Configuring SecureXL

The Gaia First Time Configuration Wizard automatically installs and enables SecureXL on your Security Gateway. No additional configuration is required.

Starting from R80.20, you can disable the SecureXL only temporarily. The SecureXL starts automatically when you start Check Point services (with the cpstart command), or reboot the Security Gateway.

Important:

• Disable the SecureXL only for debug purposes, if Check Point Support explicitly instructs you to do so.
• If you disable the SecureXL, this change does not survive reboot.

  SecureXL remains disabled until you enable it again on-the-fly, or reboot the Security Gateway.

• If you disable the SecureXL, this change applies only to new connections that arrive after you disable the acceleration.

  SecureXL continues to accelerate the connections that are already accelerated.

  Other non-connection oriented processing continues to function (for example, virtual defragmentation, VPN decrypt).

To temporarily disable SecureXL for IPv4:

Step	Description
1	Connect to the command line on your Security Group.
2	Log in to Gaia gClish, or Expert mode.
3	Examine the SecureXL status: In Gaia gClish: fwaccel stat In Expert mode: g_fwaccel stat
4	Disable the SecureXL: In Gaia gClish: fwaccel off [-a] In Expert mode: g_fwaccel off [-a]
5	Examine the SecureXL status again: In Gaia gClish: fwaccel stat In Expert mode: g_fwaccel stat

To temporarily disable SecureXL for IPv6:

Step	Description
1	Connect to the command line on your Security Group.
2	Log in to Gaia gClish, or Expert mode.
3	Examine the SecureXL status: In Gaia gClish: fwaccel6 stat In Expert mode: g_fwaccel6 stat
4	Disable the SecureXL: In Gaia gClish: fwaccel6 off [-a] In Expert mode: g_fwaccel6 off [-a]
5	Examine the SecureXL status again: In Gaia gClish: fwaccel6 stat In Expert mode: g_fwaccel6 stat

To enable SecureXL again for IPv4:

Step	Description
1	Connect to the command line on your Security Group.
2	Log in to Gaia gClish, or Expert mode.
3	Examine the SecureXL status: In Gaia gClish: fwaccel stat In Expert mode: g_fwaccel stat
4	Enable the SecureXL: In Gaia gClish: fwaccel on [-a] In Expert mode: g_fwaccel on [-a]
5	Examine the SecureXL status again: In Gaia gClish: fwaccel stat In Expert mode: g_fwaccel stat

To enable SecureXL again for IPv6:

Step	Description
1	Connect to the command line on your Security Group.
2	Log in to Gaia gClish, or Expert mode.
3	Examine the SecureXL status: In Gaia gClish: fwaccel6 stat In Expert mode: g_fwaccel6 stat
4	Enable the SecureXL: In Gaia gClish: fwaccel6 on [-a] In Expert mode: g_fwaccel6 on [-a]
5	Examine the SecureXL status again: In Gaia gClish: fwaccel6 stat In Expert mode: g_fwaccel6 stat

To Learn More About SecureXL

To learn more about SecureXL, see the R80.30SP Performance Tuning Administration Guide.

Multi-Queue

By default, the traffic for each interface is processed on one CPU core. If there are more CPU cores than interfaces, not all of the CPU cores are used to process traffic.

You can enable the Multi-Queue feature to assign more than one CPU core to one interface. Run the cpmq command to configure the Multi-Queue settings.

The SND (Secure Network Distributer) is part of SecureXL and CoreXL. It processes and helps to accelerate network traffic:

• SecureXL - Distributes traffic to the accelerated or slow path
• CoreXL - Processes traffic on a specified Firewall instance

Sample Multi-Queue Configuration

This sample configuration shows how CoreXL, SecureXL and Multi-Queue can help to use more CPU cores for SNDs to accelerate network traffic. There is a Security Gateway with two six core CPUs (total 12 CPU cores) and three interfaces:

• External
• Internal
• DMZ

  	CPU cores for SND	CPU cores for CoreXL
  Multi-Queue disabled	3	9
  Multi-Queue enabled	6	6

To learn more about Multi-Queue, see the R80.30SP Performance Tuning Administration Guide.