Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Sam2
Contributor

FW Accel Conns 0%

Jump to solution

Hi Team, 

I have a firewall running R81 with take 44 that currently has 0% accelerated conns, see output below: 

   Accelerated conns/Total conns : 22/37423 (0%)
   Accelerated pkts/Total pkts : 131018190109/134923281770 (97%)
   F2Fed pkts/Total pkts : 3905091661/134923281770 (2%)
   F2V pkts/Total pkts : 982863959/134923281770 (0%)
   CPASXL pkts/Total pkts : 1466487054/134923281770 (1%)
   PSLXL pkts/Total pkts : 128928729017/134923281770 (95%)
   CPAS pipeline pkts/Total pkts : 0/134923281770 (0%)
   PSL pipeline pkts/Total pkts : 0/134923281770 (0%)
   CPAS inline pkts/Total pkts : 0/134923281770 (0%)
   PSL inline pkts/Total pkts : 0/134923281770 (0%)
   QOS inbound pkts/Total pkts : 0/134923281770 (0%)
   QOS outbound pkts/Total pkts : 0/134923281770 (0%)
   Corrected pkts/Total pkts : 0/134923281770 (0%)

Reviewing fw accel stat does not show that templating should be disabled, 

   +---------------------------------------------------------------------------------+
   |Id|Name |Status |Interfaces |Features |
   +---------------------------------------------------------------------------------+
   |0 |SND |enabled |eth1,eth5,eth2,eth3,eth4,|Acceleration,Cryptography |
   | | | |Sync,Mgmt | |
   | | | | |Crypto: Tunnel,UDPEncap,MD5, |
   | | | | |SHA1,3DES,DES,AES-128,AES-256,|
   | | | | |ESP,LinkSelection,DynamicVPN, |
   | | | | |NatTraversal,AES-XCBC,SHA256, |
   | | | | |SHA384,SHA512 |
   +---------------------------------------------------------------------------------+

   Accept Templates : enabled
   Drop Templates : disabled
   NAT Templates : enabled

enabled blades output: 
fw urlf av appi ips anti_bot ThreatEmulation Scrub

I have reviewed sk32578 and the policy does not include anything that would impact connection templating. For my TP blades, we are using the autonomous policy with the edge profile. I am using updateable objects for both azure and o365, and I have them at the top of my rulebase, is there a chance that they impact secureXL?

 

0 Kudos
1 Solution

Accepted Solutions
3 Replies
Ben_Maoz
Employee
Employee

Hi Sam2,

Please note " Accelerated conns/Total conns"  means fully accelerated connections.

As you can see "PSLXL pkts/Total pkts : 128928729017/134923281770 (95%)"  so most of your traffic is accelerated but not fully accelerated (Medium path).

Thanks,

Ben

HeikoAnkenbrand
Champion
Champion
Timothy_Hall
Champion
Champion

As Ben and Heiko said throughput acceleration via the Medium Path is working fine.  The zero Accelerated Conns rate just means that SecureXL is not doing Accept templates at all even though fwaccel stat shows that there is no rule disabling templating.  Generally I believe this is caused by Anti-bot being enabled, as SecureXL itself cannot perform the IP reputation checks for Accept templates that is required when Anti-bot is enabled.  With the advent of Column-based matching in R80.10 Accept templating rates are much less important than they used to be for most environments, so I wouldn't worry about it.

New 2021 IPS/AV/ABOT Immersion Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com
0 Kudos