Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Sam2
Contributor
Jump to solution

FW Accel Conns 0%

Hi Team, 

I have a firewall running R81 with take 44 that currently has 0% accelerated conns, see output below: 

   Accelerated conns/Total conns : 22/37423 (0%)
   Accelerated pkts/Total pkts : 131018190109/134923281770 (97%)
   F2Fed pkts/Total pkts : 3905091661/134923281770 (2%)
   F2V pkts/Total pkts : 982863959/134923281770 (0%)
   CPASXL pkts/Total pkts : 1466487054/134923281770 (1%)
   PSLXL pkts/Total pkts : 128928729017/134923281770 (95%)
   CPAS pipeline pkts/Total pkts : 0/134923281770 (0%)
   PSL pipeline pkts/Total pkts : 0/134923281770 (0%)
   CPAS inline pkts/Total pkts : 0/134923281770 (0%)
   PSL inline pkts/Total pkts : 0/134923281770 (0%)
   QOS inbound pkts/Total pkts : 0/134923281770 (0%)
   QOS outbound pkts/Total pkts : 0/134923281770 (0%)
   Corrected pkts/Total pkts : 0/134923281770 (0%)

Reviewing fw accel stat does not show that templating should be disabled, 

   +---------------------------------------------------------------------------------+
   |Id|Name |Status |Interfaces |Features |
   +---------------------------------------------------------------------------------+
   |0 |SND |enabled |eth1,eth5,eth2,eth3,eth4,|Acceleration,Cryptography |
   | | | |Sync,Mgmt | |
   | | | | |Crypto: Tunnel,UDPEncap,MD5, |
   | | | | |SHA1,3DES,DES,AES-128,AES-256,|
   | | | | |ESP,LinkSelection,DynamicVPN, |
   | | | | |NatTraversal,AES-XCBC,SHA256, |
   | | | | |SHA384,SHA512 |
   +---------------------------------------------------------------------------------+

   Accept Templates : enabled
   Drop Templates : disabled
   NAT Templates : enabled

enabled blades output: 
fw urlf av appi ips anti_bot ThreatEmulation Scrub

I have reviewed sk32578 and the policy does not include anything that would impact connection templating. For my TP blades, we are using the autonomous policy with the edge profile. I am using updateable objects for both azure and o365, and I have them at the top of my rulebase, is there a chance that they impact secureXL?

 

0 Kudos
1 Solution

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion
3 Replies
Ben_Maoz
Employee
Employee

Hi Sam2,

Please note " Accelerated conns/Total conns"  means fully accelerated connections.

As you can see "PSLXL pkts/Total pkts : 128928729017/134923281770 (95%)"  so most of your traffic is accelerated but not fully accelerated (Medium path).

Thanks,

Ben

HeikoAnkenbrand
Champion Champion
Champion

Hi @Sam2,

It is exactly as @Ben_Maoz  described it. If you need more info on the PSLXL path see my articles:
- R8x - Security Gateway Architecture (Logical Packet Flow)
- R8x - Security Gateway Architecture (Logical Packet Flow) - Update R80.20+
- R8x - Security Gateway Architecture (Content Inspection)



➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Timothy_Hall
Legend Legend
Legend

As Ben and Heiko said throughput acceleration via the Medium Path is working fine.  The zero Accelerated Conns rate just means that SecureXL is not doing Accept templates at all even though fwaccel stat shows that there is no rule disabling templating.  Generally I believe this is caused by Anti-bot being enabled, as SecureXL itself cannot perform the IP reputation checks for Accept templates that is required when Anti-bot is enabled.  With the advent of Column-based matching in R80.10 Accept templating rates are much less important than they used to be for most environments, so I wouldn't worry about it.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events