SecureXL UPPAK Mode for Lab?

[Timothy_Hall]

Similarly with what happened to the Firewall Worker Instances being moved out of the kernel into processes (called USFW), SecureXL is in the process of being moved out of the kernel as well (called UPPAK).  Currently, only systems with a Lightspeed card and the new 9000 series will be utilizing UPPAK mode, while all other gateways will continue to have SecureXL in the kernel for now (called KPPAK).

Question: Is it possible to force UPPAK mode for testing/lab purposes only on a system that does not currently support it?  My question is specific to VMWare gateways utilizing the vmxnet3 driver.  This may actually not be possible at all since it appears UPPAK extends its tendrils into the Gaia networking driver code in ways not seen before (sk181564: Differences using the 'ethtool' command with SecureXL Kernel Mode (KPPAK) and User Mode (U...) as well as shifting away from an interrupt-driven approach to "poll mode", which dramatically changes how CPU resources are utilized by the SND cores (sk180299: Linux commands report high CPU Load Average when SecureXL works in the User Space (UPPAK) ...).

As I mentioned UPPAK for the moment may require the presence of certain hardware or network drivers that can't be readily simulated in a virtual machine, so this may simply not be possible at the present time.  Tagging @Val for an R&D assist.  Thanks! 

[HeikoAnkenbrand]

If you change the Firewall mode from User Mode (USFW) to Kernel Mode (KSFW), then SecureXL mode changes from the User Mode (UPPAK) to the Kernel Mode (KPPAK) and vice versa.

More read here:
100G_Ports_AdminGuide 

You can change the current SecureXL mode between Kernel Mode (KPPAK) and User Mode (UPPAK):
1) Run
# cpconfig
2) Enter the number of the Check Point SecureXL option. The menu shows the current SecureXL mode.
3) Enter the number of the "Change SecureXL Mode" option.
4) Exit from the cpconfig menu.
5) Reboot

If you want to test this under VMWare, you can create a 19000 appliance from a VMWare system in /etc/appliance_config.xml file and after rebooting, manually load out-of-tree modules using the insmod command "insmod </PATH/TO/MODULE.ko>". If the kernel module from Nvidia is not installed, SecureXL will not be started in user mode;-)

It is also possible to set the parameter "SxlIsUsermode" with the "cpprod_util" to "1" in the firewall start script.

I didn't want to write more detailed information in the community about exactly how it works.

I have changed it in the LAB. However, as the network drivers do not correspond, there are many unwanted side effects.

Without side effects, you can only test it on real appliances:
19000, 29000, MLS LightSpeed, QLS LightSpeed

[Timothy_Hall]

Thanks Heiko, I encountered the same driver dependency issues and it looks like UPPAK isn't currently compatible with the vmxnet3 driver (or of course the ancient e1000 driver which will be deprecated for R82).  I did manage to actually panic the gateway at boot time by trying to force UPPAK enabled under the hood.  We will see if R&D has some secret switch or patch that will enable compatibility with vmxnet3, but for now I have put in a request to my local SE team to see if they can get me a loaner 9000/19000/29000 from the demo pool.  Thanks!

[HeikoAnkenbrand]

I think that PPAK will run in user mode for all appliances with R82.x... in the future. It makes no sense for me to develop kernel software and user mode software parallel.

Perhaps @Dorit_Dor  can also answer this question.

[Gera_Dorfman]

UPPACK is going to be our only mode in the future. 

Right now QLS appliances and Force appliances are using UPPACK.

Regarding older appliances / virtual machines and open servers UPPACK support  - still not fully supported / tested . 

[HeikoAnkenbrand]

@Gera_Dorfman 
It also makes sense to only use UPPACK in future and not to develop both twice.
Thanks for the info.

[PhoneBoy]

Right now UPPAK is only for QLS (i.e. those specific cards).
While I can't say for certain, I suspect it is not in a mainstream release yet, thus not something you can enable.
I would expect this in R82.