Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Vladimir_S
Contributor

How to measure bandwidth on CP Gateway?

Hello,

Bandwidth on a device in front of external interface is 950 Mbps (I connected a laptop to the ISP's provider's router directly), bandwidth behind of internal interface is 95 Mbps (I disconnected entire LAN from the gateway and connected a laptop only). Apparently there an issue with CP.

Is there a way to measure bandwidth on the Gateway? I'm running Gaia on Open Server R81.

Thank you,

Vlad.

0 Kudos
25 Replies
Chris_Atkinson
Employee Employee
Employee

cpview will report throughput... we don't support installing speedtest tools on the gateway itself but you have utilities such as curl available.

What blades are enabled and did the test involve multiple concurrent threads/connections?

How is the interface speed/duplex configured and is the server hardware listed on our HCL?

There are likely many other relevant questions...

 

CCSM R77/R80/ELITE
Blason_R
Leader
Leader

Can not exactly say there is a issue with CP. When you disconnect lan and attach only laptop obviously only laptop is sending a traffic. While with LAN other hosts are pumping the traffic. TO confirm use cpview and under CPU -> Top Connections see who is transferring the data.

Plus if you feel hosts are sending a data and no getting proper bw; capture the packet using tcpdump on your internal interface or external inteface for a min or so and then analyze it with cpmonitor.

Thanks and Regards,
Blason R
CCSA,CCSE,CCCS
Vladimir_S
Contributor

Hi Blason,I attached cpview  screenshots with two instances, Instance0 and Instance1. I'll check tcpdump later.

Thank you,

Vlad.

0 Kudos
Vladimir_S
Contributor

Blason, there are 5 instances under cpview -> CPU -> Top Connections. What is a difference between them?

 

Thank you.

0 Kudos
Blason_R
Leader
Leader

Those shows that firewall has 6 core - one is used for SND while 5 instances displays the connections are being handled by 5 worker cores. Due to CoreXL Fw spawns and utilizes multiple cores on firewall.

Thanks and Regards,
Blason R
CCSA,CCSE,CCCS
PhoneBoy
Admin
Admin

What is your precise method for testing speed?
What precise observations did you make on the gateways while attempting this speed test?
Super Seven output while the device is under test will help: https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40...

In any case, a single flow from a single system may not achieve full bandwidth you have available or the capacity of the appliance.
It is not necessarily indicative of a problem.

Vladimir_S
Contributor

Hi PhoneBoy,

I ran speed test on couple random websites.

https://www.speedtest.net/

https://www.att.com/support/speedtest/

The gateway in production. I do not have a test gateway.

I noticed the bandwidth issue started when our ISP replaced the router and increased the bandwidth. So, the bandwidth in front of CP increased accordingly provider's service, but behind of CP was not changed.

Thank you,

Vlad.

0 Kudos
Blason_R
Leader
Leader

Ok - Are you noticing RX_DROPs on that interface? and are those getting increased rapidly? Please provide output netstat -ni 2

and ethtool -S <interface_name>

then ethttool -g <interface_name>

Thanks and Regards,
Blason R
CCSA,CCSE,CCCS
0 Kudos
Vladimir_S
Contributor

Outputs of netstat -ni 2, ethtool -S and ethtool -g are attached.

0 Kudos
Blason_R
Leader
Leader

Oh you ran the wrong netstat command. It should be netstat -ni 2 and not netstat ni 2. It looks like Buffer size is not set to max provided you are noticing too much rx-DRP

Thanks and Regards,
Blason R
CCSA,CCSE,CCCS
0 Kudos
Vladimir_S
Contributor

netstat -ni 2 attached.

PhoneBoy
Admin
Admin

I believe most of these speed test websites use a single TCP connection.
Which, as I noted before, is potentially problematic and won’t give you an accurate result of available bandwidth.
The output of the Super Seven commands are needed to confirm what is actually happening.

0 Kudos
Timothy_Hall
Champion
Champion

You can install iperf3 on the firewall's Gaia OS directly, see here: Test bandwidth/speed from Gaia

However all this will measure is performance between the firewall itself and an iperf3 server, but not the actual throughput for traffic being fully inspected while crossing/transiting the firewall.  However this tool can be useful for finding network errors/bottlenecks outside the firewall itself.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
Vladimir_S
Contributor

Hi Timothy,

My next step to set iperf3 server on the WAN side, client on the LAN and run bandwidth test.

 

Thank you,

Vlad.

0 Kudos
Vladimir_S
Contributor

Hi Chris,

I attached three screenshots with: throughput, enabled blades and external interface configuration. Full duplex is enabled on both interfaces.
Yes, I tested involving multiple threads/connections and single host as well. The bandwith is the same in both tests.
There is one more detail. When ISP replaced their router and increased bandwidth it did not affect the LAN. LAN bandwidth is remaining 95 Mbps, WAN bandwidth increased up to 950 Mbps.

Vlad.

0 Kudos
PhoneBoy
Admin
Admin

To even begin to determine definitely what is happening here, please answer the following questions:

  • Output of the Super Seven commands I linked earlier in the thread while the device is under test
  • The precise method you are using from your laptop to test bandwidth

My speculation, based on the very limited information you have provided this far, is you’re using a method that invokes a single heavy TCP stream.
This is called an elephant flow and is not in any way indicative of the overall bandwidth available for other traffic flowing through the gateway.

Note that we’ve made some improvements to handing elephant flows in R81.20 with HyperFlow.
However, it’s only supported on Check Point appliances, currently.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

 

0 Kudos
Chris_Atkinson
Employee Employee
Employee

What license is applied to this machine, is corexl enabled for multiple cores?

Refer also:

sk98871: HTTP-based speed test shows strong degradation in download speed when Anti-Virus is set to inspect all HTTP and HTTPS traffic

CCSM R77/R80/ELITE
0 Kudos
Vladimir_S
Contributor

Chris, how to check if CoreXL is activated? I think we have only two core license. I read sk98871 and can try to stop Anti-Virus blade.

Also, I asked our account manager for a trial SecureXL license.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Suggest providing the info requested prior from @PhoneBoy regarding the S7 commands otherwise the following outputs from the gateway would be helpful short of the above.

fw ctl multik stat

cplic print

 

To manage/enable corexl (license permitting):

cpconfig > option 7 

 

 

 

CCSM R77/R80/ELITE
0 Kudos
PhoneBoy
Admin
Admin

You can generate your own eval license per the instructions here: https://community.checkpoint.com/t5/General-Topics/How-to-Request-an-Evaluation-License-for-Security...
The "All-in-One" eval should give you a license for 8 cores. 

If you only have a two core license, that will limit your performance substantially since only two cores will be used.

0 Kudos
Vladimir_S
Contributor

I applied trial "All-in-One" license. The license appeared in the Smart Console. Next, per instructions I restarted the Gateway and checked license status in the Smart Console right after. It was not there.

0 Kudos
Blason_R
Leader
Leader

Thats really surprising!! What does your cplic print -x output says?

Thanks and Regards,
Blason R
CCSA,CCSE,CCCS
0 Kudos
Vladimir_S
Contributor

Oh🙂, please ignore my last post. I re-opened Smart Console, trial license still there.

0 Kudos
the_rock
Legend
Legend

Im so glad you posted this, because in all my years dealing with CP, I could NEVER find a logical way to do this. I cant even count how many TAC cases I opened asking this question...I stopped counting after 15 probably (lol). Yes, its gotten better in R80+, but I still have customers asking me for something simple/easy.

0 Kudos
(1)
Chen_Muchtar
Employee
Employee

Just to make sure we're aligned, pls see summary of bandwidth measurements at our GWs:

Single flow

  1. Can be measured using CPVIEW -> Network -> Top-Connections
  2. Notes:
    • May affect performance, hence only activated using sk167903 (enabling sim_top_conns_enable global parameter)
    • Since this is a secureXL view, slow path connections will not appear here, only fast path and medium path
      Chen_Muchtar_0-1672675675527.png
    • In case a connection does not appear in the view above (aka: not one of the top used connections), you can calculate this info from the connection table, just run: fwaccel conns and calculate ‘host bytes’ divided by ‘duration’

Total throughput

Can be measured using CPView -> Network -> Interfaces -> Traffic (RX Traffic & TX Traffic TOTAL)

Chen_Muchtar_1-1672675760492.jpeg

Additional option: use the CPVIEW -> Traffic -> Traffic Rate

Chen_Muchtar_2-1672675760499.png

(1)

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events