fw_worker

[Vinayakkumar_An]

What is fw_worker and what is the use?

[PhoneBoy]

fw_worker is a so-called firewall instance, which the gateway uses to process traffic. It is normal to see multiple fw_worker processes. It is part of CoreXL.

Refer to: https😕/supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Nick_Doropoulos]

From the ATRG that Daemon shared:

"CoreXL is a performance-enhancing technology for Security Gateways on multi-CPU-core processing platforms. CoreXL enhances Security Gateway performance by enabling the processing CPU cores to concurrently perform multiple tasks.

On a Security Gateway with CoreXL enabled, the Firewall kernel is replicated multiple times. Each replicated copy, or FW instance, runs on one processing CPU core. These FW instances handle traffic concurrently, and each FW instance is a complete and independent FW inspection kernel. When CoreXL is enabled, all the FW kernel instances in the Security Gateway process traffic through the same interfaces and apply the same security policy."

The fw_worker process is essentially the "replicated copy" of the firewall kernel as described above.

CoreXL can be configured with the cpconfig command. See screenshot below:

Hope it helps.