I have tested a lot in the lab with vsx and affinity over the last days. Now a question has come up which I cannot explain 100%.
Way 1:
When I search the internet, they all say that the CoreXL instances must be assigned to the Core's. Typical assignment:
fw ctl affinity -s -d -vsid 0 -cpu 1
fw ctl affinity -s -d -vsid 1 -cpu 1
fw ctl affinity -s -d -vsid 2 -cpu 2
fw ctl affinity -s -d -vsid 3 -cpu 3
After that my affinity looks like this:
![vsx2.JPG vsx2.JPG](https://community.checkpoint.com/t5/image/serverpage/image-id/6821i5BE93EA372738198/image-size/large?v=v2&px=999)
Way 2:
From my point of view, it would be better to distribute the fwk process to the cores as well. For this purpose I have set the following:
fw ctl affinity -s -d -pname fwk -vsid 0 -cpu 1
fw ctl affinity -s -d -pname fwk -vsid 1 -cpu 1
fw ctl affinity -s -d -pname fwk -vsid 2 -cpu 2
fw ctl affinity -s -d -pname fwk -vsid 3 -cpu 3
Here the affinity looks as follows:
![vsx3.JPG vsx3.JPG](/t5/image/serverpage/image-id/6822i3FFD97D96410372C/image-size/large?v=v2&px=999)
Now the question arises for me, which of the two ways is the better one?
PS:
Top shows the fwkX processes:
![vsx4.JPG vsx4.JPG](https://community.checkpoint.com/t5/image/serverpage/image-id/6823i3AEF6FBF4C613BC4/image-size/large?v=v2&px=999)
A small calculation sample for the utilization of process fwkX:
![vsx5.JPG vsx5.JPG](https://community.checkpoint.com/t5/image/serverpage/image-id/6824iCBC49D8B0712C9E0/image-dimensions/706x90?v=v2)
- fwk0_X -> fw instance thread that takes care for the packet processing
- fwk0_dev_X -> the thread that takes care for communication between fw instances and other CP daemons
- fwk0_kissd -> legacy Kernel Infrastructure (obsolete)
- fwk0_hp -> (high priority) cluster thread
➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips