Multi-Queue Basic Configuration

You configure Multi-Queue An acceleration feature on Security Gateway that configures more than one traffic queue for each network interface. Multi-Queue assigns more than one receive packet queue (RX Queue) and more than one transmit packet queue (TX Queue) to an interface. Multi-Queue is applicable only if SecureXL is enabled (this is the default). Acronym: MQ. on the command line in one of these shells:

In the Expert mode
In Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell).
In Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators and for Security Gateway Modules on Scalable Chassis. Commands you run in this shell apply to all Security Gateway Module / Security Appliances in the Security Group. on Scalable Platforms

Multi-Queue Configuration in the Expert mode

Description

The mq_mng utility shows and configures the Multi-Queue on supported interfaces.

Syntax

Important:

In a Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.
You must run these commands in the Expert mode.
On Scalable Platforms, you must connect to the applicable Security Group A logical group of Security Appliances (in Maestro) / Security Gateway Modules (on Scalable Chassis) that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances / Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. In Maestro, each Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. and use the "g_all mq_mng" commands.
Change in the Multi-Queue mode can cause short packet loss.

To see the built-in help

mq_mng {-h | --help}

To show the existing Multi-Queue configuration:

mq_mng {-o | --show} [{-v | -vv}] [-a]

To configure the Multi-Queue for the specified driver:

mq_mng {-s | --set-mode}

auto

manual

{-i | --interface} <Names of Interfaces>

{-c | --core} <IDs of CPU Cores>

off

[{-i | --interface} <Names of Interfaces>]

To apply the existing Multi-Queue policy:

mq_mng {-r | --reconf}

Parameters

Parameter

Description

-h | --help

Shows built-in help.

-o | --show

Shows the existing Multi-Queue configuration.

Notes:

Available Queues - Shows the maximum number of queues available for the given interface.
Actual Queues - Shows the current number of queues assigned to the given interface.
When CoreXL Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point Firewall instances are running in parallel on multiple CPU cores. Dynamic-Balancing is disabled, the values of Available Queues and Actual Queues are the same for both automatic and manual Multi-Queue modes.

-v | -vv

Verbose output.

-a

Shows all interfaces in the output.

-s | --set-mode

Configures the Multi-Queue mode:

auto - Automatic mode (this is the default). Multi-Queue automatically configures the affinity The assignment of a specified CoreXL Firewall instance, VSX Virtual System, interface, user space process, or IRQ to one or more specified CPU cores. of all supported interfaces to CPU cores that run CoreXL SND Instances.
manual - Manual mode. Administrator configures the affinity of interfaces to CPU cores that run CoreXL SND Instances. In this mode, you can specify interfaces, CPU cores, or both.
off - Disables the Multi-Queue on all or specified supported interfaces.

Important - Change in the Multi-Queue mode can cause short packet loss.

Notes:

To specify interfaces:
- Use this syntax:
  
  {-i | --interface} <Names of Interfaces>
- If you do not specify interfaces, then the configuration applies to all supported interfaces.
- To specify a specific interface, enter its name (for example: -i eth2).
- To specify several interfaces, enter their names separates with spaces (for example: -i eth2 eth4).
To specify CPU cores:
- Use this syntax:
  
  {-c | --core} <IDs of CPU Cores that run CoreXL SND Instances>
- To specify a specific CPU core, enter its ID number (for example: -c 1).
- To specify several nonconsecutive CPU cores, enter their ID numbers separated with spaces (for example: -c 1 3) or commas (for example: -c 1,3).
- To specify several consecutive CPU cores, enter their first and last ID numbers separated with a hyphen (for example: -c 3-6).
To see the current CoreXL affinity configuration, run the fw ctl affinity command (with applicable parameters).
To see the CoreXL Firewall Instances and which CPU cores they use, run the fw ctl multik stat command.

To see all available CPU cores, run:

cat /proc/cpuinfo | grep processor

-r | --reconf

Applies the existing Multi-Queue policy.

Examples

Show the current Multi-Queue verbose configuration on all interfaces

[Expert@Hostname:0]# mq_mng --show -v

Total 112 cores. Available for MQ 32 cores: Dynamic-Balancing enabled: 0,56,1,57,2,58,3,59,4,60,28,84,29,85,30,86,31,87,32,88,5,61,33,89,6,62,34,90,7,63,35,91
i/f             driver          driver mode     state           mode (queues)   cores
								 actual/avail
------------------------------------------------------------------------------------------------
ethsBP1-01      mlx5_pci        DPDK            Up              Dynamic (10/32) 0,56,1,57,2,58,3,59,4,
										 60
ethsBP1-02      mlx5_pci        DPDK            Up              Dynamic (10/32) 0,56,1,57,2,58,3,59,4,
										 60
 
core            interfaces      queue                     irq        rx packets      tx packets
------------------------------------------------------------------------------------------------
0               ethsBP1-01      0                         None       18409592        388640

                ethsBP1-02      0                         None       7495723         115534704
1               ethsBP1-01      2                         None       15926139        255839
		 ethsBP1-02      2                         None       6633336         975
2               ethsBP1-01      4                         None       16105770        210370
		 ethsBP1-02      4                         None       6003514         1096
3               ethsBP1-01      6                         None       19906359        39
		 ethsBP1-02      6                         None       7304843         0
4               ethsBP1-01      8                         None       22296468        700
		 ethsBP1-02      8                         None       7920505         0
56              ethsBP1-01      1                         None       18902160        166099
		 ethsBP1-02      1                         None       6603803         47917
57              ethsBP1-01      3                         None       18508951        187803
		 ethsBP1-02      3                         None       7513138         776
58              ethsBP1-01      5                         None       17152508        475
		 ethsBP1-02      5                         None       6001529         0
59              ethsBP1-01      7                         None       18597442        55
		 ethsBP1-02      7                         None       7320374         0
60              ethsBP1-01      9                         None       21868703        86
		 ethsBP1-02      9                         None       7205076         0

Multi-Queue Configuration in Gaia Clish / Gaia gClish

Syntax

Important:

In a Cluster, you must configure all the Cluster Members in the same way.
You must run these commands in Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Clish / Gaia gClish.
On Scalable Platforms, you must connect to the applicable Security Group.
Change in the Multi-Queue mode can cause short packet loss.

To show the existing Multi-Queue configuration for the specified interface:

show interface <Name of Interface> multi-queue [verbose]

To configure the Multi-Queue for the specified interface:

set interface <Name of Interface> multi-queue

auto

manual core <IDs of CPU Cores that run CoreXL SND Instances>

off

Parameters

Parameter

Description

<Name of Interface>

Specifies the interface.

verbose

Verbose output that also includes:

IRQ numbers for traffic queues
Total number of RX and TX packets in traffic queues

auto

Configures the automatic Multi-Queue mode (this is the default).

Multi-Queue automatically configures the affinity of the specified interface to CPU cores that run CoreXL SND Instances.

manual core <IDs of CPU Cores>

Configures the manual Multi-Queue mode.

Administrator configures the affinity of the specified interface to CPU cores that run CoreXL SND Instances.

Notes:

To specify a specific CPU core, enter its ID number (for example: manual core 1).
To specify several nonconsecutive CPU cores, enter their ID numbers separated with commas and without spaces (for example: manual core 1,3).
To specify several consecutive CPU cores, enter their first and last ID numbers separated with a hyphen (for example: manual core 3-6).
To see the current CoreXL affinity configuration, run the fw ctl affinity command (with applicable parameters).
To see the CoreXL Firewall Instances and which CPU cores they use, run the fw ctl multik stat command.

To see all available CPU cores, run:

cat /proc/cpuinfo | grep processor

off

Disables the Multi-Queue on the specified interface.

Examples