Configuring IPv4 and IPv6 CoreXL Firewall instances

Important Notes for Cluster:

• You must configure the CoreXL in the same way on all the cluster members. Otherwise, a cluster member with a greater number of CoreXL Firewall instances by design enters the Down state (see sk42096).
• If you enable CoreXL, disable CoreXL, or change the number of CoreXL Firewall instances, you should treat this change as a version upgrade.

  Schedule a full maintenance window and follow the instructions in the R80.20 Installation and Upgrade Guide - Chapter Upgrading ClusterXL Deployments.

  Perform either a Minimal Effort Upgrade procedure (requires downtime), or a Zero Downtime Upgrade procedure (no downtime, but active connections are lost). Instead of the version upgrade, configure the CoreXL on each cluster member.

IPv4 CoreXL Firewall instances and IPv6 CoreXL Firewall instances:

After you enable Gaia IPv6 support on the Security Gateway (see R80.20 Gaia Administration Guide), you can configure the CPU cores to run different combinations of IPv4 and IPv6 CoreXL Firewall instances:

• The number of IPv4 CoreXL Firewall instances you can configure is from a minimum of two to a maximum equal to the total number of CPU cores on the Security Gateway:

  2 <= (Number of IPv4 CoreXL Firewall instances) <= (Total Number of CPU cores)

• By default, the number of IPv6 CoreXL Firewall instances is set to two.

  When SMT (Hyper-Threading) is enabled, the default number of IPv6 CoreXL Firewall instances is four.

• The number of IPv6 CoreXL Firewall instances you can configure is from a minimum of two to a maximum equal to the total number of IPv4 CoreXL Firewall instances. The number of IPv6 CoreXL Firewall instances cannot exceed the number of IPv4 CoreXL Firewall instances:

  2 <= (Number of IPv6 CoreXL Firewall instances) <= (Total Number of IPv4 CoreXL Firewall instances)

• The total number of IPv4 and IPv6 CoreXL Firewall instances cannot exceed forty:

  (Number of IPv4 CoreXL Firewall instances) + (Number of IPv6 CoreXL Firewall instances) <= 40

To configure the number of IPv4 CoreXL Firewall instances:

Step	Description
1	Connect to the command line on the Security Gateway.
2	Log in to Gaia Clish or Expert mode.
3	Run: cpconfig
4	Enter the number of the Check Point CoreXL option.
5	Enter 1 for the option Change the number of firewall instances.
6	Enter the total number of IPv4 CoreXL Firewall instances you wish the Security Gateway to run. Note - You can only select a number from the range shown. Follow the instructions on the screen.
7	Exit from the cpconfig menu.
8	Reboot the Security Gateway.

To configure the number of IPv6 CoreXL Firewall instances:

Step	Description
1	Connect to the command line on the Security Gateway.
2	Log in to Gaia Clish or Expert mode.
3	Run: cpconfig
4	Enter the number of the Check Point CoreXL option.
5	Enter 2 for the option Change the number of IPv6 firewall instances.
6	Enter the total number of IPv6 CoreXL Firewall instances you wish the Security Gateway to run. Note - You can only select a number from the range shown. Follow the instructions on the screen.
7	Exit from the cpconfig menu.
8	Reboot the Security Gateway.

Example CoreXL configuration:

Security Gateway has four CPU cores.

By default, there are three IPv4 CoreXL Firewall instances and two IPv6 CoreXL Firewall instances:

CPU Core	IPv4 CoreXL Firewall instances	IPv6 CoreXL Firewall instances
CPU 0	N / A	N / A
CPU 1	fw4_2	N / A
CPU 2	fw4_1	fw6_1
CPU 3	fw4_0	fw6_0

• IPv4 CoreXL Firewall instances: The minimum allowed number is two and the maximum is four
• IPv6 CoreXL Firewall instances: The minimum allowed number is two and the maximum is three

To increase the number of IPv6 CoreXL Firewall instances to four, first you must increase the number of IPv4 CoreXL Firewall instances to the maximum of four and reboot:

CoreXL is currently enabled with 3 IPv4 firewall instances and 2 IPv6 firewall instances.   (1) Change the number of firewall instances (2) Change the number of IPv6 firewall instances (3) Disable Check Point CoreXL   (4) Exit Enter your choice (1-4) : 1   How many IPv4 firewall instances would you like to enable (2 to 4) [3] ? 4   CoreXL was enabled successfully with 4 firewall instances. Important: This change will take effect after reboot.

After the reboot, the CoreXL configuration on the Security Gateway looks like this:

CPU Core	IPv4 CoreXL Firewall instances	IPv6 CoreXL Firewall instances
CPU 0	fw4_3	N / A
CPU 1	fw4_2	N / A
CPU 2	fw4_1	fw6_1
CPU 3	fw4_0	fw6_0

Increase the number of IPv6 CoreXL Firewall instances to four and reboot:

CoreXL is currently enabled with 4 IPv4 firewall instances and 2 IPv6 firewall instances.   (1) Change the number of firewall instances (2) Change the number of IPv6 firewall instances (3) Disable Check Point CoreXL   (4) Exit Enter your choice (1-4) : 2   How many IPv6 firewall instances would you like to enable (2 to 4)[2] ? 4   CoreXL was enabled successfully with 3 IPv6 firewall instances. Important: This change will take effect after reboot.

After the reboot, the CoreXL configuration on the Security Gateway looks like this:

CPU Core	IPv4 CoreXL Firewall instances	IPv6 CoreXL Firewall instances
CPU 0	fw4_3	fw6_3
CPU 1	fw4_2	fw6_2
CPU 2	fw4_1	fw6_1
CPU 3	fw4_0	fw6_0