CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


Tim Hall has done it again! He has just released the 2nd edition of "Max Power".
Rather than get into details here, I urge you to check out this announcement post.
It's a massive upgrade, and well worth checking out. -E

 

Results 1 to 11 of 11

Thread: checkpoint appliance and microburst

  1. #1
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default checkpoint appliance and microburst

    How does checkpoint appliance, the 13500 model, handle microburst traffics?

  2. #2
    Join Date
    2011-08-02
    Location
    http://spikefishsolutions.com
    Posts
    1,623
    Rep Power
    9

    Default Re: checkpoint appliance and microburst

    Quote Originally Posted by cciesec2006 View Post
    How does checkpoint appliance, the 13500 model, handle microburst traffics?
    It fully tastes the rainbow.

  3. #3
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default Re: checkpoint appliance and microburst

    Quote Originally Posted by jflemingeds View Post
    It fully tastes the rainbow.
    Is it a joke?

    How does checkpoint appliance or checkpoint running on open servers handle microburst traffics?

  4. #4
    Join Date
    2011-08-02
    Location
    http://spikefishsolutions.com
    Posts
    1,623
    Rep Power
    9

    Default Re: checkpoint appliance and microburst

    Quote Originally Posted by cciesec2006 View Post
    Is it a joke?

    How does checkpoint appliance or checkpoint running on open servers handle microburst traffics?
    My guess is rx_missed_errors and/or rx_no_buffer_count go up.

  5. #5
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default Re: checkpoint appliance and microburst

    Quote Originally Posted by jflemingeds View Post
    My guess is rx_missed_errors and/or rx_no_buffer_count go up.
    is the appliance robust enough to handle microburst traffics?

  6. #6
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default Re: checkpoint appliance and microburst

    Has anyone seen this problem with checkpoint firewall running either open servers or Checkpoint appliances? I can't be the only one with this issue.

  7. #7
    Join Date
    2009-04-30
    Location
    Colorado, USA
    Posts
    2,218
    Rep Power
    13

    Default Re: checkpoint appliance and microburst

    I assume you are referring to this:

    https://en.wikipedia.org/wiki/Micro-...8networking%29

    This is more a function of Gaia and its NIC drivers emptying the network ring buffers via SoftIRQ in a timely fashion (or not) and is not necessarily dependent on the specific hardware model. If the ring buffer is full and more frames arrive, an RX-DRP (as shown by netstat -ni) will occur. There is no Active Queue Management (AQM) available in the current Gaia kernel for network buffers (Priority Queuing is something completely different) and tail drops will occur if the ring buffer is full. The upcoming Gaia kernel update will have some AQM capabilities such as CoDel but whether they will be officially supported for use by Check Point is an open question.

    Mitigations to this are extensively covered in my book, and consist of (in order of preference):

    • Adding more SND/IRQ cores
    • Enabling Multi-Queue
    • Increasing ring buffer size (only as a last resort due to BufferBloat)
    • Increasing SoftIRQ CPU budget (not supported)
    Last edited by ShadowPeak.com; 2018-03-12 at 09:34.
    --
    Second Edition of my "Max Power" Firewall Book
    Now Available at http://www.maxpowerfirewalls.com

  8. #8
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default Re: checkpoint appliance and microburst

    I have a very interesting issue. I have 1350 appliances with R77.30 with latest GA JHFA.

    I see a lot of drops and rx-drop on the 10G interface even though peaks around 800Mbps. However, if I replace the 10G interface with a 1Gig interface for the same traffic and I see ZERO drops and ZERO rx-drop.

    How do you explain that?

    TIA.

  9. #9
    Join Date
    2009-04-30
    Location
    Colorado, USA
    Posts
    2,218
    Rep Power
    13

    Default Re: checkpoint appliance and microburst

    Quote Originally Posted by cciesec2006 View Post
    I have a very interesting issue. I have 1350 appliances with R77.30 with latest GA JHFA.

    I see a lot of drops and rx-drop on the 10G interface even though peaks around 800Mbps. However, if I replace the 10G interface with a 1Gig interface for the same traffic and I see ZERO drops and ZERO rx-drop.

    How do you explain that?

    TIA.
    Check status of Ethernet flow control function on the 1Gig interface.
    --
    Second Edition of my "Max Power" Firewall Book
    Now Available at http://www.maxpowerfirewalls.com

  10. #10
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default Re: checkpoint appliance and microburst

    Quote Originally Posted by ShadowPeak.com View Post
    Check status of Ethernet flow control function on the 1Gig interface.
    On a 10Gig interface:
    ethtool -a eth0
    Pause parameters for eth0:
    Autonegotiate: on
    RX: on
    TX: on


    On a 1Gig interface:
    ethtool -a eth8
    Pause parameters for eth8:
    Autonegotiate: on
    RX: on
    TX: off


    These are values that comes with installing R77.30. I do NOT make changes to them.

    What's next?

  11. #11
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default Re: checkpoint appliance and microburst

    I am still looking for solutions on this.

Similar Threads

  1. CheckPoint 750 flash alternative OS on appliance
    By FlashOver in forum Check Point Security Gateway Appliances
    Replies: 2
    Last Post: 2017-10-28, 21:16
  2. Upgrading Checkpoint appliance 2200 from R75.40 to R77.00
    By Shawshank in forum Installing And Upgrading
    Replies: 3
    Last Post: 2015-07-06, 03:57
  3. Checkpoint smart-1 210 appliance
    By oharek in forum Intermediate
    Replies: 2
    Last Post: 2015-03-12, 07:42
  4. Checkpoint UTM-1 appliance reboot
    By dhirajkapur in forum Miscellaneous
    Replies: 3
    Last Post: 2012-05-18, 10:53
  5. Checkpoint IP appliance upgrade ??
    By TommyBoay in forum Check Point IP Appliances and IPSO (Formerly Sold By Nokia)
    Replies: 4
    Last Post: 2011-06-14, 03:42

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •