SecureXL Kernel Parameters

To change the internal default behavior of SecureXLClosed Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway. or to configure special advanced settings for SecureXL, you can use SecureXL kernel parameters.

The names of applicable SecureXL kernel parameters and their values appear in various SK articles in Check Point Support Center, and provided by Check Point Support.

Important:

  • The names of SecureXL kernel parameters are case-sensitive.

  • You cannot configure SecureXL kernel parameters on-the-fly with the "g_fw ctl set" command.

    You must configure them only permanently in the special configuration file - $PPKDIR/conf/simkern.conf

    Schedule a maintenance window, because this procedure requires a reboot.

  • For some SecureXL kernel parameters, you cannot get their current value on-the-fly with the "g_fw ctl get" command (see sk43387).

Type

Name

Integer

num_of_sxl_devices

sim_ipsec_dont_fragment

tcp_always_keepalive

sim_log_all_frags

simple_debug_filter_dport_1

simple_debug_filter_proto_1

String

simple_debug_filter_addr_1

simple_debug_filter_daddr_2

simlinux_excluded_ifs_list

Step

Instructions

1

Connect to the command line on the applicable Security GroupClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected..

2

Log in to the Expert mode.

3

Get the list of the available integer kernel parameters and their values:

modinfo -p $PPKDIR/boot/modules/sim_kern*.o | sort -u | grep _type | awk 'BEGIN {FS=":"} ; {print $1}' | xargs -n 1 fw ctl get int 1>> /var/log/sxl_integer_kernel_parameters.txt 2>> /var/log/sxl_integer_kernel_parameters.txt

4

Analyze the output file:

/var/log/sxl_integer_kernel_parameters.txt

Step

Instructions

1

Connect to the command line on the applicable Security Group.

2

Log in to the Expert mode.

3

Get the list of the available integer kernel parameters and their values:

modinfo -p $PPKDIR/boot/modules/sim_kern*.o | sort -u | grep 'string param' | awk 'BEGIN {FS=":"} ; {print $1}' | xargs -n 1 fw ctl get str 1>> /var/log/sxl_string_kernel_parameters.txt 2>> /var/log/sxl_string_kernel_parameters.txt

4

Analyze the output file:

/var/log/sxl_string_kernel_parameters.txt

For more information, see sk26202: Changing the kernel global parameters for Check Point Security Gateway.

Step

Instructions

1

Connect to the command line on the applicable Security Group.

2

Log in to the Expert mode.

3

Add the required SecureXL kernel parameter with the assigned value in the exact format specified below.

Important - This configuration file does not support space characters, tabulation characters, and comments (lines that contain the # character).

  • To add an integer kernel parameter:

    g_update_conf_file $PPKDIR/conf/simkern.conf <Name_of_SecureXL_Integer_Kernel_Parameter>=<Integer_Value>

  • To add a string kernel parameter:

    Note - You must write the value in single quotes, or double quotes.

    g_update_conf_file $PPKDIR/conf/simkern.conf <Name_of_SecureXL_String_Kernel_Parameter>='<String_Text>'

    or

    g_update_conf_file $PPKDIR/conf/simkern.conf <Name_of_SecureXL_String_Kernel_Parameter>="<String_Text>"

6

Reboot the Security Group:

reboot -b all

7

Connect to the command line on the applicable Security Group.

8

Log in to the Expert mode.

9

Make sure the new value of the kernel parameter is set:

  • For an integer kernel parameter, run:

    g_fw ctl get int <Name of Integer Kernel Parameter> [-a]

  • For a string kernel parameter, run:

    g_fw ctl get str <Name of String Kernel Parameter> [-a]