- Products
- Learn
- Local User Groups
- Partners
-
More
Join Us for CPX 360
23-24 February 2021
Check Point Harmony
Highest Level of Security for Remote Users
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
Advanced Protection for
Small and Medium Business
Secure Endpoints from
the Sunburst Attack
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Can someone please give a clear explanation, what is the difference between the Secure Network Distributor (SND) and CoreXL Dynamic dispatcher?
The SND performs acceleration of traffic and if traffic is not accelerated then the SND will dispatch the traffic to the firewall workers, each having their own firewall kernel instance. The SND will distribute traffic evenly based on the amount of connections, however, it may not evenly distribute the load as some connections are "heavier" than others. I believe the heaviness is based on the bit rate value, I will need to verify that. The dynamic dispatcher will be aware of how heavy the connections are, so it will better distribute the load to each firewall worker. To recap, the SND thinks that the load should be distributed based on the amount of connections, but that's not true, because some connections are heavier than others. This is where dynamic dispatcher comes to the rescue.
Already has been answered in sk105261: CoreXL Dynamic Dispatcher in R77.30 / R80.10 and above
Read this article form @HeikoAnkenbrand:
The best way to explain the difference is to list the responsibilities of cores designated as SND and cores designated as Firewall Instances/Workers. This information is for R80.10 and earlier:
Due to the big changes in SecureXL, R80.20 and later is, uh, different. I have an initial guess of the separation of duties but am still verifying it.
The SND performs acceleration of traffic and if traffic is not accelerated then the SND will dispatch the traffic to the firewall workers, each having their own firewall kernel instance. The SND will distribute traffic evenly based on the amount of connections, however, it may not evenly distribute the load as some connections are "heavier" than others. I believe the heaviness is based on the bit rate value, I will need to verify that. The dynamic dispatcher will be aware of how heavy the connections are, so it will better distribute the load to each firewall worker. To recap, the SND thinks that the load should be distributed based on the amount of connections, but that's not true, because some connections are heavier than others. This is where dynamic dispatcher comes to the rescue.
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY