How to measure bandwidth on CP Gateway?

[Vladimir_S]

Hello,

Bandwidth on a device in front of external interface is 950 Mbps (I connected a laptop to the ISP's provider's router directly), bandwidth behind of internal interface is 95 Mbps (I disconnected entire LAN from the gateway and connected a laptop only). Apparently there an issue with CP.

Is there a way to measure bandwidth on the Gateway? I'm running Gaia on Open Server R81.

Thank you,

Vlad.

[Chris_Atkinson]

cpview will report throughput... we don't support installing speedtest tools on the gateway itself but you have utilities such as curl available.

What blades are enabled and did the test involve multiple concurrent threads/connections?

How is the interface speed/duplex configured and is the server hardware listed on our HCL?

There are likely many other relevant questions...

[Blason_R]

Can not exactly say there is a issue with CP. When you disconnect lan and attach only laptop obviously only laptop is sending a traffic. While with LAN other hosts are pumping the traffic. TO confirm use cpview and under CPU -> Top Connections see who is transferring the data.

Plus if you feel hosts are sending a data and no getting proper bw; capture the packet using tcpdump on your internal interface or external inteface for a min or so and then analyze it with cpmonitor.

[Vladimir_S]

Hi Blason,I attached cpview  screenshots with two instances, Instance0 and Instance1. I'll check tcpdump later.

Thank you,

Vlad.

[Vladimir_S]

Blason, there are 5 instances under cpview -> CPU -> Top Connections. What is a difference between them?

Thank you.

[Blason_R]

Those shows that firewall has 6 core - one is used for SND while 5 instances displays the connections are being handled by 5 worker cores. Due to CoreXL Fw spawns and utilizes multiple cores on firewall.

[PhoneBoy]

What is your precise method for testing speed?
What precise observations did you make on the gateways while attempting this speed test?
Super Seven output while the device is under test will help: https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40...

In any case, a single flow from a single system may not achieve full bandwidth you have available or the capacity of the appliance.
It is not necessarily indicative of a problem.

[Vladimir_S]

Hi PhoneBoy,

I ran speed test on couple random websites.

https://www.speedtest.net/

https://www.att.com/support/speedtest/

The gateway in production. I do not have a test gateway.

I noticed the bandwidth issue started when our ISP replaced the router and increased the bandwidth. So, the bandwidth in front of CP increased accordingly provider's service, but behind of CP was not changed.

Thank you,

Vlad.

[Blason_R]

Ok - Are you noticing RX_DROPs on that interface? and are those getting increased rapidly? Please provide output netstat -ni 2

and ethtool -S <interface_name>

then ethttool -g <interface_name>

[Vladimir_S]

Outputs of netstat -ni 2, ethtool -S and ethtool -g are attached.

[Blason_R]

Oh you ran the wrong netstat command. It should be netstat -ni 2 and not netstat ni 2. It looks like Buffer size is not set to max provided you are noticing too much rx-DRP

[Vladimir_S]

netstat -ni 2 attached.

[PhoneBoy]

I believe most of these speed test websites use a single TCP connection.
Which, as I noted before, is potentially problematic and won’t give you an accurate result of available bandwidth.
The output of the Super Seven commands are needed to confirm what is actually happening.

[Timothy_Hall]

You can install iperf3 on the firewall's Gaia OS directly, see here: Test bandwidth/speed from Gaia

However all this will measure is performance between the firewall itself and an iperf3 server, but not the actual throughput for traffic being fully inspected while crossing/transiting the firewall.  However this tool can be useful for finding network errors/bottlenecks outside the firewall itself.

[Vladimir_S]

Hi Timothy,

My next step to set iperf3 server on the WAN side, client on the LAN and run bandwidth test.

Thank you,

Vlad.

[Vladimir_S]

Hi Chris,

I attached three screenshots with: throughput, enabled blades and external interface configuration. Full duplex is enabled on both interfaces.
Yes, I tested involving multiple threads/connections and single host as well. The bandwith is the same in both tests.
There is one more detail. When ISP replaced their router and increased bandwidth it did not affect the LAN. LAN bandwidth is remaining 95 Mbps, WAN bandwidth increased up to 950 Mbps.

Vlad.

[PhoneBoy]

To even begin to determine definitely what is happening here, please answer the following questions:

• Output of the Super Seven commands I linked earlier in the thread while the device is under test
• The precise method you are using from your laptop to test bandwidth

My speculation, based on the very limited information you have provided this far, is you’re using a method that invokes a single heavy TCP stream.
This is called an elephant flow and is not in any way indicative of the overall bandwidth available for other traffic flowing through the gateway.

Note that we’ve made some improvements to handing elephant flows in R81.20 with HyperFlow.
However, it’s only supported on Check Point appliances, currently.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Chris_Atkinson]

What license is applied to this machine, is corexl enabled for multiple cores?

Refer also:

sk98871: HTTP-based speed test shows strong degradation in download speed when Anti-Virus is set to inspect all HTTP and HTTPS traffic

[Vladimir_S]

Chris, how to check if CoreXL is activated? I think we have only two core license. I read sk98871 and can try to stop Anti-Virus blade.

Also, I asked our account manager for a trial SecureXL license.

[Chris_Atkinson]

Suggest providing the info requested prior from @PhoneBoy regarding the S7 commands otherwise the following outputs from the gateway would be helpful short of the above.

fw ctl multik stat

cplic print

To manage/enable corexl (license permitting):

cpconfig > option 7 

[PhoneBoy]

You can generate your own eval license per the instructions here: https://community.checkpoint.com/t5/General-Topics/How-to-Request-an-Evaluation-License-for-Security...
The "All-in-One" eval should give you a license for 8 cores. 

If you only have a two core license, that will limit your performance substantially since only two cores will be used.

[Vladimir_S]

I applied trial "All-in-One" license. The license appeared in the Smart Console. Next, per instructions I restarted the Gateway and checked license status in the Smart Console right after. It was not there.

[Blason_R]

Thats really surprising!! What does your cplic print -x output says?

[Vladimir_S]

Oh🙂, please ignore my last post. I re-opened Smart Console, trial license still there.

[the_rock]

Im so glad you posted this, because in all my years dealing with CP, I could NEVER find a logical way to do this. I cant even count how many TAC cases I opened asking this question...I stopped counting after 15 probably (lol). Yes, its gotten better in R80+, but I still have customers asking me for something simple/easy.

[Chen_Muchtar]

Just to make sure we're aligned, pls see summary of bandwidth measurements at our GWs:

Single flow

1. Can be measured using CPVIEW -> Network -> Top-Connections
2. Notes:
   • May affect performance, hence only activated using sk167903 (enabling sim_top_conns_enable global parameter)
   • Since this is a secureXL view, slow path connections will not appear here, only fast path and medium path
     
   • In case a connection does not appear in the view above (aka: not one of the top used connections), you can calculate this info from the connection table, just run: fwaccel conns and calculate ‘host bytes’ divided by ‘duration’

Total throughput

Can be measured using CPView -> Network -> Interfaces -> Traffic (RX Traffic & TX Traffic TOTAL)

Additional option: use the CPVIEW -> Traffic -> Traffic Rate