Check Point VPN-1/FireWall-1 Performance Pack Guide

Size: px

Start display at page:

Download "Check Point VPN-1/FireWall-1 Performance Pack Guide"

Augusta Henry
5 years ago
Views:

Check Point products, consult Check Point s

1 Check Point VPN-1/FireWall-1 Performance Pack Guide NG FP3 For additional technical information about Check Point products, consult Check Point s SecureKnowledge at September 2002

2 Table Of Contents Chapter 1 Chapter 2 Chapter 3 Appendix A Introduction to Performance Pack Overview 7 Release Notes 8 Getting Started Performance Pack NG FP3 System Requirements 9 Minimum Requirements 9 Recommended System Options 10 Performance Pack NG FP3 Recommended Platforms 10 Preparing the Performance Pack NG FP3 Machine 11 BIOS settings 11 Network Interface Cards location 11 Installation Upgrade and Configuration 11 Installation for Performance Pack NG FP3 on SecurePlatform NG FP3 11 Installation for Performance Pack NG FP3 on Solaris 11 Uninstalling Performance Pack NG FP3 on SecurePlatform NG FP3 12 Uninstalling Performance Pack NG FP3 on Solaris 12 Upgrade Sequence for Performance Pack NG FP3 on SecurePlatform NG FP3 from Performance Pack NG FP2 12 Command Line fwaccel 13 cpconfig 14 sim 14 proc entries 15 Performance Tuning and Measurement Hints Performance Tuning 17 SYN Defender 17 Amount of Concurrent Connections and Hash Size 17 Implied Rules 18 HyperThreading 18 Connection Templates 19 Performance Measurement 20 TCP State and Benchmarking 20 Table of Contents 1

3 Preface Who Should Use this User Guide This User Guide is written for system administrators who are responsible for maintaining networks. It assumes you have a basic understanding and a working knowledge of: system administration the Unix operating system the Windows GUI Internet protocols (IP, TCP, UDP, etc.) Summary of Contents Chapter 1, Introduction to Performance Pack, presents a general overview of Check Point Performance Pack, including how to find the latest Release Notes. Chapter 2, Getting Started, describes Check Point Performance Pack NG FP3 system requirements, information about preparing the Performance Pack machine for optimal performance, as well as, instructions for the installation and enabling of the software. Chapter 3, Command Line provides a complete inventory of Performance Pack command line options. Appendix A, Performance Tuning and Measurement Hints, describes techniques for measuring and improving the performance of your hardware. 2

4 Check Point Documentation User Guides are available for each product in Portable Document Format (PDF) in the Check Point Enterprise Suite. The Adobe Acrobat Reader is required to view PDF files and is also available on the Check Point Enterprise Suite CD-ROM. Alternatively, you can download the Acrobat Reader from the Adobe Web site ( The following User Guides are available for Check Point Enterprise Suite products. 1) Check Point Getting Started Guide This book is an introduction to Check Point products. 2) Check Point SmartCenter Guide This book describes the Check Point Management GUI, which is used to manage VPN-1/FireWall-1 and other Check Point products. 3) Check Point FireWall-1 This book describes Check Point VPN-1/FireWall-1. 4) Check Point Virtual Private Networks This book describes the Check Point VPN-1/FireWall-1 encryption features. 5) Check Point Desktop Client Guide This book describes Check Point security as implemented by SecuRemote and SecureClient. 6) Check Point FloodGate-1 Administration Guide This book describes Check Point FloodGate-1, which enables administrators to manage the quality of service on their networks. 7) Check Point SmartView Monitor This book describes the Check Point Real Time Monitor, which enables administrators to monitor quality of service on their network links, as well as Service Level Agreement compliance. 8) Check Point Provider-1 This book describes Check Point Provider-1, which enables service providers and managers of large networks to provide Check Point products-based services to large numbers of subscribers. 9) Check Point Reporting Module This book describes the Check Point SmartView Reporter Module, which enables administrators to manage databases of Check Point log-based information. 10) Check Point UserAuthority This book describes Check Point UserAuthority, which enables third-party and Web applications to leverage Check Point s sophisticated authentication and authorization technologies. 11) Check Point User Management This book describes Check Point LDAP-based user management. 3

5 For additional technical information about Check Point products, consult Check Point s SecureKnowledge database at What Typographic Changes Mean The following table describes the typographic changes used in this book. TABLE P-1 Typographic Conventions Typeface or Symbol AaBbCc123 Meaning The names of commands, files, and directories; on-screen computer output Example Edit your.login file. Use ls -a to list all files. machine_name% You have mail. AaBbCc123 AaBbCc123 AaBbCc123 Save What you type, when contrasted with on-screen computer output Command-line placeholder: replace with a real name or value Book titles, new words or terms, or words to be emphasized Text that appears on an object in a window machine_name% su Password: To delete a file, type rm filename. Read Chapter 6 in User s Guide. These are called class options. You must be root to do this. Click the Save button. 4

TABLE P-2 Command-line Usage Conventions Symbol Meaning Example [] Optional variable fw ver [ -k

<> Compulsory variable fw converthosts <input_file> [output_file] input_file is compulsory.

either the Module IP or the object name option Note - This note draws the reader s attention to

6 TABLE P-2 Command-line Usage Conventions Symbol Meaning Example [] Optional variable fw ver [ -k ] [-f filename] Use either or both of the -k and the -f filename options. <> Compulsory variable fw converthosts <input_file> [output_file] input_file is compulsory. output_file is optional Use one of the alternatives cplic import <Module IP object name> Use either the Module IP or the object name option Note - This note draws the reader s attention to important information. Warning - This warning cautions the reader about an important point. Tip - This is a helpful suggestion. 5

7 Shell Prompts in Command Examples The following table shows the default system prompt and superuser for the C shell, Bourne shell, Korn shell and DOS. TABLE P-3 Shell Prompts Shell C shell prompt C shell superuser prompt Bourne shell and Korn shell prompt Bourne shell and Korn shell superuser prompt DOS Prompt machine_name% machine_name# $ # current-directory> 6

8 CHAPTER 1 Introduction to Performance Pack Overview In This Chapter Overview page 7 Release Notes page 8 This document describes how to install and configure Performance Pack NG FP3. Additionally it shows you how to get the best possible performance using Performance Pack NG FP3. Performance Pack NG FP3 is supported both for SecurePlatform NG FP3 and Solaris platforms. Performance Pack NG FP3 is a software acceleration product installed as an add-on to VPN-1/FireWall-1 NG FP3. Performance Pack NG FP3 significantly enhances and improves the performance of VPN-1/FireWall-1 NG FP3. The Performance Pack NG FP3 uses Check Point s SecureXL technology and other innovative network acceleration techniques, in order to deliver wire-speed performance for VPN-1/FireWall-1 NG FP3. Moreover, it accelerates key security functions, such as: access control encryption NAT accounting and connection/session rate general security checks 7

9 thereby ensuring your organization the best security with the best performance available on an open platform. Release Notes The latest Release Notes for Performance Pack NG FP3 can be found at: Chapter 1 Introduction to Performance Pack 8

10 CHAPTER 2 Getting Started In This Chapter Performance Pack NG FP3 System Requirements page 9 Performance Pack NG FP3 Recommended Platforms page 10 Preparing the Performance Pack NG FP3 Machine page 11 Installation Upgrade and Configuration page 11 Performance Pack NG FP3 System Requirements Performance Pack NG FP3 accelerates the performance of VPN-1/FireWall-1 NG FP3 on Pentium PC supported by SecurePlatform NG FP3 or Solaris 8 SPARC 64 Bit. The following are the minimum and recommended requirements: Minimum Requirements The following are the minimum system requirements: TABLE 2-1 Operating Systems CPU Minimum System Requirements SecurePlatform NG FP3 Solaris 8 Pentium III and above for SecurePlatform NG FP3 SPARC 64 Bits for Solaris Disk Space Memory 80 MB 128 MB 9

11 Recommended System Options TABLE 2-1 Minimum System Requirements Network Interfaces SecurePlatform NG FP3 Network Interfaces supported by VPN-1/FireWall-1 NG FP3 Solaris The Network Interface Cards: GEM Ethernet NIC 10/100 QuadEthernet NIC GigaSwift NIC Sun HME 10/100 Ethernet NIC Recommended System Options The following system options are recommended for optimal performance: TABLE 2-2 Operating Systems CPU Recommended System options SecurePlatform NG FP3 Solaris 8 Dual Intel Xeon or Dual SPARC 64 bits Disk Space Memory Network Interfaces Bus Technology 400 MB 512 MB or more Intel Pro 1000XF or Intel Pro 1000XT for SecurePlatform NG FP3. GigaSwift for Solaris. At least two 64bit/66Mhz PCI buses, ServerWorks or Intel E7500 Chipset Performance Pack NG FP3 Recommended Platforms The following Platforms were tested by Check Point and are recommended for use with Performance Pack: Super Micro SuperServer 6022P-6 Dual Processor Compaq ML530 Dual Processor Compaq Proliant Dual Processor IBM 330, 340 & 343 Dual Processor Dell precision 530 Dual Processor SunBlade 1000 Chapter 2 Getting Started 10

12 BIOS settings SunFire V480 Please refer to the latest Performance Pack NG FP3 Release Notes for a constantly updated list of recommended platforms. See Release Notes on page 8, for more information. Preparing the Performance Pack NG FP3 Machine For best performance it is suggested to examine the following hardware issues: BIOS settings If your BIOS supports CPU clock setting, make sure that the BIOS is set to the actual CPU speed. If you are running Performance Pack NG FP3 on a machine with Intel Xeon CPUs, consider setting the HyperThreading feature to on. Using HyperThreading may improve performance for some scenarios. Network Interface Cards location If you are using a motherboard with multiple PCI or PCI-X buses, make sure that each Network Interface Card is installed in a slot connected to a different bus. If you are using more than two Network Interface Cards in a system with only two 64bit/66Mhz PCI buses, make sure that the least-used cards are installed in slots connected to the same bus. Installation Upgrade and Configuration Installation for Performance Pack NG FP3 on SecurePlatform NG FP3 Performance Pack NG FP3 is installed automatically during the installation of the following products from a SecurePlatform NG FP3: Enterprise VPN-1/FireWall-1 NG FP3 Installation for Performance Pack NG FP3 on Solaris Installation can be done either by using the Wrapper, SmartUpdate NG FP3 or by performing the following actions: 1) Extract ppak.tgz to a temporary directory and extract the files. 2) Run the following command: pkgadd -d CPppak-53 Chapter 2 Getting Started 11

13 Uninstalling Performance Pack NG FP3 on SecurePlatform NG FP3 After the installation of Performance Pack NG FP3, your products will need to be configured with a utility called cpconfig. When running the cpconfig utility for the first time, you will be asked whether or not you would like to enable SecureXL acceleration. To this question, the answer must be Yes. For more on cpconfig see, the Check Point NG FP3 Getting Started Guide. For more on cpconfig and Performance Pack, see cpconfig on page 14. Note - Performance Pack NG FP3 can only be installed on an enforcement module. Performance Pack NG FP3 starts to accelerate network traffic as soon as a Security Policy is installed. Uninstalling Performance Pack NG FP3 on SecurePlatform NG FP3 Run the command rpm -e CPppak Uninstalling Performance Pack NG FP3 on Solaris Run the command pkgrm CPppak-53 Upgrade Sequence for Performance Pack NG FP3 on SecurePlatform NG FP3 from Performance Pack NG FP2 1 Upgrade VPN-1/Firewall-1 to FP3. Please refer to Check Point SmartCenter Guide. 2 Upgrade Performance Pack to FP3 using SmartUpdate. 3 Reboot the machine. Chapter 2 Getting Started 12

14 CHAPTER 3 Command Line In This Chapter fwaccel The fwaccel utility allows you to enable or disable acceleration dynamically while VPN-1/FireWall-1 is running. The default setting is determined by the setting configured with cpconfig (see cpconfig on page 14). This setting reverts to the default after reboot. Usage fwaccel page 13 cpconfig page 14 sim page 14 proc entries page 15 fwaccel [on off stat cfg l number] 13

15 Parameters TABLE 3-1 fwaccel parameters Parameter on off stat cfg l number Explanation Start acceleration Stop acceleration Display the acceleration device status and the status of the Connection Templates on the local VPN-1/FireWall-1 module. Limit the number of connection templates that will be created in the system (until next reboot). cpconfig Check Point products are configured using the cpconfig utility. When run, this utility displays a screen with the configuration options. The options that are displayed, depend on the installed configuration and product(s). You can use cpconfig to enable or disable Performance Pack. Once you have selected an acceleration setting, the setting remains configured, until you choose to change it on another occasion. In other words, the settings that you define will remain even after the machine is rebooted. For an alternative method to enable or disable acceleration, see fwaccel on page 13. Usage Execute cpconfig by entering the following command: cpconfig An interactive menu will be displayed providing you with the option to enable or disable the acceleration by selecting Enable/Disable Check Point SecureXL. Select Enable in order to enable acceleration. Select Disable in order to disable acceleration. sim The sim utility controls various Performance Pack NG FP3 driver features and applies only for SecurePlatform. Usage sim affinity [-a -s -l] Chapter 3 Command Line 14

16 Parameters Affinity is a general term for binding Network Interface Card (NIC) interrupts to processors. By default, SecurePlatform NG FP3 does not set Affinity to the NIC interrupts, which means that each NIC is handled by all processors. Optimal network performance is obtained when each NIC is individually bound to a single processor. To achieve the above, the sim utility includes an Affinity feature, which has the following operation modes: TABLE 3-2 sim Affinity operation modes Option Explanation -a Automatic Mode the Affinity is determined automatically, by analyzing the load on each NIC. If the NICs are not loaded, the Affinity will not be set. This is the default Affinity operation mode, in which the Affinity is re-tuned every 60 seconds. -s Manual Mode allows you to manually specify the Affinity settings. For each interface, you will be asked to enter one of the following: A space-separated list of the processor numbers that are to handle this interface, or The word all, to allow all processors to handle this interface. When setting the Affinity manually, the periodic automatic check will be disabled. After booting, it will remain disabled and the Affinity settings entered manually will be applied. -l View a list of the current Affinity settings proc entries Performance Pack NG FP3 supports SecurePlatform NG FP3 proc entries. These entries are used to display information about the Performance Pack NG FP3. The proc entries are read-only entries.they cannot be configured. The proc entries are located under /proc/ppk. Usage cat /proc/ppk/<conf ifs statistics> Chapter 3 Command Line 15

17 Parameters TABLE 3-3 /proc Parameters Parameter conf ifs statistics Explanation Displays the Performance Pack NG FP3 Configuration Lists the interfaces to which Performance Pack NG FP3 is attached Displays general Performance Pack NG FP3 statistics Chapter 3 Command Line 16

18 Appendix A Performance Tuning and Measurement Hints In This Appendix Performance Tuning SYN Defender Performance Tuning page 17 Performance Measurement page 20 To obtain optimal TCP connection setup rate performance, verify that the SYN Defender method specified in the SmartDefense is set to None (default). Amount of Concurrent Connections and Hash Size Setting the Maximal Concurrent Connections To set the desired number of maximal concurrent connections, proceed as follows: Open SmartDashboard s Gateway Object Properties window Open the Advanced Tab. Make sure that Calculate connections hash table size and memory pool is set to Automatically. Set the desired amount of concurrent connections in the Maximum Concurrent Connections field. 17

19 Increasing the Number of Concurrent Connections You can increase the actual number of concurrent connections by reducing the timeout of TCP and UDP sessions: TCP end timeout determines the amount of time a TCP connection will stay in the FireWall connection table after a TCP session has ended. UDP virtual session timeout determines the amount of time a UDP connection will stay in the FireWall connection table after the last UDP packet was seen by the gateway. By, reducing the above values the capacity of actual TCP and UDP connections is increased. Reducing the Packet Loss On SecurePlatform NG FP3, increasing the backlog queue size will reduce the packet loss. To increase the backlog queue size issue the following command: echo > /proc/sys/net/core/netdev_max_backlog Implied Rules In order to set the optimal connection/sec rate, proceed as follows: Select Global Properties from the Policy menu Select FireWall-1in the Global Properties tree Uncheck the following options Accept RIP Accept Domain Name over UDP (Queries) Accept Domain Name over TCP (Zone Transfer) Accept ICMP requests HyperThreading HyperThreading applies only for SecurePlatfrom. HyperThreading is a new feature of the Intel Xeon processors, enabling emulation of two virtual processors by a single physical processor. This feature increases the performance under certain conditions. Machines with Xeon processors have a BIOS option that may allow enabling or disabling HyperThreading, under the following circumstances: if the number of network interfaces is less than the actual physical number of processors (i.e. two network interfaces and three processors), it is recommended to enable HyperThreading. Appendix A Performance Tuning and Measurement Hints 18

20 If the number of network interfaces is equal to or greater than the actual physical number of processors (i.e. two network interfaces and two processors), it is recommended to disable HyperThreading. Connection Templates General Connection templates are generated from active connections according to the policy rules. They accelerate connections (by means of setup and teardown rate) where the source port is the only variant. Examples: A connection from /2000 to /80 established through FireWall-1 and then accelerated. A connection from /2001 to /80 fully accelerated (including connection establishment). A connection from /8000 to /80 fully accelerated (including connection establishment) HTTP GET request to specific server will be accelerated since the only variant is the source port of the client. Restrictions In general, Connections Templates will be created only for plain UDP or TCP connections. The following restrictions apply for Connection Template generation: Global restrictions: SYN Defender Connection Templates for TCP connections will not be created. NAT connections VPN connections Complex connections (H323, FTP, SQL) Security Server connections If the rule base contains rules with one of the following, Connection Templates will be disabled altogether: Services with source port range Time objects in the rules Dynamic Objects and/or Domain Objects Services of type other with a match expression. Services of type RPC/DCERPC/DCOM Appendix A Performance Tuning and Measurement Hints 19

21 When installing a policy containing restricted rules, you will receive both log and console messages indicating that Connection Templates will not be created due to the rules that have been defined. The warnings should be used as a recommendation that will assist you to fine-tune your policy in order to optimize performance. Testing To verify that connection templates are created, while running traffic use sim tab templates to get a list of currently defined templates. The result will be sent to the console on Solaris or sent to /var/log/messages on SecurePlatform NG FP3. Use the fwaccel stat command to verify that the connections templates feature is enabled. Performance Measurement TCP State and Benchmarking Some testing equipment (SmartBits or Chariot) generate invalid TCP sequences. The VPN-1/FireWall-1 module s TCP state check detects these faulty sequences, and drops the packets. As a result, the benchmark fails. To disable the above TCP state check, perform the following operations on the SmartCenter Server: 1 Shut down SmartDashboard. 2 Run dbedit. 3 Login with your management username and password. 4 Type modify properties firewall_properties fw_allow_out_of_state_tcp 1. This will disable the TCP state check. 5 Type quit. Install the Policy from the SmartDashboard to apply the changes. Appendix A Performance Tuning and Measurement Hints 20

Performance Pack. Administration Guide Version R70. March 8, 2009

Performance Pack. Administration Guide Version R70. March 8, 2009 Performance Pack TM Administration Guide Version R70 March 8, 2009 2003-2009 Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by copyright