Question in 32-bit R80.10 CheckPoint Server

[Ricky_Wong]

Dear All,

Refer to the CheckPoint R80.10 requirement, we do find that a Standalone requirement in memory is 6Gb.

Meanwhile, we can also find the Gaia page supporting to switch the CheckPoint to 32bit OS.

So,  few questions follow with that:

1. The maximum support memory in 32bit should be 4Gb only. How can this fit the R80.10 requirement?

2. If this exactly not fit to, why the R80.10 Gaia still support switching the OS to 32bit? 

3. When there is only 4Gb memory assigned to 32Bit R80.10, how does the Checkpoint still work ? Is that a memory swapping behavior appearing?

[PhoneBoy · Accepted solution]

If you're running a standalone config (gateway plus management) on a system with anything less than 8GB, your management will be extremely slow.
16gb of RAM (or more) is recommended in a standalone gateway configuration.
As for 32bit, it is definitely not recommended in R80.10.
R80.20 and above only operates in 64bit mode.

[BlueGrass]

A quite interesting question.

I really want to know how R80.10 distributes its resources in 32bit / 4Gb ram mode.

Can any expert help to explain it?

[PhoneBoy]

For Management only, the 4gb barrier is less of a concern because PAE (physical address extension) allows use of more than 4GB of RAM.
Each userland process is capable of addressing up to 4GB of RAM.
The maximum RAM you can use in a 32-bit OS with PAE is 64gb.

For a gateway (including standalone), you cannot use PAE at all.
Kernel components (Linux + firewall kernel) takes up roughly half of the 2GB.
That's before you add in the various required userland processes and start processing traffic, not to mention the kernel tables to track the ongoing connections.
Userland processes can be swapped out of memory as needed, kernel components (including the various tables) cannot.

If you have a relatively small number of connections with firewall and possibly VPN only, R80.10 on 4gb of RAM may still suffice and provide adequate performance.
If you want to use any Threat Prevention or even Application Control features, it could be a very tight fit.