- Products
- Learn
- Local User Groups
- Partners
- More
MVP 2026: Submissions
Are Now Open!
What's New in R82.10?
Watch NowOverlap in Security Validation
Help us to understand your needs better
CheckMates Go:
Maestro Madness
Hello team,
My experience with checkpoint technology is at an intermediate level. As I read about CoreXL technology, I have following queries.
Refer SK/Guide:-
https://support.checkpoint.com/results/sk/sk105261
https://support.checkpoint.com/results/sk/sk174423
Thanks in advance.
Regards,
Magesh
To answer your questions:
1) Automatic interface affinity is not used any more on interfaces that support Multi-Queue. Prior to the use of Multi-Queue, every 60 seconds or so automatic interface affinity would measure interface utilization, and allocate SND resources to the busiest interfaces. If there were enough SND cores available, the busiest interfaces would end up with their very own SND core and not have to share it with other interfaces. Multi-Queue is enabled by default on all interfaces and replaces automatic interface affinity, and also allows multiple SND cores to service a busy interface.
The Dynamic Dispatcher is implemented on the SND Cores, but it is not directly related to automatic interface affinity or Multi-Queue. The Dynamic Dispatcher monitors the load of the Firewall Worker Instances and directs new connections (and all their subsequent packets) to the least-busy worker core.
2) The job of the Dynamic Dispatcher is to keep the Firewall Worker Cores evenly balanced (and it does consider the existing load on the Firewall Worker Cores to do this), while Multi-Queue attempts to keep the load balanced among the SND cores by balancing traffic loads. I'm not sure if Multi-Queue really considers SND CPU load in its balancing of traffic; it is just trying to keep the raw traffic load balanced among the SND cores to my knowledge.
3) You're conflating the Dynamic Dispatcher and Multi-Queue with this question, they are functions both implemented by the SND cores but serve very different functions. (Firewall Worker Core balancing vs. SND Core balancing)
4) Interfaces are not affined directly to the Firewall Worker Cores, interfaces are handled/affined by Multi-Queue by the SND cores. If Dynamic Balancing/Split is in use, an interface that was being serviced by an SND core could suddenly not be if that core is reassigned to be a new Firewall Worker Instance. The remaining SND cores will pick up the slack for that interface in that instance.
In a static split scenario the number of SND cores cannot change, and each interface's load is distributed among all available SND cores by Multi-Queue, subject to the queue limits of some driver and NIC hardware. For example the igb I211 NIC only supports a maximum two queues, so even if there are 8 SND Cores available only 2 of them can service that I211 interface at any one time.
Hey Magesh,
See if below links help.
Andy
To answer your questions:
1) Automatic interface affinity is not used any more on interfaces that support Multi-Queue. Prior to the use of Multi-Queue, every 60 seconds or so automatic interface affinity would measure interface utilization, and allocate SND resources to the busiest interfaces. If there were enough SND cores available, the busiest interfaces would end up with their very own SND core and not have to share it with other interfaces. Multi-Queue is enabled by default on all interfaces and replaces automatic interface affinity, and also allows multiple SND cores to service a busy interface.
The Dynamic Dispatcher is implemented on the SND Cores, but it is not directly related to automatic interface affinity or Multi-Queue. The Dynamic Dispatcher monitors the load of the Firewall Worker Instances and directs new connections (and all their subsequent packets) to the least-busy worker core.
2) The job of the Dynamic Dispatcher is to keep the Firewall Worker Cores evenly balanced (and it does consider the existing load on the Firewall Worker Cores to do this), while Multi-Queue attempts to keep the load balanced among the SND cores by balancing traffic loads. I'm not sure if Multi-Queue really considers SND CPU load in its balancing of traffic; it is just trying to keep the raw traffic load balanced among the SND cores to my knowledge.
3) You're conflating the Dynamic Dispatcher and Multi-Queue with this question, they are functions both implemented by the SND cores but serve very different functions. (Firewall Worker Core balancing vs. SND Core balancing)
4) Interfaces are not affined directly to the Firewall Worker Cores, interfaces are handled/affined by Multi-Queue by the SND cores. If Dynamic Balancing/Split is in use, an interface that was being serviced by an SND core could suddenly not be if that core is reassigned to be a new Firewall Worker Instance. The remaining SND cores will pick up the slack for that interface in that instance.
In a static split scenario the number of SND cores cannot change, and each interface's load is distributed among all available SND cores by Multi-Queue, subject to the queue limits of some driver and NIC hardware. For example the igb I211 NIC only supports a maximum two queues, so even if there are 8 SND Cores available only 2 of them can service that I211 interface at any one time.
Thanks for the detailed explanation. It seems that I have mixed up two distinct concepts related to load balancing.
Affinity and multi-queue, is the principle utilized for achieving load balancing among CoreXL SND.
Dynamic Dispatcher is utilized by the CoreXL SND to distribute packets evenly among CoreXL firewall instances.
Am I right?
Regards,
Magesh
The Dynamic Dispatcher really distributes connections and all their associated packets (not just individual packets on their own), and "sticks" them to the same worker instance every time.
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 20 | |
| 19 | |
| 18 | |
| 8 | |
| 7 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 |
Tue 16 Dec 2025 @ 05:00 PM (CET)
Under the Hood: CloudGuard Network Security for Oracle Cloud - Config and Autoscaling!Thu 18 Dec 2025 @ 10:00 AM (CET)
Cloud Architect Series - Building a Hybrid Mesh Security Strategy across cloudsTue 16 Dec 2025 @ 05:00 PM (CET)
Under the Hood: CloudGuard Network Security for Oracle Cloud - Config and Autoscaling!Thu 18 Dec 2025 @ 10:00 AM (CET)
Cloud Architect Series - Building a Hybrid Mesh Security Strategy across cloudsAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY