Monitoring the 100G Ports

For more information about the CPView Tool, see sk101878.

Viewing the Hardware Information for 100G Cards in CPView Tool

Step

Instructions

1

Connect to the command line on the Security Gateway.

2

Run:

cpview

3

From the top, click SysInfo.

4

In the output, refer to the section Hardware Information > sub-section Devices.

Example output (truncated):

|----------------------------------------------------------------------------
| CPVIEW.SysInfo                                                             
|----------------------------------------------------------------------------
| Overview SysInfo Network CPU I/O Software-blades Hardware-Health Advanced  
|----------------------------------------------------------------------------
| Configuration Information:                                                 
|                                                                            
| Platform                      Gaia 64Bit                                   
| Configuration                 Check Point Security Gateway                 
| CoreXL Status                 On                                           
| CoreXL instances              43                                           
| Dynamic Balancing Status      Off                                          
| SecureXL Status               On                                           
| USFW Status                   On                                           
| UPPAK Status                  On                                           
| ---------------------------------------------------------------------------
| General information:                                                       
|                                                                            
| System uptime                 11 days, 18:39:10                            
| Last policy install time      25Aug2022 19:10:00                           
| Last policy name              Standard                                     
| ---------------------------------------------------------------------------
| Version Information:                                                       
|                                                                            
| fw1_wrapper package version   R81.10                                       
|                                                                            
|                Branch Name    Build Number                                 
| FW User Mode   XXX            XXX                                          
| FW Kernel      XXX            XXX                                          
| Accel Module   XXX            XXX                                          
| Adpdrv Module  XXX            XXX                                          
| SIM Module     XXX            XXX                                          
| ---------------------------------------------------------------------------
| Hardware Information:                                                      
|                                                                            
| HW Model  Quantum LightSpeed QLS250                                        
|                                                                            
| Devices              Type                Slot      Status    Firmware      
| Expansion-1          2x100GbE LightSpeed 1         Connected 22.31.2302

Viewing the 100G Ports in CPView Tool

Step

Instructions

1

Connect to the command line on the Security Gateway.

2

Run:

cpview

3

From the top, click Network > Interfaces > Overview.

4

In the output, refer to the column Driver.

The 100G Ports use the mlx5_core driver.

Example output (truncated):

|-----------------------------------------------------------------------------------------------------------------------------
| CPVIEW.Network.Interfaces                                                                                                   
|-----------------------------------------------------------------------------------------------------------------------------
| Overview SysInfo Network CPU I/O Software-blades Hardware-Health Advanced                                                   
|-----------------------------------------------------------------------------------------------------------------------------
| Traffic Distribution Interfaces Top-Protocols Top-Connections LightSpeed-Top-Connections Templates                          
|-----------------------------------------------------------------------------------------------------------------------------
| Overview Traffic                                                                                                            
|-----------------------------------------------------------------------------------------------------------------------------
| Interface Information:                                                                                                      
|                                                                                                                             
| Interface      State     Type      Port      Driver    Firmware                  Speed     IPv4               IPv6          
| lo             On        loopback  N/A       N/A       N/A                       N/A       127.0.0.1/8        Not Configured
| Mgmt           On        ethernet  TP        igb       1.63, 0x8 0.0.0           10000M    192.168.3.59/24    Not Configured
| eth5-01        On        ethernet  OTHER     mlx5_core 22.31.2302                N/A       Not Configured     Not Configured
| eth5-02        On        ethernet  OTHER     mlx5_core 22.31.2302                N/A       Not Configured     Not Configured
| eth5-03        On        ethernet  OTHER     mlx5_core 22.31.2302                N/A       Not Configured     Not Configured
| eth5-04        On        ethernet  OTHER     mlx5_core 22.31.2302                N/A       Not Configured     Not Configured

Viewing the SecureXL Status for 100G Ports

Step

Instructions

1

Connect to the command line on the Security Gateway.

2

Run:

fwaccel stat

3

In the output, refer to these rows:

  • LightSpeed Accel

    Shows the state of the 100G Port acceleration.

  • LightSpeed Low Latency Mode

    Shows how the Host Appliance offloads the connections to the 100G Ports.

Example output:

+---------------------------------------------------------------------------------+
|Id|Name     |Status     |Interfaces               |Features                      |
+---------------------------------------------------------------------------------+
|0 |UPPAK    |enabled    |Mgmt,mlx7-01,mlx7-02,    |Acceleration,Cryptography     |
|  |         |           |mlx4-01,mlx4-02,mlx5-01, |                              |
|  |         |           |mlx5-02,mlx1-01,mlx1-02, |Crypto: Tunnel,UDPEncap,MD5,  |
|  |         |           |eth7-01,eth7-02,eth4-01, |SHA1,3DES,DES,AES-128,AES-256,|
|  |         |           |eth4-02,eth5-01,eth5-02, |ESP,LinkSelection,DynamicVPN, |
|  |         |           |eth1-01,eth1-02          |NatTraversal,AES-XCBC,SHA256, |
|  |         |           |                         |SHA384,SHA512                 |
+---------------------------------------------------------------------------------+
Accept Templates : enabled
Drop Templates   : disabled
NAT Templates    : enabled
LightSpeed Accel : enabled
LightSpeed Low Latency Mode : disabled

Notes:

  • By default, the Host Appliance starts to offload the connection to the 100G Ports only after 10 megabytes of traffic passes in this connection.

  • An Administrator can enable the "LightSpeed Low Latency Mode", in which the Host Appliance starts to offload the connection to the 100G Ports immediately when this connection opens.

  • To change the state of the LightSpeed Low Latency Mode, run:

    fwaccel low_latency {on | off}

    This command:

    • Applies immediately

    • Does not require a reboot

    • Survives a reboot

Viewing the Summary

Note - This output is intended for Check Point Support only.

Step

Instructions

1

Connect to the command line on the Security Gateway.

2

Log in to the Expert mode.

2

Run:

ls_info

Example:

[Expert@Appliance:0]# ls_info
LightSpeed Information:

Number of SmartNIC cards: 4
mlx7-01 firmware-version: 22.31.2302
mlx7-02 firmware-version: 22.31.2302
mlx4-01 firmware-version: 22.31.2302
mlx4-02 firmware-version: 22.31.2302
mlx5-01 firmware-version: 22.31.2302
mlx5-02 firmware-version: 22.31.2302
mlx1-01 firmware-version: 22.31.2302
mlx1-02 firmware-version: 22.31.2302

This is Check Point CPinfo Build 914000227 for GAIA
[PPACK]
        HOTFIX_R81_10_JHF_MAIN       Take:  96

Blades enabled:
fw

Firewall is User mode
SecureXL is in User mode

SecureXL and HW accel status:
|UPPAK |enabled
LightSpeed Accel : enabled (Cards:enabled,enabled,enabled,enabled)
LightSpeed Low Latency Mode : enabled

Dynamic Balancing is currently Off

#fwaccel stats -s
Accelerated conns/Total conns    : 31/31 (100%)
LightSpeed conns/Total conns     : 0/31 (0%)
Accelerated pkts/Total pkts      : 100712/3848813 (2%)
LightSpeed pkts/Total pkts       : 0/3848813 (0%)
F2Fed pkts/Total pkts            : 3748101/3848813 (97%)

#fwaccel stats (cumulative)
hw accel inbound bytes                   0    hw accel packets                         0
hw accel outbound bytes                  0    hw accel conns                           0
hw accel total conns                     0    hw accel tcp conns                       0
hw accel non-tcp conns                   0

LightSpeed Connection Count
Total LightSpeed Conns: 0
LightSpeed Accounting Conns: 0
LightSpeed PXL Conns: 0
LightSpeed Other Conns (all other flags except A,S,N,L): 0

Ipsctl Errors/Drops
net:dev:adp:ipsctl:slot:1:kern:ipsctl:stats:errors:registration = 1
net:dev:adp:ipsctl:slot:1:cpu:0:nip:ingress:stats:rx_vlan_drop = 3
net:dev:adp:ipsctl:slot:1:nip:rx_vlan_drop = 3
net:dev:adp:ipsctl:slot:1:fwk_snd:cpu:11:stats:fw_pkt_drops = 10
net:dev:adp:ipsctl:slot:1:fwk_snd:cpu:37:stats:fw_pkt_drops = 3
net:dev:adp:ipsctl:slot:1:fwk_snd:cpu:36:stats:fw_pkt_drops = 17
net:dev:adp:ipsctl:slot:1:fwk_snd:cpu:39:stats:fw_pkt_drops = 21
net:dev:adp:ipsctl:slot:1:fwk_snd:cpu:38:stats:fw_pkt_drops = 9
net:dev:adp:ipsctl:slot:1:fwk_snd:cpu:1:stats:fw_pkt_drops = 17
net:dev:adp:ipsctl:slot:1:fwk_snd:cpu:2:stats:fw_pkt_drops = 6
net:dev:adp:ipsctl:slot:1:fwk_snd:cpu:3:stats:fw_pkt_drops = 17
[Expert@Appliance:0]#