Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Timothy_Hall
Legend Legend
Legend

SecureXL Acceleration/Templating vs. Logging Config

So a point raised in another thread got me thinking: can just the logging configuration as specified in the Track column of any Access Control (including HTTPS Inspection) or Threat Prevention policy layer in the SmartConsole impact SecureXL Throughput Acceleration (i.e. make traffic take a less efficient processing path) or reduce SecureXL Accept Template formation?  Does SecureXL/sim/SND handling fully-accelerated traffic have more or less the same logging capabilities as a Firewall Worker Instance Core, and whatever logging option is selected won't force traffic out of SecureXL?

I'm well aware that specifying Accounting, Detailed and especially Extended logging in a layer's Track column will increase the gateway's logging load via fwd, but is there any way doing so will directly affect these two parts of SecureXL?  What about if sk101221: TCP state logging is enabled with a setting other than Never?

I'm pretty sure the answer here is no, but wanted to confirm.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
3 Replies
Chris_Atkinson
Employee Employee
Employee

Accounting does get a mention in sk32578 as a:

"Factors that adversely affect SecureXL performance"

Impact: Disables Delayed Notifications for this rule. (R80.10 and below per: sk98722)

Outside of this only "bug" scenarios come to mind but perhaps others may know differently...

CCSM R77/R80/ELITE
PhoneBoy
Admin
Admin

Keep in mind that anything that requires Detailed/Extended Logging will be in Medium Path by default anyway.
Accounting has been SecureXL friendly for a while now.
Pretty sure the basic state information is also available via SecureXL, thus shouldn’t prevent the traffic from being accelerated.

the_rock
Legend
Legend

I know exactly the topic, just cant find the link now, but it was @Wolfgang who brought that up I believe. Anyway, cant speak for others, but looking at this for 3 customers recently and comparing fwaccel stats outputs with accounting in heavily hit rules and without, I did not see any difference at all.

Btw, pretty sure this was it:

https://community.checkpoint.com/t5/General-Topics/https-inspection-performance-issue-F2F-traffic-82...

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events