R80.10 Security Management Performance Tuning Guide

[Tomer_Sole]

In this guide, we explain how to select the correct hardware for an optimal experience.

We provide tips on tuning your environment for performance-intensive operations.

Finally, we help you troubleshoot performance-related problems in case they happen. 

R80.10 Security Management - Performance Tuning Guide - Check Point Software Technologies 

Please let us know your feedback in the comments below.

[Kaspars_Zibarts]

Wow! One year too late in our case but still impressive! More technical comments to follow!

[Tomer_Sole]

On the upside we integrated a lot of customer feedback an experience to this document. But we will release the R80.20 document faster.

[NaderAlly]

Thanks for creating this document!

Will there be a PDF version available for download?

[Tomer_Sole]

I believe all major browsers have a "print to PDF" option.

[Vladimir]

Thanks Tomer.

Can you tell us if the hyperthreading situation in R80.20.M1 have changed or is the old recommendation still stands?

Thank you,

Vladimir

[Tomer_Sole]

We will publish an R80.20 guide soon but regarding hyper-threading, the recommendation has changed from NO in R80.10 to "make sure that you test that effect on a lab first". With the new kernel of R80.20.M1 and the upcoming R80.20 we cannot give a guaranteed answer whether this speeds up daily operations or slows them down as we received different findings from different environments. 

[Kim_Moberg]

Hi Tomer,

I think I have read something about this some were. So if one uses a vsphere with ssd disks with R80.10 it would not give same performance if one uses a linux kernel version higher than 3.xx .

The linux kernel 3.1x are better to handle ssd hard drives to clean it up after usage. This might be an issues with earlier linux kernel versions like the one used in R80.10 

Am I totally wrong here? or how is it?

thanks

[Tomer_Sole]

Since Linux 3.1x is not even a choice for R80.10 we didn't include that in the guide.

[PhoneBoy]

Doesn't the newer Smart-1 Appliances use the 3.10 kernel via a special install ISO?

[Kim_Moberg]

Thank you Tomer,

This is a great piece of work  when one needs to find out the right hardware specs is required to run the SMS server

[Pablo_Barriga]

Good document, I have a question, what are the recomended guaranteed ram and i/o in a virtual enviroment, I have several customers with different flavors of private cloud, some has vmware, other hyper-v or nutanix.

Another consideration that you should make prior to deploying the Check Point management and logging software on a virtual machine, is that the Security Management Server needs guaranteed RAM at all times, and the Log Management Server needs a guaranteed I/O amount. If not, you might experience performance problems. Merely having a strong virtual machine host is not enough for placing the Check Point servers within – you must also find out who its “neighbors” are going to be and the demands they will place on the Management and Log Servers.

[Tomer_Sole]

1. Get the answers to the questions that appear in the "Assessing" section

2. Visit the 2018 appliance data sheet and find the appliance column that fits your answers from step 1

3. The RAM, CPU and disk specifications that appear in the appliance column, should be the hardware that you give to your VM.

[Christof_Jacque]

That datasheet does not contain any info on the I/O 'amount' needed, unless I'm missing something. Can you clarify, please?

[_Val_]

well done Tomer Sole‌

[18568]

Very interesting guide. Just checking if there is any update regarding the R80.20 guide now that R80.20 is GA?

[Timothy_Hall]

Tomer Sole‌ should be able to give the definitive answer here, but based on the limited changes in the $CPDIR/conf/CpSetupInfo_resourceProfiles.conf file for the SMS between R80.10 and R80.20, I think everything in that guide will still be applicable to R80.20.  You can read more about that file and how it affects SMS performance here:

https://community.checkpoint.com/message/16843-re-mangement-server-r8010-slowness?commentID=16843#co... 

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com