Dynamic Balancing of CoreXL Instances

Introduction

On Check Point Appliances, R80.40 added the ability to change the number of CoreXL Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point Firewall instances are running in parallel on multiple CPU cores. Firewall and SND instances without reboot (Dynamic Balancing).

Important: By default, this feature is enabled. We do not recommend manual configuration of CoreXL Firewall and SND instances, because such configuration disables the CoreXL Dynamic Balancing. To enable the CoreXL Dynamic Balancing again, you must disable it and enable it. For CoreXL Dynamic Balancing requirements, see sk164155.

When CoreXL Dynamic Balancing is enabled, Security Gateways / Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Members monitor the average CPU utilization of CoreXL Firewall and SND instances and automatically increases or decreases the number of CoreXL Firewall instances.

The Dynamic Balancing Daemon (dsd) has three stages in each iteration:

1. Examine the current CPU utilization.

2. Decide if and what changes to make based on the current CPU utilization.

3. If needed, change the current CoreXL configuration in one of these ways:

   • Add a CoreXL Firewall instance.

     This change is possible only under these conditions:

     1. Average difference in CPU utilization between CoreXL Firewall and SND instances is greater than 10%.

     2. The current number of CoreXL Firewall instances is less than it was during the boot.

   • Add a CoreXL SND instance.

     This change stops a CoreXL Firewall instance and moves it to another CPU core.

     This change is possible only under these conditions:

     1. Average difference in CPU utilization between CoreXL Firewall and SND instances is greater than 10%.

     2. CoreXL Firewall instances consume the CPU cores at less than 40%.

     3. There is an available CPU core.

Syntax

Important: There are commands for Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell). (Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators and for Security Gateway Modules on Scalable Chassis. Commands you run in this shell apply to all Security Gateway Module / Security Appliances in the Security Group.) and for the Expert mode. In a Cluster, you must configure all the Cluster Members in the same way.

Monitoring

• You can monitor the status of the CoreXL Dynamic Balancing with CLI commands:

  Shell	Security Gateway (each Cluster Member)
  Gaia Clish	show dynamic-balancing state
  Gaia gClish	N / A
  Expert mode	dynamic_balancing -p

• You can monitor the status of the CoreXL Dynamic Balancing in the CPView tool:

  Procedure

  1. Connect to the command line on the Security Gateway.

  2. Run:

     cpview

  3. From the top, click:

     SysInfo

  4. Examine this field:

     DS Status

     • On - Means the CoreXL Dynamic Balancing is enabled

     • Off - Means the CoreXL Dynamic Balancing is disabled

• You can monitor the performance of the CoreXL Dynamic Balancing in the CPView tool:

  Procedure

  1. Connect to the command line on the Security Gateway.

  2. Run:

     cpview

  3. From the top, click:

     CPU > Overview > Host

  4. Examine these sections:

     • Overview - Shows the current number of CoreXL instances and the average CPU utilization

     • CPU - Shows the CPU cores, the CoreXL instance types they run, and the CPU utilization in different categories

• You can monitor the CoreXL Firewall instances with this command:

  Shell	Security Gateway (each Cluster Member)
  Gaia Clish	fw ctl multik stat
  Gaia gClish	N / A
  Expert mode	fw ctl multik stat

• You can monitor the CoreXL Affinity The assignment of a specified CoreXL Firewall instance, VSX Virtual System, interface, user space process, or IRQ to one or more specified CPU cores. with this command:

  Shell	Security Gateway (each Cluster Member)
  Gaia Clish	fw ctl affinity -l -r -a
  Gaia gClish	N / A
  Expert mode	fw ctl affinity -l -r -a

• You can examine these log files:

  • When the CoreXL Dynamic Balancing changes the CoreXL configuration, it writes the applicable entries in the $FWDIR/log/dsd.elg file.

  • When the CoreXL Dynamic Balancing starts, it writes the applicable

    entries in the $FWDIR/log/dynamic_split.elg file.