Configuring IPv4 and IPv6 CoreXL Firewall instances

Important Notes for Cluster: You must configure the CoreXL Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point Firewall instances are running in parallel on multiple CPU cores. in the same way on all the cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. members. If you enable CoreXL, disable CoreXL, or change the number of CoreXL Firewall instances, you should treat this change as a version upgrade. Schedule a full maintenance window and follow the instructions in the R81 Installation and Upgrade Guide - Chapter Upgrading ClusterXL Deployments. Perform either a Minimal Effort Upgrade procedure (requires downtime), or a Zero Downtime Upgrade procedure (no downtime, but active connections are lost). Instead of the version upgrade, configure the CoreXL on each cluster member Security Gateway that is part of a cluster..

IPv4 and IPv6 CoreXL Firewall Instances

After you enable Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. IPv6 support on the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. (see R81 Gaia Administration Guide), configure the CPU cores to run different combinations of IPv4 and IPv6 CoreXL Firewall instances:

• The number of IPv4 CoreXL Firewall instances you can configure is from a minimum of two to a maximum equal to the total number of CPU cores on the Security Gateway:

  2 <= (Number of IPv4 CoreXL Firewall instances) <= (Total Number of CPU cores)

• By default, the number of IPv6 CoreXL Firewall instances is set to two.

  When the SMT (Hyper-Threading) is enabled, the default number of IPv6 CoreXL Firewall instances is four.

• The number of IPv6 CoreXL Firewall instances you can configure is from a minimum of two to a maximum equal to the total number of IPv4 CoreXL Firewall instances.

  The number of IPv6 CoreXL Firewall instances cannot be greater than the number of IPv4 CoreXL Firewall instances:

  2 <= (Number of IPv6 CoreXL Firewall instances) <= (Total Number of IPv4 CoreXL Firewall instances)

• The total number of IPv4 and IPv6 CoreXL Firewall instances cannot be greater than forty:

  Note - This limit applies only to the Kernel Mode Firewall (KMFW).

  (Number of IPv4 CoreXL Firewall instances) + (Number of IPv6 CoreXL Firewall instances) <= 40

Configuring the Number of IPv4 CoreXL Firewall Instances

Step	Instructions
1	Connect to the command line on the Security Gateway.
2	Log in to Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell). or Expert mode.
3	Run: cpconfig
4	Enter the number of the Check Point CoreXL option.
5	Enter 1 to select Change the number of firewall instances.
6	Enter the total number of IPv4 CoreXL Firewall instances you wish the Security Gateway to run. Note - You can only select a number from the range shown. Follow the instructions on the screen.
7	Exit from the cpconfig menu.
8	Reboot the Security Gateway.

Configuring the Number of IPv6 CoreXL Firewall Instances

Step	Instructions
1	Connect to the command line on the Security Gateway.
2	Log in to Gaia Clish or Expert mode.
3	Run: cpconfig
4	Enter the number of the Check Point CoreXL option.
5	Enter 2 to select Change the number of IPv6 firewall instances.
6	Enter the total number of IPv6 CoreXL Firewall instances you wish the Security Gateway to run. Note - You can only select a number from the range shown. Follow the instructions on the screen.
7	Exit from the cpconfig menu.
8	Reboot the Security Gateway.

Example CoreXL Configuration

Security Gateway has four CPU cores.

By default, there are three IPv4 CoreXL Firewall instances and two IPv6 CoreXL Firewall instances:

CPU Core	IPv4 CoreXL Firewall instances	IPv6 CoreXL Firewall instances
CPU 0	N / A	N / A
CPU 1	fw4_2	N / A
CPU 2	fw4_1	fw6_1
CPU 3	fw4_0	fw6_0

• IPv4 CoreXL Firewall instances: The minimum allowed number is two and the maximum is four

• IPv6 CoreXL Firewall instances: The minimum allowed number is two and the maximum is three