How does checkpoint appliance, the 13500 model, handle microburst traffics?
CPUG: The Check Point User Group | |
Resources for the Check Point Community, by the Check Point Community.
| |
Tim Hall has done it again! He has just released the 2nd edition of "Max Power". | |
|
How does checkpoint appliance, the 13500 model, handle microburst traffics?
Has anyone seen this problem with checkpoint firewall running either open servers or Checkpoint appliances? I can't be the only one with this issue.
I assume you are referring to this:
https://en.wikipedia.org/wiki/Micro-...8networking%29
This is more a function of Gaia and its NIC drivers emptying the network ring buffers via SoftIRQ in a timely fashion (or not) and is not necessarily dependent on the specific hardware model. If the ring buffer is full and more frames arrive, an RX-DRP (as shown by netstat -ni) will occur. There is no Active Queue Management (AQM) available in the current Gaia kernel for network buffers (Priority Queuing is something completely different) and tail drops will occur if the ring buffer is full. The upcoming Gaia kernel update will have some AQM capabilities such as CoDel but whether they will be officially supported for use by Check Point is an open question.
Mitigations to this are extensively covered in my book, and consist of (in order of preference):
- Adding more SND/IRQ cores
- Enabling Multi-Queue
- Increasing ring buffer size (only as a last resort due to BufferBloat)
- Increasing SoftIRQ CPU budget (not supported)
Last edited by ShadowPeak.com; 2018-03-12 at 09:34.
I have a very interesting issue. I have 1350 appliances with R77.30 with latest GA JHFA.
I see a lot of drops and rx-drop on the 10G interface even though peaks around 800Mbps. However, if I replace the 10G interface with a 1Gig interface for the same traffic and I see ZERO drops and ZERO rx-drop.
How do you explain that?
TIA.
On a 10Gig interface:
ethtool -a eth0
Pause parameters for eth0:
Autonegotiate: on
RX: on
TX: on
On a 1Gig interface:
ethtool -a eth8
Pause parameters for eth8:
Autonegotiate: on
RX: on
TX: off
These are values that comes with installing R77.30. I do NOT make changes to them.
What's next?
I am still looking for solutions on this.
Bookmarks