[Announcement] R80.20 Gateway with new Linux kernel is GA in Azure & AWS

[CloudGuard_IaaS]

Hi Everyone,

We are glad to announce that R80.20 Gateway with new Linux kernel is now generally available in Azure & AWS.

The new image offers significant improvements:

• Significant improvement in performance throughout – See detailed table below
• Upgraded Linux kernel (based on RHEL 7.x kernel 3.10)
• Added support for Azure Accelerated Networking
• Added support for AWS next generation EC2 Compute Optimized instances family – C5
• For the entire list of R80.20 security features, see SK122485
• See sk141173 - Check Point R80.20 with Gaia 3.10 for Security Gateways for more information on GAIA OS & Limitations

Important

• R77.30 based solutions will be removed soon from the marketplace.
• For specific exceptional cases where R77.30 is needed, please contact Check Point TAC.
• Only standard deployment is supported for single R80.20 gateway. Standalone and custom configuration modes are not supported.
• In order to manage R80.20 gateways using R80.10 Management Server JHF take 177 or later must be installed.
  See sk116380 for more information.

Performance

AWS

For R80.20 gateway:

	Maximum Throughput (Mbps)	Maximum Throughput (Mbps)	Maximum Throughput (Mbps)
AWS Instance Type	c5.large	c5.xlarge	c5.2xlarge
Number of cores	2	4	8
CPEnt - NGFW	2600	4055	4065
CPEnt - NGTP	1040	1890	3400

• Tested with Cloud-Certified leading testing equipment
• Used AWS on-demand instances environment
• Actual performance results may vary depending on cloud infrastructure resources availability, region, topology, and other factors
• These results are based on actual performances measurements by Check Point performance lab using real-world traffic simulation with out-of-the-box configuration

Azure

For R80.20 gateways:

	Maximum Throughput	Maximum Throughput	Maximum Throughput
Azure VM size	D2_v2 (2 core)	D3_v2 (4 core)	D4_v2 (8 core)
CPEnt - FW + IPS	1320	2540	4890
CPEnt - NGFW	1320	2535	4790
CPEnt - NGTP	1235	2530	3985

• Tested using default deployment and Check Point configurations.
• Tested with Cloud-Certified leading testing equipment

• Actual performance results may vary depending on cloud infrastructure resources availability, region, topology, and other factors
• These results are based on actual performances measurements by Check Point performance lab using real-world traffic simulation with out-of-the-box configuration

Notes:

-          For different VM sizes see: https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-linux-sizes/ 

-          Performance can be limited by the network bandwidth allocated by Azure to the VM

-          NGFW:  FW + IPS (Recommended - out of the box) + APCL

-          NGTP: NGTP : FW + IPS (Recommended - out of the box) + APCL + URLF + AV + AB

AWS Solution templates update

All deployment options (Single Gateway, Cluster, Auto Scaling Group and Transit VPC) are supported and can be deployed using our CloudFormation templates.

Azure Solution templates update

The following marketplace offers have been renamed:

• Check Point CloudGuard IaaS R80.10 Scale Set à Check Point CloudGuard IaaS Scale Set (as it supports both R80.10 & R80.20).
• Check Point CloudGuard IaaS R80.10 High Availability à Check Point CloudGuard IaaS High Availability (as it supports both R80.10 & R80.20).
• Check Point CloudGuard IaaS Cluster à Check Point CloudGuard IaaS R77.30 & R80.10 Cluster (as it supports only R77.30 & R80.10).

The new image is supported by the following solutions:

• Check Point CloudGuard IaaS Single Gateway
• Check Point CloudGuard IaaS High Availability
• Check Point CloudGuard IaaS Scale Set

This version will be available on OCI & GCP Marketplace, soon.

As always we are here for your comments and suggestions.

CloudGuard IaaS R&D 

[Martin_Valenta]

Nice! Great progress with performance..

[Dawei_Ye]

We are using Multi-queue features with the Azure Accelarated Networking .

As documented ,Multi-queue is only supported igbe,ixgbe and mlx5_core.

But we got Azure Accelarated Networking as mlx4_core,do you guys ever test this driver on the new version?

[CloudGuard_IaaS]

Hello Dawei,

We added it specifically for Azure (mix4_core) EN. 

It is fully supported on Azure as you can configure it with cpmq. 

[Constantin_Pop]

Hi,

  it think it would have been a good idea to keep the image name starting with "Check Point" as for other images and not just "CloudGuard IaaS High Availability". I didn't find the image at first and the "Fresh install" comment in the download section here wasn't very helpful as this isn't something possible in Azure - it's a redeployment.

 Also, can you post some VPN performance test results? With R80.10 I would only get up to 500Mbps throughput for Site2Site. Will try to get the new version deployed tomorrow and run the same tests.

Thank you!

Constantin

[Yonatan_Philip]

Hi Constantin,

I'll take this up with the relevant parties and see what can be done to improve this. I know that the decision was debated back and forth - there is a character limit on the image names and this was the compromise that was eventually reached.

Based on your feedback we'll have to reevaluate the decision and see if it might make more sense to rename the image.

Regarding the question about VPN numbers - that info is still pending. 

We'll release the info as soon as we have the numbers.

HTH 

 Yonatan