R81.x Architecture and Performance Tuning - Link Collection

[HeikoAnkenbrand]

Architecture

- R8x - Security Gateway Architecture (Logical Packet Flow)
- R8x - Security Gateway Architecture (Logical Packet Flow) - Update R80.20+
- R8x - Security Gateway Architecture (Content Inspection)
- R8x - Security Gateway Architecture (Acceleration Card Offloading)
- R8x - Ports Used for Communication by Various Check Point Modules
- R8x - How does the Medium Path (PXL) and Content Inspection work with R80
- R8x - ClusterXL CCP Encryption (R80.30+)
- R8x - SNI vs. enabled HTTPS Interception
- R8x - Policy Installation Flowchart 

Performance tuning TIP's

- R8x - Performance Tuning Tip - Intel Hardware
- R8x - Performance Tuning Tip - AES-NI
- R8x - Performance Tuning Tip - SMT (Hyper Threading)
- R8x - Performance Tuning Tip - Multi Queue
- R8x - Performance Tuning Tip - Connection Table
- R8x - Performance Tuning Tip - Elephant Flows (Heavy Connections)
- R8x - Performance Tuning Tip – User Mode Firewall vs. Kernel Mode Firewall  
- R8x - Performance Tuning Tip - Dynamic split of CoreXL in R80.40 
- R8x - Performance Tuning Tip - SecureXL Fast Accelerator  (R80.20 JHF103+)
- R8x - Performance Tuning Tip - DDoS „fw sam“ vs. „fwaccel dos“ 
- R8x - Performance Tuning Tip - SNI vs. https inspection
- R8x - Performance Tuning Tip - Control SecureXL / CoreXL Paths
- R8x - Performance Tuning Tip - BIOS
- R8x - Performance Tuning Tip - CPU Spike Detective  (R80.40 JHF69+)
- R8x - Performance Tuning Tip - Management Data Plane Separation  (R80.30 kernel 3.10 and JHF 136+)
- R8x - Performance Tuning Tip - SND vs. CoreXL 
- R8x - Performance Tuning Tip - Disable all Debug Settings
- R8x - Performance Tuning Tip – HyperFlow  
- R8x - Performance Tuning Tip - Maestro Autoscaling (R81.20+) 
- R8x - Performance Tuning Tip - Maestro Fast Forwarding (R81.20+) 
- R8x - Performance Tuning Tip – Lightspeed Appliance (R81.10 + JHF) 

Performance tuning informations

- R80.x - Top 20 Gateway Tuning Tips 
- R80.x - Gateway Performance Metrics 
- R80.x - Performance Tuning and Debug Tips - fw monitor
- R80.x - Performance Tuning and Debug Tips - TCPDUMP vs. CPPCAP
- R80.x - High Performance Firewalls - ESX vs. Open Server
- R80.x - High Performance Gateways and Tuning
- R80.x - Falcon Modules and R80.20
- R80.x - Performance Tuning - Link Collection
- R81.x - Multi-Queue (what is new) 

Cheat sheets

- R80.x - cheat sheet - fw monitor
- R80.x - cheat sheet - ClusterXL

Easy Tools

- Easy execute CLI commands from management on gateways
- Easy execute CLI commands on all gateways simultaneously
- Easy Mobile User License Tool - replaced "dtps lic" 
- Easy Backup Tool - (migrate export + all GAIA configs)
- Easy View Tool - View System Info for All Gateways Simultaneously
- Easy VPN Debug Tool 
- Easy Tool Collection
- Easy Tool - Real time connection table analysis v1.0
- Easy Tool - Real time connection table analysis v4.0

ClusterXL

- R80.20 - new ClusterXL commands
- R80.20 - More ClusterXL State Information
- R80.30 - ClusterXL CCP Encryption
- R80.x - ClusterXL Installation - OpenServer, Appliance, OpenStack, KVM, ESXi, NSX, AWS, ACI, Azure...

SecureXL

- R80.20 - New FW Monitor inspection points
- R80.20 - SYN Defender on SecureXL Level
- R80.20 - IP blacklist in SecureXL
- R80.20 - New Chain Modules?
- R80.20 - SecureXL + new chain modules + fw monitor

CoreXL

- R80.x - Security Gateway Architecture (Logical Packet Flow)
- R80.x - Security Gateway Architecture (Content Inspection)
- R80.x - More then 40 Cores for CoreXL
- R80.x - User-Mode Firewall and performance impact

VSX

- R80.x - VSX Affinity 

Management Server, MDS and SmartConsole

- R80.20 - Portable SmartConsole + Tips and Tricks
- R80.10 - Syslog Exporter
- R80.20 - Multiple SmartConsole sessions
- R80.x   - Debug policy installation on gateway
- R80.x   - MDS Upgrade failing from R80.10 to R80.30
- R80.x   - Policy Installation Flowchart 
- R80.x   - Mobile User License Tool - replaced "dtps lic" 
- R80.x   - One-liner for Remote Access VPN License Summary 

Sandblast and TEX

- Fortigate Firewall ICAP and Sandblast (TEX)
- Symantec (Bluecoat) SG ICAP and Sandblast (TEX)
- ICAP and Sandblast Appliance

R80.10+

- R80.10 - Syslog Exporter
- R80.10 - Bash script to show IP ranges for countrys from GeoProtection (new version)
- R80.10 - GEO Location Objects in Firewall Policy (with Dynamic Objects)
- R80.10 - User-Mode Firewall and performance impact

R80.20+

- R80.20 - new interesting commands
- R80.20 - Performance Tuning Tip - DDoS „fw sam“ vs. „fwaccel dos“
- R80.20 - New FW Monitor inspection points
- R80.20 - SYN Defender on SecureXL Level
- R80.20 - IP blacklist in SecureXL
- R80.20 - New Chain Modules?
- R80.20 - SecureXL + new chain modules + fw monitor
- R80.20 - SecureXL - new names in "/proc/ppk/statistics"?
- R80.20 - Portable SmartConsole + Tips and Tricks
- R80.20 - New daemon or processes under R80.20!
- R80.20 - New SecureXL path in R80.20 (CPASXL)
- R80.20 - More then 40 Cores for CoreXL
- R80.20 - Updatable Domain Objects and CLI Commands
- R80.20 - SNI vs. enabled HTTPS Interception 

R80.30+

- R80.30 - new interesting commands
- R80.30 - ClusterXL CCP Encryption
- R80.30 - Swiss Army Knive IPMITOOL for GAIA
- R80.30 - High Performance Firewalls - ESX vs. Open Server

R80.40+

- R80.40 - new interesting commands 
- R80.40 - automatically changes the number of CoreXL SNDs, Firewall instances and the Multi-Queue
- R80.40 - Dynamic split of CoreXL SND and FW
- R80.40 - Processes
- R80.40 - Multi Queue on VMWare vmxnet3 drivers
- R80.40 - Performance Tuning Tip - CPU Spike Detective

R81

- R81.x  - new interesting commands

- R81.x  - VXLAN and ClusterXL 
- R81.x  - new features - video
- R81.x  - Multi Queue (what is new) 
- Face recognition with R81 
- RFID token authentication with R81

R81.10

- PSL inline vs pipeline?

CLI

- GAIA - Easy execute CLI commands from management on gateways
- GAIA - Easy execute CLI commands on all gateways simultaneously
- GAIA - Create snapshots or backups on all gateways with one CLI command.
- GAIA - Backup all clish configs from all gateways with one CLI command
- CLISH Commands in Expert Mode easier
- "fw ctl zdebug" Helpful Command Combinations
- Check Inbound and Outbound TCP Sequece Numbers on R80.20+
- R80.20 - new interesting commands
- R80.30 - new interesting commands
- ccp_analyzer - what is it!
- Check Point - HEX to IP Converter Tool?
- R80.30 - Swiss Army Knive IPMITOOL for GAIA

ONELINER

- ONELINER - Show Address Spoofing Networks via CLI
- ONELINER - Interface speed and duplex as list
- ONELINER - Show VPN Routing on CLI
- ONELINER - process utilization per core
- ONELINER - SecureXL and CoreXL AVG Load
- ONELINER - Interfaces with RX-ERR, RX-DRP and RX-OVR Errors 
- ONELINER - All Physical Interface States in one Overview 
- ONELINER - Firewall User Mode vs. Kernel Mode 
- ONELINER - CLISH Commands in Expert Mode easier 
- ONELINER - Easy VPN Debug 
- ONELINER - Easy VPN Debug - with VPND live view 
- ONELINER - Easy VPN Debug - with IKE live view 
- ONELINER - Easy Debug 
- ONELINER - Show all Kernel Parameters and their Values  
- ONELINER - Endpoint Versions
- ONELINER - Show all Kernel Parameter
- ONELINER - Show all SecureXL Parameter
- ONELINER - Show all Gateway Registry Parameter 
- ONELINER - Show all Gateway Parameter >>> Registry, Kernel, SecureXL 
- ONELINER - Formatted Connection Table 

Script

- Bash script to show IP ranges for countrys from GeoProtection (new version)
- GEO Location Objects in Firewall Policy (with Dynamic Objects)

Cloud

- Overview - Cloud Feature Terms
- R80.30 Azure CloudGuard - Links and SK's
- CloudGuard VMSS instance and logging (on premise SMS)  
- Public Preview CloudGuard Gateway

Maestro

- Maestro - Dual Side 
- Maestro - Connection Acceleration at the MHO
- Maestro - g_tcpdump performance impact
- Maestro - Performance Tuning Tip - Maestro Autoscaling (R81.20+)
- Maestro - Performance Tuning Tip - Maestro Fast Forwarding (R81.20+) 

More

- Appliance model from CLI and dmidecode with full model list
- VoIP Issue and SMB Appliance (600/1000/1200/1400)
- High CPU utilization during process fwk0_dev_0 (UMFW vs. KMFW) 
- Password reset - Collection
- One-liner collection
- Check and config SSHv1 or SSHv2 on GAIA
- Top100 - Check Point Terms Overview for Debug
- R81 is now available
- Face recognition with R81 
- RFID token authentication with R81
- Homekit (Siri) integration with R81 Dynamic Objects  
- Config - Arista Macro Segmentation Service (MSS) + Check Point 
- Disable Stateful Inspection 
- Checkmates Happy New Year 2022 - Screwdriver  

More interesting articles and books

Over the last years I had a very good cooperation and exchange of knowledge with @Timothy_Hall. Therefore I recommend you to read this book about Check Point Performance Tuning.

- Max Power 2020

Why these articles

I wrote my first article on R80.x firewall architecture a year ago. After many hours in the lab with R80.10, R80.20, R80.30 and R80.40 many long evenings, another approximately 40 articles were added.

Because I lost the overview of my articles, here is a list of links to the most interesting articles with the topics:
- R80.x performance tuning
- R80.x architecture
- R80.x new CoreXL, SecureXL and ClusterXL functions

I hope I can help you with interesting information about R80.x!

Thanks to everyone who contributed to the Checkmates forum and to the Check Point R&D guys as well as the Chackmates team and thanks to all who voted this article as Post of the Year 2019. 

[Jan_Elbers]

Looks like a lot of work.

Thank you.

Jan

[Maarten_Sjouw]

Wow, a master Cheat-Sheet of Cheat-Sheets

[Levin_Swizell]

Great master Cheat-Sheet

Regards
Levin

[spiros-p]

yes a master cheat sheet:-)

[Will_Wells]

wow

[PhoneBoy]

Marked as featured

[HeikoAnkenbrand]

Nice!
Thanks

Heiko

[Ulf_Wegner]

This is a great link overview. Much work to write all these articles.

Thanks from me!

[Patricia_OSulli]

Hi @HeikoAnkenbrand 

This is an interesting link overview. That would be great if we could do that on other topics too. Then you will find interesting articles on topics faster.

[James_Hawkins]

Nice link collection!

Thanks

James

[Metehan_Doglali]

great link collection

[J__Bourgeois]

Are the articles all from you @HeikoAnkenbrand?

[HeikoAnkenbrand]

Yes!

[J__Bourgeois]

Are the articles all from you @HeikoAnkenbrand?

[SChalhoub]

Really good job.

Tks.

[Sergey_Kozlov]

Nice collection of links!

[Ilan_Khoushy]

Nice!

[Tomer_Sole]

Very impressive collection! I would like to add https://sc1.checkpoint.com/documents/R80.10/Performance/R80.10-performance-guide.html

[Tobias_L]

Yea, very impressive collection! Looks like a lot of work.

[Tanguy_Dufour]

From these link collections we should have more then the forum will be clearer.

[_Val_]

@Tanguy_Dufour what are you trying to say?

[Daniel_Hainich]

Hello Heiko,

that was a lot of work - Thanks very much!

[Paul_Erez]

Great job😀.

[HeikoAnkenbrand]

Now new links are added.

[Uta_Rowzee]

Nice link collection. We need more of this collections.

Regats

Uta

[Guy_Ozyl]

We need more link Collections:-)

[Morris_Nelka]

👍🏻

[Achim_Dehio]

You spent a lot of time on all those articles.

Great job keep up the good work.

[HeikoAnkenbrand]

Now with R80.40 update:-)