Configuring Bond Load Sharing Mode

This section explains how to configure Load Sharing on a bond interface.

Run the CLI commands from the VSX Gateway (VS0) context.

In a VSX Cluster configuration, run these commands on each VSX Cluster Member.

Configure one of these Load Sharing modes for the bond interface:

  • Round Robin - Selects the Active subordinate interfaces sequentially.

  • 802.3ad - Dynamically uses Active subordinate interfaces to share the traffic load. This mode uses the LACP protocol, which fully monitors the interface link between the Check Point Security Gateway and a switch.

  • XOR - All subordinate interfaces in the UP state are Active for Load Sharing. Traffic is assigned to Active subordinate interfaces based on the transmit hash policy: Layer 2 information (XOR of hardware MAC addresses), or Layer 3+4 information (IP addresses and Ports).

Configuring the Load Sharing Bond

This is a workflow of CLI commands to configure Link Aggregation in Load Sharing mode.

Notes:

  • For exact commands, see R82 Gaia Administration Guide.

  • When you are enslaving configured interfaces, make sure that these interfaces are not used in other configurations and that IP addresses are not assigned to them.

To configure the Link Aggregation in Load Sharing mode:

  1. Add the bonding group.

  2. Add subordinate interfaces to the bonding group.

  3. Define the number of critical interfaces.

  4. For configurations that use Performance Pack, configure the core affinities.

  5. Make sure that the bond is configured correctly.

  6. Open SmartConsole and configure the VSX Cluster object.

    • For a new Link Aggregation installation, create a new cluster object.

    • For updating an existing configuration, update the interface topology.

Setting Critical Required Interfaces

Note - The Critical Required Interfaces feature is supported for ClusterXL only.

A Bond in Load Sharing mode is considered to be down when fewer than a critical minimum number of subordinate interfaces remain up. When not explicitly defined, the critical minimum number of subordinate interfaces, which must remain up, in a bond of n interfaces is n-1. Failure of an additional subordinate interface (when n-2 subordinate interfaces remain up) will cause the entire bond interface to be considered down, even if the bond contains more than two subordinate interfaces.

If a smaller number of subordinate interfaces will be able to handle the expected traffic, you can increase redundancy by explicitly defining the critical minimum number of subordinate interfaces. Divide your maximum expected traffic speed by the speed of your subordinate interfaces and round up to a whole number to determine an appropriate number of critical subordinate interfaces.

To define the critical number of subordinate interfaces explicitly, create and edit the following file:

$FWDIR/conf/cpha_bond_ls_config.conf

Each line of the file should be written in the following syntax:

<Name of Bond> <Critical Minimum Number of Subordinate Interfaces>

For example, if bond0 has 7 subordinate interfaces, and bond1 has 6 subordinate interfaces, file contents could be:

bond0 5

bond1 3

In this example:

  • bond0 would be considered down when 3 of its subordinate interfaces have failed.

  • bond1 would be considered down when 4 of its subordinate interfaces have failed.

Affinities of Bond Subordinate Interfaces to CPU Cores

For optimal performance, follow these guidelines:

  1. Configure static affinities of bond subordinate interfaces to CPU Cores.

  2. Whenever possible, dedicate one processing core to each interface.

  3. If there are more physical interfaces than CPU cores, then some CPU cores handle two or more interfaces.

    Use pairs of subordinate interface of the same position with internal and external bonds.

    1. To view positions of subordinate interface in a bond, run in the Expert mode:

      cat /proc/net/bonding/<Name of Bond Interface>

    2. Note the sequence of the interfaces in the output.

      Compare this sequence for the two bonds (external bond and its respective internal bond).

      Subordinate interfaces that appear in the same position in the two bonds are interface pairs.

      Set these pairs to be handled by one processing CPU core.

    An appliance has:

    • Four processing CPU cores:

      core 0, core 1, core 2, and core 3

    • Two bond interfaces:

      bond0 with subordinate interfaces eth0, eth1, and eth2

      bond1 with subordinate interfaces eth3, eth4, and eth5

    In such case, two of the CPU cores need to handle two subordinate interfaces each.

    An optimal configuration can be:

    CPU core

    bond0

    bond1

    0

    eth0

    eth3

    1

    eth1

    eth4

    2

    eth2

     

    3

     

    eth5

For more information, see the R82 Performance Tuning Administration Guide:

  • Chapter CoreXL > Section Configuring Affinity Settings.

  • Chapter CoreXL > Section Affinity Settings for 16000 and 26000 Appliances.