{"id":1104,"date":"2019-03-19T15:56:24","date_gmt":"2019-03-19T15:56:24","guid":{"rendered":"http:\/\/www.ankenbrand24.de\/?page_id=1104"},"modified":"2019-03-19T16:04:53","modified_gmt":"2019-03-19T16:04:53","slug":"fw-monitor","status":"publish","type":"page","link":"https:\/\/www.ankenbrand24.de\/index.php\/articles\/check-point-articel\/performance-tuning\/fw-monitor\/","title":{"rendered":"FW Monitor"},"content":{"rendered":"\n
\n\n\n\n

R80.x Performance Tuning and Debug Tips \u2013 fw monitor<\/span><\/h2>\n\n\n\n
\n\n\n\n\n\n\n
R80.20 – fw monitor<\/span><\/th>\n<\/tr>\n<\/thead>\n<\/table>\n

\"\"<\/p>\n

Tip 1<\/strong><\/span><\/p>\n

SecureXL has been significantly revised in R80.20. It now works in user space. This has also led to some changes in “fw monitor”.<\/span><\/p>\n

Since R80.20  “fw monitor” is able to show the traffic accelerated with SecureXL. Thus it is possible to see SecureXL (provide more performance)<\/strong> modules in fw monitor chain. For more informations revert to “SecureXL offloading chain modules” in this article. Now you can see that SecureXL is used, which increases the performance of the firewall.

<\/span>SecureXL “fwaccel off<\/strong><\/span>” does not<\/strong><\/span> have to be disabled on R80.20<\/strong><\/span> to run “fw monitor”. This is good for performance, so “fw monitor” does not affect performance any more.<\/span><\/p>\n

# fwaccel off<\/strong><\/span>                                      > no longer necessary in R80.20 and above<\/p>\n

# fw monitor -e “accept(…);”<\/strong><\/p>\n\n\n\n
R77.30 and R80.10 – fw monitor<\/span><\/th>\n<\/tr>\n<\/thead>\n<\/table>\n

On R77.30 and R80.10 only disabling SecureXL allows to see the complete connection in fw monitor, which may be required for troubleshooting purposes or revert to “How to disable SecureXL for specific IP addresses”<\/a>.<\/span><\/p>\n

# fwaccel off<\/strong>                            <\/p>\n

# fw monitor -e “accept(…);”<\/strong><\/p>\n\n\n\n
New fw monitor inspection points in R80.20<\/span><\/th>\n<\/tr>\n<\/thead>\n<\/table>\n

Tip 2<\/span>
<\/strong><\/span><\/p>\n

Furthermore there are new fw monitor inspection points available:
<\/span><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Inspection point<\/th>\nName of fw monitor inspection point<\/th>\nRelation to firewall VM<\/th>\nAvailable since version<\/th>\n<\/tr>\n
i<\/td>\nPre-Inbound<\/td>\nBefore the inbound FireWall VM<\/td>\nalways<\/td>\n<\/tr>\n
I<\/td>\nPost-Inbound<\/td>\nAfter the inbound FireWall VM<\/td>\nalways<\/td>\n<\/tr>\n
id<\/strong><\/span><\/td>\nPre-Inbound VPN<\/td>\nInbound before decrypt <\/td>\nR80.20<\/strong><\/span><\/td>\n<\/tr>\n
ID<\/strong><\/span><\/td>\nPost-Inbound VPN<\/td>\nInbound after decrypt<\/td>\nR80.20<\/strong><\/span><\/td>\n<\/tr>\n
iq<\/strong><\/span><\/td>\nPre-Inbound QoS<\/td>\nInbound before QoS <\/td>\nR80.20<\/strong><\/span><\/td>\n<\/tr>\n
IQ<\/strong><\/span><\/td>\nPost-Inbound QoS<\/td>\nInbound after QoS <\/td>\nR80.20<\/strong><\/span><\/td>\n<\/tr>\n
o<\/td>\nPre-Outbound<\/td>\nBefore the outbound FireWall VM <\/td>\nalways<\/td>\n<\/tr>\n
O<\/td>\nPost-Outbound<\/td>\nAfter the outbound FireWall VM<\/td>\nalways<\/td>\n<\/tr>\n
\n

e<\/strong><\/span><\/p>\n

oe<\/strong><\/span><\/p>\n<\/td>\n

Pre-Outbound VPN*<\/td>\n\n

Outbound before encrypt <\/p>\n<\/td>\n

\n

R80.10<\/strong><\/span><\/p>\n

R80.20<\/strong><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

E<\/strong><\/span><\/p>\n

OE<\/strong><\/span><\/p>\n<\/td>\n

Post-Outbound VPN*<\/td>\n\n

Outbound after encrypt<\/p>\n<\/td>\n

\n

R80.10<\/strong><\/span><\/p>\n

R80.20<\/strong><\/span><\/p>\n<\/td>\n<\/tr>\n

oq<\/strong><\/span><\/td>\nPre-Outbound QoS<\/td>\nOutbound before QoS<\/td>\nR80.20<\/strong><\/span><\/td>\n<\/tr>\n
OQ<\/strong><\/span><\/td>\nPost-Outbound QoS<\/td>\nOutbound after QoS<\/td>\nR80.20<\/strong><\/span><\/td>\n<\/tr>\n<\/thead>\n<\/table>\n

* The fw monitor inspection point is different in R80.10 (“e” or “E”) and R80.20 (“oe” and “OE”)<\/p>\n

For more information, see sk30583<\/a>, fw monitor<\/a> or How to use FW Monitor<\/a>.<\/span><\/p>\n\n\n\n
SecureXL offloading chain modules<\/span><\/th>\n<\/tr>\n<\/thead>\n<\/table>\n

Tip 3<\/span>
<\/strong><\/span><\/p>\n

Like I said SecureXL has been significantly revised in R80.20. It now works in user space. This has also led to some changes in “fw monitor”<\/p>\n

There are new fw monitor chain (SecureXL) objects that do not run in the virtual machine.<\/p>\n

# fw ctl chain<\/strong><\/span>
\"\"
<\/span>The new fw monitor chain modules (SecureXL) do not run in the virtual machine (vm).
<\/span>SecureXL inbound (sxl_in)<\/strong><\/span>                 > Packet received in SecureXL from network
<\/span>SecureXL inbound CT (sxl_ct)<\/strong><\/span> <\/span>          > Accelerated packets moved from inbound to outbound processing (post routing)
<\/span>SecureXL outbound (sxl_out)<\/strong><\/span>            > Accelerated packet starts outbound processing
<\/span>SecureXL deliver (sxl_deliver)<\/strong><\/span>          > SecureXL transmits accelerated packet<\/span><\/p>\n\n\n\n
New VM chain modules in R80.20<\/span><\/th>\n<\/tr>\n<\/thead>\n<\/table>\n

Tip 4<\/span>
<\/strong><\/span><\/p>\n

There are more new chain modules in R80.20<\/p>\n

vpn before offload (vpn_in) <\/strong><\/span>                 > FW inbound preparing the tunnel for offloading the packet (along with the connection)
fw offload inbound (offload_in) <\/strong><\/span>           > FW inbound that perform the offload
fw post VM inbound  (post_vm) <\/strong><\/span>           > Packet was not offloaded (slow path) – continue processing in FW inbound<\/p>\n

# fw ctl chain<\/strong> 
\"\"
<\/strong><\/p>\n\n\n\n
New fw monitor chain key (00000000)<\/span><\/th>\n<\/tr>\n<\/thead>\n<\/table>\n

Tip 5<\/span>
<\/strong><\/span><\/p>\n

In Firewall kernel (now also SecureXL), each kernel is associated with a key (red<\/span>) witch specifies the type of traffic applicable to the chain modul.<\/span><\/p>\n

 <\/span># fw ctl chain<\/strong><\/span> 
\"\"
<\/span><\/p>\n\n\n\n\n\n\n\n\n\n
Key<\/th>\nFunction<\/th>\n<\/tr>\n<\/thead>\n
ffffffff<\/strong><\/span><\/td>\nIP Option Stip\/Restore<\/td>\n<\/tr>\n
00000001<\/strong><\/span><\/td>\nnew processed flows<\/td>\n<\/tr>\n
00000002<\/strong><\/span><\/td>\nwire mode<\/td>\n<\/tr>\n
00000003<\/strong><\/span><\/td>\nwill applied to all ciphered traffic (VPN)<\/td>\n<\/tr>\n
00000000<\/strong><\/span><\/td>\nSecureXL offloading (new in R80.20+<\/strong><\/span>)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n\n\n\n
References<\/span><\/th>\n<\/tr>\n<\/thead>\n<\/table>\n

R&D meeting Israel<\/p>\n

Copyright by Heiko Ankenbrand 1994-2019<\/p>\n","protected":false},"excerpt":{"rendered":"

R80.x Performance Tuning and Debug Tips \u2013 fw monitor R80.20 – fw monitor Tip 1 SecureXL has been significantly revised in R80.20. It now works in user space. This has also led to some changes in “fw monitor”. Since R80.20  “fw monitor” is able to show the traffic accelerated with SecureXL. Thus it is possible to<\/p>\n

Read More \u2192<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":1068,"menu_order":4,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/pages\/1104"}],"collection":[{"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/comments?post=1104"}],"version-history":[{"count":8,"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/pages\/1104\/revisions"}],"predecessor-version":[{"id":1117,"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/pages\/1104\/revisions\/1117"}],"up":[{"embeddable":true,"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/pages\/1068"}],"wp:attachment":[{"href":"https:\/\/www.ankenbrand24.de\/index.php\/wp-json\/wp\/v2\/media?parent=1104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}