Any time the number of licensed cores differs from the number of physical cores on open hardware gateways, watch out for what call I call the licensing "core crunch" in the second edition of my book. This situation cannot occur on a Check Point gateway appliance that has the correct bundled license installed:
The Trial License “Core Crunch”
This issue can be summed up quite succinctly with just one fateful screenshot:
Figure 7-14: Example Showing Effects of a Licensing "Core Crunch"
What the...? We can see that there are 4 processing cores total yet there are six Firewall Workers splattered all over the place. But how did it get this way? Some further investigation utilizing commands we covered earlier can help:
Figure 7-15: Diagnosing a Licensing "Core Crunch"
Oops. This situation can occur on an open hardware firewall, which has more physical cores than permanently licensed cores. When this example firewall was first configured, it was using the built-in 15-day Trial Period license which permits an unlimited number of cores to be employed by CoreXL. Because there were 8 total cores present, the default allocation of 2 SND/IRQ cores and 6 Firewall Worker cores was initially set under the trial license. However once the permanent license for only 4 cores was applied and the firewall rebooted, there were still 2 SND/IRQ and 6 Firewall Worker cores allocated, and they all got “crunched” onto the 4 allowed cores as shown in the command output above. The SND/IRQ and Firewall Worker functions are tripping all over each other, and in some cases separate Firewall Workers are fighting each other for the same core! Needless to say the CPU fast caches will be getting mercilessly thrashed and overall firewall performance will be absolutely dismal.
To correct this particular situation described in our example: run cpconfig to allocate 3 Firewall Worker cores, and then reboot the firewall. However even after performing this step, as you might suspect the remaining 4 unlicensed cores will do practically nothing, while the 4 licensed ones are forced to carry the entire traffic load; core licensing limits are actively enforced by the Check Point code. This situation should never occur on a Check Point firewall appliance unless the wrong license is applied, as the license bundled with the appliance will always permit the same number of cores as actual physical cores.