FW Accel Conns 0%

[Sam2]

Hi Team, 

I have a firewall running R81 with take 44 that currently has 0% accelerated conns, see output below: 

   Accelerated conns/Total conns : 22/37423 (0%)
   Accelerated pkts/Total pkts : 131018190109/134923281770 (97%)
   F2Fed pkts/Total pkts : 3905091661/134923281770 (2%)
   F2V pkts/Total pkts : 982863959/134923281770 (0%)
   CPASXL pkts/Total pkts : 1466487054/134923281770 (1%)
   PSLXL pkts/Total pkts : 128928729017/134923281770 (95%)
   CPAS pipeline pkts/Total pkts : 0/134923281770 (0%)
   PSL pipeline pkts/Total pkts : 0/134923281770 (0%)
   CPAS inline pkts/Total pkts : 0/134923281770 (0%)
   PSL inline pkts/Total pkts : 0/134923281770 (0%)
   QOS inbound pkts/Total pkts : 0/134923281770 (0%)
   QOS outbound pkts/Total pkts : 0/134923281770 (0%)
   Corrected pkts/Total pkts : 0/134923281770 (0%)

Reviewing fw accel stat does not show that templating should be disabled, 

   +---------------------------------------------------------------------------------+
   |Id|Name |Status |Interfaces |Features |
   +---------------------------------------------------------------------------------+
   |0 |SND |enabled |eth1,eth5,eth2,eth3,eth4,|Acceleration,Cryptography |
   | | | |Sync,Mgmt | |
   | | | | |Crypto: Tunnel,UDPEncap,MD5, |
   | | | | |SHA1,3DES,DES,AES-128,AES-256,|
   | | | | |ESP,LinkSelection,DynamicVPN, |
   | | | | |NatTraversal,AES-XCBC,SHA256, |
   | | | | |SHA384,SHA512 |
   +---------------------------------------------------------------------------------+

   Accept Templates : enabled
   Drop Templates : disabled
   NAT Templates : enabled

enabled blades output: 
fw urlf av appi ips anti_bot ThreatEmulation Scrub

I have reviewed sk32578 and the policy does not include anything that would impact connection templating. For my TP blades, we are using the autonomous policy with the edge profile. I am using updateable objects for both azure and o365, and I have them at the top of my rulebase, is there a chance that they impact secureXL?

[Ben_Maoz]

Hi Sam2,

Please note " Accelerated conns/Total conns"  means fully accelerated connections.

As you can see "PSLXL pkts/Total pkts : 128928729017/134923281770 (95%)"  so most of your traffic is accelerated but not fully accelerated (Medium path).

Thanks,

Ben

[HeikoAnkenbrand · Accepted solution]

Hi @Sam2,

It is exactly as @Ben_Maoz  described it. If you need more info on the PSLXL path see my articles:
- R8x - Security Gateway Architecture (Logical Packet Flow)
- R8x - Security Gateway Architecture (Logical Packet Flow) - Update R80.20+
- R8x - Security Gateway Architecture (Content Inspection)

[Timothy_Hall]

As Ben and Heiko said throughput acceleration via the Medium Path is working fine.  The zero Accelerated Conns rate just means that SecureXL is not doing Accept templates at all even though fwaccel stat shows that there is no rule disabling templating.  Generally I believe this is caused by Anti-bot being enabled, as SecureXL itself cannot perform the IP reputation checks for Accept templates that is required when Anti-bot is enabled.  With the advent of Column-based matching in R80.10 Accept templating rates are much less important than they used to be for most environments, so I wouldn't worry about it.