Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Timothy_Hall
Champion
Champion

R81.20 Gaia Kernel Update?

So it would appear that the version of the Gaia kernel was updated in R81.20 to 3.10.0-1160.15.2cpx86_64 from the older 3.10.0-957.21.3cpx86_64 which maps from RHEL 7.6 to RHEL 7.9.  

Were there specific reasons Check Point decided to update the kernel in this release beyond getting the latest package updates (most of which are stripped out by Check Point anyway as part of Gaia hardening), some stronger Gaia ciphers, and support for the latest hardware (storage controllers, NICs, etc)? 

One area of interest in the RHEL release notes: it appears the NIC driver versions for igb/ixgbe/i40/mlx_core have all been updated.  While this is generally a good thing (and I know that NIC drivers are sometimes updated in Jumbo HFAs) this has been an area of concern in the past in regards to performance & stability and sometimes even behavioral changes.  An example of the latter is sudden RX-DRPs appearing when Gaia 3.10 was first deployed due to unknown EtherTypes detailed in sk166424: Number of RX packet drops on interfaces increases on a Security Gateway R80.30 and higher ...

I looked through the RHEL 7.7-7.9 release notes and didn't see any new interesting capabilities or commands directly relevant to how Gaia is used to run Check Point software, does R&D care to share any tips or tricks present in this kernel update?  Tagging @PhoneBoy 

IPS/AV/ABOT Immersion & Max Capture: Know your Packets
Self-Guided Video Series available at www.maxpowerfirewalls.com
3 Replies
PhoneBoy
Admin
Admin

I suspect the main reasons for updating the Linux kernel are:

  • Updated drivers for hardware and NICs for future appliances, newer Open Servers, and virtualization environments (not all of which may be packportable).
  • Ability to support newer versions of userspace tools like OpenSSH.
  • For future capabilities not yet announced.

Longer term, I suspect we'll see more frequent updates to the Linux kernel included in Gaia.
It probably won't happen with every release, but it will definitely happen more frequently than during the 10+ year stretch where the Linux 2.6 kernel was used.

0 Kudos
Timothy_Hall
Champion
Champion

Thanks.  The updating of the Gaia kernel is a relatively rare event, and I was wondering if there were any reasons not part of the standard ones you listed.  Gotta admit I get a little nervous whenever the NIC drivers get touched as there have been some issues introduced in the past such as soft lockups, TCP offloads, improper traffic balancing of multiple queues, Emulex/Broadcom NIC issues, etc.

IPS/AV/ABOT Immersion & Max Capture: Know your Packets
Self-Guided Video Series available at www.maxpowerfirewalls.com
0 Kudos
PhoneBoy
Admin
Admin

None that I'm aware of anyway 🙂

0 Kudos