- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Hello Guys
I am having trouble finding what does turning on/off vsx mode does to firewall cluster.
I have 2 members fully configured in cluster VSLS mode, running coreXL, few virtual-systems on it and soon in production. In many guides theres suggestion to turn off vsx mode before applying some commands which otherwise cannot be accepted. I only understand that vsx mode is "interface and routes configuration protection". But is there anything beyond human factor protection in CLI?
Subsequently, I have this problem:
automatic affinity on one cluster member is working fine, and it doesn't on another:
A:
eth1-01 : 8
eth1-02 : 8
eth1-03 : 0
eth1-04 : 8
eth2-01 : 0
eth2-04 : 8
eth2-05 : 0
eth2-08 : 8
eth3-01 : 0
eth3-02 : 0
B:
eth1-01 : 0
eth1-02 : 0
eth1-03 : 0
eth1-04 : 0
eth2-01 : 0
eth2-04 : 0
eth2-05 : 0
eth2-08 : 0
eth3-01 : 0
eth3-02 : 0
some CP article suggests checking "fw ctl multik get_mode" to see if dynamic dispatcher is on, but this command cannot be run in vsx mode:
Option not supported in VSX mode.
Edit: (there are 2 cores for vs:0 in my setup) after restarting and re-entering default affinity mode (automatic) all interfaces are assigned core 0 (I expected even distribution between cores 0, 8). There is no traffic passing interfaces yet.
Thank you
Tomas
Before risking my VSX VSLS configuration i would rather involve TAC !
Here's link to my cpx presentation on the subject of VSX optimisation
Hard to answer without having full details of the system.
As for vsx off - yes it's mainly to protect system from making silly mistakes in areas that are owned my management i.e routing and interfaces. You will learn to survive without it 🙂 can't remember last time I turned vsx off
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY