch back to KPPAK. A major question for me is whether the following features will still be supported with UPPAK in R82.10: DDoS (SecureXL), VXLAN interface, GRE interface, and Bridge interface. 

[PhoneBoy]

Possible these will not be limitations in R82.10, though I have not seen any confirmation of this.

[JozkoMrkvicka]

R82.10 is already in Public EA stage. Maybe some limitations will be solved only in GA, but if someone has some spare appliances supported by R82.10, might be worth to test features mentioned in sk179432 as not currently supported within UPPAK on R82.

[the_rock]

Looking forward to it!