{"id":39415,"date":"2019-10-31T22:32:08","date_gmt":"2019-10-31T19:32:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/check-point-optimizatsiya-cpu-i-ram\/"},"modified":"2019-10-31T22:32:08","modified_gmt":"2019-10-31T19:32:08","slug":"check-point-optimizatsiya-cpu-i-ram","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","title":{"rendered":"Check Point: optimalizace CPU a RAM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Check
\nDobr\u00fd den, kolegov\u00e9! Dnes bych cht\u011bl prodiskutovat t\u00e9ma, kter\u00e9 je pro mnoh\u00e9 administr\u00e1tory Check Point velmi aktu\u00e1ln\u00ed, a to \u201eOptimalizace CPU a RAM\u201c. Nen\u00ed neobvykl\u00e9, \u017ee br\u00e1na a\/nebo server pro spr\u00e1vu neo\u010dek\u00e1van\u011b spot\u0159ebov\u00e1vaj\u00ed hodn\u011b t\u011bchto zdroj\u016f, a cht\u011bl bych pochopit, kam \u201eut\u00edkaj\u00ed\u201c, a pokud mo\u017eno je vyu\u017e\u00edt efektivn\u011bji. <\/p>\n

1. Anal\u00fdza<\/h3>\n

\nPro anal\u00fdzu zat\u00ed\u017een\u00ed procesoru je u\u017eite\u010dn\u00e9 pou\u017e\u00edt n\u00e1sleduj\u00edc\u00ed p\u0159\u00edkazy, kter\u00e9 se zad\u00e1vaj\u00ed v expertn\u00edm re\u017eimu:
\n<\/a><\/noindex>
\ntop<\/b> ukazuje v\u0161echny procesy, mno\u017estv\u00ed spot\u0159ebov\u00e1van\u00fdch zdroj\u016f CPU a RAM v procentech, uptime, prioritu procesu a jin\u00e9<\/a><\/noindex> v re\u00e1ln\u00e9m \u010dase<\/i>a <\/p>\n

\"Check
\n
\ncpwd_admin list<\/b> Check Point WatchDog Daemon, kter\u00fd zobrazuje v\u0161echny moduly za\u0159\u00edzen\u00ed, jejich PID, stav a po\u010det spu\u0161t\u011bn\u00ed<\/i><\/p>\n

\"Check
\n
\ncpstat -f cpu os<\/b> vyu\u017eit\u00ed CPU, jejich po\u010det a rozd\u011blen\u00ed procesorov\u00e9ho \u010dasu v procentech<\/i><\/p>\n

\"Check
\n
\ncpstat -f memory os<\/b> vyu\u017eit\u00ed virtu\u00e1ln\u00ed RAM, kolik je celkov\u011b aktivn\u00ed, voln\u00e9 RAM a dal\u0161\u00ed<\/i><\/p>\n

\"Check
\n
\nSpr\u00e1vn\u00fd poznatek je, \u017ee v\u0161echny p\u0159\u00edkazy cpstat lze zobrazit pomoc\u00ed n\u00e1stroje cpview<\/b>. Sta\u010d\u00ed zadat p\u0159\u00edkaz cpview z jak\u00e9hokoli re\u017eimu v SSH relaci.<\/p>\n

\"Check
\n\"Check
\n
\nps auxwf<\/b> dlouh\u00fd seznam v\u0161ech proces\u016f, jejich ID, zabranou virtu\u00e1ln\u00ed pam\u011b\u0165 a RAM, CPU<\/i><\/p>\n

\"Check
\n
\nDal\u0161\u00ed varianta p\u0159\u00edkazu: <\/p>\n

ps -aF<\/b> uk\u00e1\u017ee nejv\u00edce n\u00e1ro\u010dn\u00fd proces<\/i><\/p>\n

\"Check
\n
\nfw ctl affinity -l -a<\/b> rozlo\u017een\u00ed jader pro r\u016fzn\u00e9 instance firewallu, tedy technologie CoreXL<\/i><\/p>\n

\"Check
\n
\n fw ctl pstat<\/b> anal\u00fdza RAM a celkov\u00e9 ukazatele p\u0159ipojen\u00ed, cookies, NAT<\/i><\/p>\n

\"Check
\n
\nfree -m<\/b> buffer RAM<\/i><\/p>\n

\"Check
\n
\nSamostatn\u00e9 pozornosti si zaslou\u017e\u00ed p\u0159\u00edkaz netsat <\/b>a jeho varianty. Nap\u0159\u00edklad, netstat -i<\/b> m\u016f\u017ee pomoci p\u0159i monitorov\u00e1n\u00ed p\u0159enosov\u00fdch buffer\u016f. Parametr RX dropped packets (RX-DRP) ve v\u00fdstupu tohoto p\u0159\u00edkazu obvykle roste s\u00e1m o sob\u011b kv\u016fli dropp\u016fm ilegitimn\u00edch protokol\u016f (IPv6, \u0161patn\u00e9\/ne\u00famysln\u00e9 VLAN tagy a dal\u0161\u00ed). Av\u0161ak pokud k dropp\u016fm doch\u00e1z\u00ed z jin\u00e9ho d\u016fvodu, je dobr\u00e9 vyu\u017e\u00edt tento \u010dl\u00e1nkem<\/a><\/noindex>, abychom zah\u00e1jili vy\u0161et\u0159ov\u00e1n\u00ed a pochopili, pro\u010d dan\u00e9 s\u00ed\u0165ov\u00e9 rozhran\u00ed odhazuje pakety. Jakmile zjist\u00edme p\u0159\u00ed\u010dinu, lze tak\u00e9 optimalizovat pr\u00e1ci za\u0159\u00edzen\u00ed.<\/p>\n

\"Check
\n
\nPokud je povolen blade Monitoring, mohou se tyto \u00fadaje zobrazit graficky ve SmartConsole, kliknut\u00edm na objekt a v\u00fdb\u011brem polo\u017eky \u201eInformace o za\u0159\u00edzen\u00ed a licenci\u201c. <\/p>\n

Blade Monitoring se nedoporu\u010duje trvale aktivovat, ale na den pro testov\u00e1n\u00ed to je zcela v po\u0159\u00e1dku.<\/p>\n

\"Check
\n
\nNav\u00edc je mo\u017en\u00e9 p\u0159id\u00e1vat dal\u0161\u00ed parametry pro monitorov\u00e1n\u00ed, jedn\u00edm z velmi u\u017eite\u010dn\u00fdch je Bytes Throughput (propustnost za\u0159\u00edzen\u00ed).<\/p>\n

\"Check
\n
\nPokud existuje jak\u00fdkoli jin\u00fd monitorovac\u00ed syst\u00e9m, nap\u0159\u00edklad bezplatn\u00fd Zabbix<\/a><\/noindex>, zalo\u017een\u00fd na SNMP, tak\u00e9 bude vyhovovat pro odhalen\u00ed t\u011bchto probl\u00e9m\u016f.<\/p>\n

2. \"\u00danik\" RAM v pr\u016fb\u011bhu \u010dasu<\/h3>\n

\n\u010casto se klade ot\u00e1zka, \u017ee v pr\u016fb\u011bhu \u010dasu br\u00e1na nebo mana\u017eersk\u00fd server za\u010d\u00edn\u00e1 spot\u0159ebov\u00e1vat st\u00e1le v\u00edce a v\u00edce RAM. Chci uklidnit: to je norm\u00e1ln\u00ed jev pro syst\u00e9my podobn\u00e9 Linuxu. <\/p>\n

Pod\u00edval jsem se na v\u00fdstup p\u0159\u00edkaz\u016f free -m<\/b> a cpstat -f memory os<\/b> na aplika\u010dn\u00edm za\u0159\u00edzen\u00ed z expertn\u00edho re\u017eimu, kde lze zapo\u010d\u00edtat a prohl\u00e9dnout v\u0161echny parametry souvisej\u00edc\u00ed s RAM.<\/p>\n

V sou\u010dasn\u00e9 dob\u011b dostupn\u00e9 pam\u011bti na br\u00e1n\u011b Voln\u00e1 pam\u011b\u0165<\/b> + Pam\u011b\u0165 buffer\u016f<\/b> + Ulo\u017een\u00e1 pam\u011b\u0165<\/b> = +-1,5 GB<\/b>, obvykle.<\/p>\n

Jak \u0159\u00edk\u00e1 SR, v pr\u016fb\u011bhu \u010dasu se br\u00e1na\/management server optimalizuje a pou\u017e\u00edv\u00e1 st\u00e1le v\u00edce pam\u011bti, a\u017e dos\u00e1hne p\u0159ibli\u017en\u011b 80% vyu\u017eit\u00ed, a pak se zastav\u00ed. M\u016f\u017eete restartovat za\u0159\u00edzen\u00ed, a t\u00edm se ukazatel resetuje. 1,5 GB voln\u00e9 RAM br\u00e1n\u011b ur\u010dit\u011b sta\u010d\u00ed k prov\u00e1d\u011bn\u00ed v\u0161ech \u00fakol\u016f a management z\u0159\u00eddka dosahuje takov\u00fdch prahov\u00fdch hodnot.<\/p>\n

Tak\u00e9 v\u00fdstupy zm\u00edn\u011bn\u00fdch p\u0159\u00edkaz\u016f uk\u00e1\u017e\u00ed, kolik m\u00e1te N\u00edzk\u00e1 pam\u011b\u0165<\/b> (opera\u010dn\u00ed pam\u011b\u0165 v u\u017eivatelsk\u00e9m prostoru) a Vysok\u00e1 pam\u011b\u0165<\/b> (opera\u010dn\u00ed pam\u011b\u0165 v j\u00e1d\u0159e) bylo pou\u017eito.<\/p>\n

Procesy j\u00e1dra (v\u010detn\u011b aktivn\u00edch modul\u016f, jako jsou moduly j\u00e1dra Check Point) vyu\u017e\u00edvaj\u00ed pouze n\u00edzkou pam\u011b\u0165. U\u017eivatelsk\u00e9 procesy v\u0161ak mohou vyu\u017e\u00edvat jak n\u00edzkou, tak vysokou pam\u011b\u0165. Nav\u00edc je n\u00edzk\u00e1 pam\u011b\u0165 p\u0159ibli\u017en\u011b rovna Celkov\u00e1 pam\u011b\u0165<\/b>.<\/p>\n

O starosti byste m\u011bli m\u00edt pouze tehdy, pokud se v log\u00e1ch objevuj\u00ed chyby \"moduly se restartuj\u00ed nebo procesy jsou zab\u00edjeny kv\u016fli propu\u0161t\u011bn\u00ed pam\u011bti z d\u016fvodu OOM (Out of memory)\".<\/b>Pak byste m\u011bli restartovat br\u00e1nu a obr\u00e1tit se na podporu, pokud restart nepom\u016f\u017ee.<\/p>\n

\u00dapln\u00fd popis najdete v sk99547 <\/a><\/noindex>a sk99593<\/a><\/noindex>.<\/p>\n

3. Optimalizace<\/h3>\n

\nN\u00ed\u017ee jsou uvedeny ot\u00e1zky a odpov\u011bdi na optimalizaci CPU a RAM. Na tyto ot\u00e1zky byste si m\u011bli poctiv\u011b odpov\u011bd\u011bt a poslechnout si doporu\u010den\u00ed.<\/p>\n

3.1. Byla spr\u00e1vn\u011b vybr\u00e1na aplika\u010dn\u00ed za\u0159\u00edzen\u00ed? Byl proveden pilotn\u00ed projekt?<\/h4>\n

\nP\u0159esto\u017ee byl proveden spr\u00e1vn\u00fd sizing, s\u00ed\u0165 se mohla jednodu\u0161e rozr\u016fst a tato za\u0159\u00edzen\u00ed si s n\u00e1kladem jednodu\u0161e neporad\u00ed. Druh\u00e1 mo\u017enost je, \u017ee sizing jako takov\u00fd nebyl proveden.<\/p>\n

3.2. Je povolena HTTPS inspekce? Pokud ano, je technologie nastavena podle nejlep\u0161\u00edch praktik? <\/h4>\n

\nObra\u0165te se na \u010dl\u00e1nek<\/a><\/noindex>, pokud jste na\u0161\u00edm klientem, nebo na sk108202<\/a><\/noindex>.<\/p>\n

Po\u0159ad\u00ed pravidel v politice HTTPS inspekce m\u00e1 velk\u00fd v\u00fdznam pro optimalizaci na\u010d\u00edt\u00e1n\u00ed HTTPS web\u016f.<\/p>\n

Doporu\u010den\u00e9 po\u0159ad\u00ed um\u00edst\u011bn\u00ed pravidel:<\/p>\n

    \n
  1. Pravidla bypass se kategoriemi\/URL<\/li>\n
  2. Pravidla inspect s kategoriemi\/URL<\/li>\n
  3. Pravidla inspect pro ostatn\u00ed kategorie<\/li>\n<\/ol>\n

    \n\"Check
    \n
    \nPodobn\u011b jako u firewallov\u00e9 politiky, Check Point hled\u00e1 shodu podle paket\u016f shora dol\u016f, tak\u017ee pravidla bypass by m\u011bla b\u00fdt um\u00edst\u011bna na vrchu, proto\u017ee br\u00e1na nebude pl\u00fdtvat zdroji na proch\u00e1zen\u00ed v\u0161emi pravidly, pokud je t\u0159eba tento paket p\u0159esko\u010dit.<\/p>\n

    3.3 Pou\u017e\u00edvaj\u00ed se objekty address-range?<\/h4>\n

    \nObjekty s vyu\u017eit\u00edm adresn\u00edho rozsahu, nap\u0159\u00edklad s\u00ed\u0165 192.168.0.0-192.168.5.0, spot\u0159ebov\u00e1vaj\u00ed podstatn\u011b v\u00edce RAM ne\u017e 5 s\u00ed\u0165ov\u00fdch objekt\u016f. Obecn\u011b se pova\u017euje za dobrou praxi odstra\u0148ovat nepou\u017e\u00edvan\u00e9 objekty ve SmartConsole, proto\u017ee p\u0159i ka\u017ed\u00e9m nasazen\u00ed politiky br\u00e1na a server pro spr\u00e1vu spot\u0159ebov\u00e1vaj\u00ed zdroje a, co je hlavn\u00ed, \u010das na ov\u011b\u0159en\u00ed a uplatn\u011bn\u00ed politiky.<\/p>\n

    3.4. Jak je nastavena politika Threat Prevention? <\/h4>\n

    \nV prvn\u00ed \u0159ad\u011b, Check Point doporu\u010duje izolovat IPS do samostatn\u00e9ho profilu a vytv\u00e1\u0159et samostatn\u00e1 pravidla pro tento blade. <\/p>\n

    Nap\u0159\u00edklad, administr\u00e1tor se domn\u00edv\u00e1, \u017ee segment DMZ by m\u011bl b\u00fdt chr\u00e1n\u011bn pouze pomoc\u00ed IPS. Proto je t\u0159eba vytvo\u0159it pravidlo specificky pro tento segment s profilem, ve kter\u00e9m je zapnuto pouze IPS, aby br\u00e1na nemusela pl\u00fdtvat zdroji na zpracov\u00e1n\u00ed paket\u016f jin\u00fdmi blade.<\/p>\n

    Pokud jde o nastaven\u00ed profil\u016f, doporu\u010duje se nastavit je podle nejlep\u0161\u00edch praktik v tomto dokumentu<\/a><\/noindex>(str\u00e1nky 17-20).<\/p>\n

    3.5. Kolik podpis\u016f je v re\u017eimu Detect v nastaven\u00ed IPS? <\/h4>\n

    \nDoporu\u010duje se d\u016fkladn\u011b zpracovat podpisy s t\u00edm, \u017ee by m\u011bly b\u00fdt deaktivov\u00e1ny nepou\u017e\u00edvan\u00e9 (nap\u0159\u00edklad podpisy na exploataci produkt\u016f Adobe vy\u017eaduj\u00ed mnoho v\u00fdpo\u010detn\u00edho v\u00fdkonu, a pokud u z\u00e1kazn\u00edka takov\u00e9 produkty nejsou, m\u00e1 smysl tyto podpisy deaktivovat). D\u00e1le nastavte Prevent m\u00edsto Detect, kde je to mo\u017en\u00e9, proto\u017ee br\u00e1na spot\u0159ebov\u00e1v\u00e1 zdroje na zpracov\u00e1n\u00ed cel\u00e9ho spojen\u00ed v re\u017eimu Detect, v re\u017eimu Prevent okam\u017eit\u011b odm\u00edt\u00e1 spojen\u00ed a nepl\u00fdtv\u00e1 zdroji na \u00fapln\u00e9 zpracov\u00e1n\u00ed paketu.<\/p>\n

    3.6. Jak\u00e9 soubory zpracov\u00e1vaj\u00ed blade Threat Emulation, Threat Extraction, Anti-Virus?<\/h4>\n

    \nNem\u00e1 smysl emulovat a analyzovat soubory s p\u0159\u00edponami, kter\u00e9 si va\u0161i u\u017eivatel\u00e9 nestahuj\u00ed, nebo kter\u00e9 pova\u017eujete za zbyte\u010dn\u00e9 ve va\u0161\u00ed s\u00edti (nap\u0159\u00edklad soubory bat a exe lze snadno zablokovat pomoc\u00ed technologie Content Awareness na \u00farovni firewallu, tak\u017ee prost\u0159edky br\u00e1ny budou vyu\u017eity efektivn\u011bji). Nav\u00edc v nastaven\u00ed Threat Emulation m\u016f\u017eete vyb\u00edrat Environment (opera\u010dn\u00ed syst\u00e9m) pro emulaci hrozeb v p\u00edskovi\u0161ti a nastavovat Environment Windows 7, kdy\u017e v\u0161ichni u\u017eivatel\u00e9 pracuj\u00ed s verz\u00ed 10, tak\u00e9 ned\u00e1v\u00e1 smysl.<\/p>\n

    3.7. Jsou pravidla firewallu a pravidla na \u00farovni aplikace um\u00edst\u011bna podle osv\u011bd\u010den\u00fdch praktik? <\/h4>\n

    \nPokud m\u00e1 pravidlo p\u0159\u00edli\u0161 mnoho z\u00e1sah\u016f (shod), doporu\u010duje se um\u00edstit je nahoru, zat\u00edmco pravidla s mal\u00fdm po\u010dtem z\u00e1sah\u016f by m\u011bla b\u00fdt na spodn\u00ed \u010d\u00e1sti. Hlavn\u00ed je sledovat, aby se nep\u0159ekr\u00fdvala a nekryla navz\u00e1jem. Doporu\u010den\u00e1 architektura pravidel firewallu:<\/p>\n

    \"Check
    \n
    \nVysv\u011btlen\u00ed: <\/p>\n

    Prvn\u00ed pravidla \u2013 sem se um\u00eds\u0165uj\u00ed pravidla s nejv\u011bt\u0161\u00edm po\u010dtem shod
    \nHlukov\u00e9 pravidlo \u2013 pravidlo pro odm\u00edtnut\u00ed parazitn\u00edho provozu, jako je NetBIOS
    \nTajn\u00e9 pravidlo \u2013 z\u00e1kaz p\u0159\u00edstup\u016f k br\u00e1n\u00e1m a management\u016fm pro v\u0161echny krom\u011b t\u011bch zdroj\u016f, kter\u00e9 byly uvedeny v pravidlech pro autentizaci na br\u00e1nu
    \n\u010cist\u011bn\u00ed, posledn\u00ed a pravidla Drop se obvykle kombinuj\u00ed do jednoho pravidla pro odm\u00edtnut\u00ed v\u0161eho, co nebylo d\u0159\u00edve povoleno<\/p>\n

    Osv\u011bd\u010den\u00e9 praktiky jsou pops\u00e1ny v sk106597<\/a><\/noindex>.<\/p>\n

    3.8. Jak\u00e1 nastaven\u00ed maj\u00ed slu\u017eby vytvo\u0159en\u00e9 administr\u00e1tory? <\/h4>\n

    \nNap\u0159\u00edklad je vytvo\u0159ena n\u011bjak\u00e1 TCP slu\u017eba na ur\u010dit\u00e9m portu a m\u00e1 smysl ve pokro\u010dil\u00fdch nastaven\u00edch slu\u017eby od\u0161krtnout mo\u017enost \u201eMatch for Any\u201c. V tomto p\u0159\u00edpad\u011b bude tato slu\u017eba konkr\u00e9tn\u011b spadat pod pravidlo, ve kter\u00e9m je uvedena, a nebude se \u00fa\u010dastnit pravidel, kde v sloupci Slu\u017eby je naps\u00e1no Any.<\/p>\n

    \"Check
    \n
    \nPokud mluv\u00edme o slu\u017eb\u00e1ch, je t\u0159eba zm\u00ednit, \u017ee n\u011bkdy je nezbytn\u00e9 dola\u010fovat \u010dasov\u00e9 limity. Toto nastaven\u00ed umo\u017en\u00ed efektivn\u011bji vyu\u017e\u00edvat prost\u0159edky br\u00e1ny, aby se zbyte\u010dn\u011b neudr\u017eovaly TCP\/UDP sezen\u00ed protokol\u016f, kter\u00e9 nepot\u0159ebuj\u00ed dlouh\u00fd \u010dasov\u00fd limit. Nap\u0159\u00edklad na obr\u00e1zku n\u00ed\u017ee jsem p\u0159em\u00edstil \u010dasov\u00fd limit slu\u017eby domain-udp z 40 sekund na 30 sekund.<\/p>\n

    \"Check
    \n<\/p>\n

    3.9. Pou\u017e\u00edv\u00e1 se SecureXL a jak\u00fd je procentu\u00e1ln\u00ed n\u00e1r\u016fst zrychlen\u00ed? <\/h4>\n

    \nKvalitu pr\u00e1ce SecureXL lze zkontrolovat pomoc\u00ed z\u00e1kladn\u00edch p\u0159\u00edkaz\u016f v expertn\u00edm re\u017eimu na br\u00e1n\u011b fwaccel stat<\/b> a fw accel stats -s<\/b>. D\u00e1le je t\u0159eba zjistit, jak\u00fd provoz je urychlov\u00e1n, jak\u00e9 \u0161ablony (templates) lze je\u0161t\u011b vytvo\u0159it. <\/p>\n

    V\u00fdchoz\u00ed \u0161ablony Drop nejsou zapnut\u00e9, jejich aktivace pozitivn\u011b ovlivn\u00ed fungov\u00e1n\u00ed SecureXL. K tomu p\u0159ejd\u011bte do nastaven\u00ed br\u00e1ny a na kartu Optimalizace:<\/p>\n

    \"Check
    \n
    \nP\u0159i pr\u00e1ci s clusterem m\u016f\u017eete pro optimalizaci CPU tak\u00e9 vypnout synchronizaci nekritick\u00fdch slu\u017eeb, jako jsou UDP DNS, ICMP a dal\u0161\u00ed. K tomu je pot\u0159eba p\u0159ej\u00edt do nastaven\u00ed slu\u017eby \u2192 Roz\u0161\u00ed\u0159en\u00e9 \u2192 Synchronizovat p\u0159ipojen\u00ed stavu synchronizace, pokud je v clusteru povoleno.<\/p>\n

    \"Check
    \n
    \nV\u0161echny osv\u011bd\u010den\u00e9 postupy jsou pops\u00e1ny v     sk98348<\/a><\/noindex>.<\/p>\n

    3.10. Jak se pou\u017e\u00edv\u00e1 CoreXL? <\/h4>\n

    \nTechnologie CoreXL umo\u017e\u0148uj\u00edc\u00ed vyu\u017e\u00edvat v\u00edce CPU pro instance firewallu jednozna\u010dn\u011b pom\u00e1h\u00e1 optimalizovat fungov\u00e1n\u00ed za\u0159\u00edzen\u00ed. Nejprve p\u0159\u00edkaz fw ctl affinity -l -a <\/b>uk\u00e1\u017ee pou\u017e\u00edvan\u00e9 instance firewallu a procesory, kter\u00e9 jsou p\u0159id\u011bleny pot\u0159eb\u00e1m SND (modul, kter\u00fd rozd\u011bluje provoz mezi firewallov\u00e9 entity). Pokud nejsou zapojeny v\u0161echny procesory, m\u016f\u017eete je p\u0159idat p\u0159\u00edkazem cpconfig <\/b>na br\u00e1n\u011b.
    \nDal\u0161\u00ed dobr\u00e1 v\u011bc je nainstalovat     hotfix <\/a><\/noindex>pro aktivaci Multi-Queue. Multi-Queue \u0159e\u0161\u00ed probl\u00e9m, kdy se procesor s SND vyu\u017e\u00edv\u00e1 na vysok\u00e9 procento, zat\u00edmco instance firewallu na jin\u00fdch procesorech nepracuj\u00ed. T\u00edm by SND z\u00edskala mo\u017enost vytv\u00e1\u0159et v\u00edce front pro jednu NIC a nastavovat r\u016fzn\u00e9 priority pro r\u016fzn\u00fd provoz na \u00farovni j\u00e1dra. To znamen\u00e1, \u017ee j\u00e1dra CPU se budou vyu\u017e\u00edvat efektivn\u011bji. Metodiky jsou tak\u00e9 pops\u00e1ny v sk98348<\/a><\/noindex>.<\/p>\n

    Na z\u00e1v\u011br bych cht\u011bl \u0159\u00edci, \u017ee to rozhodn\u011b nejsou v\u0161echny osv\u011bd\u010den\u00e9 postupy pro optimalizaci pr\u00e1ce Check Point, ale ty nejpopul\u00e1rn\u011bj\u0161\u00ed. Pokud si p\u0159ejete objednat audity va\u0161\u00ed bezpe\u010dnostn\u00ed politiky nebo vy\u0159e\u0161it probl\u00e9m souvisej\u00edc\u00ed s Check Point, nev\u00e1hejte se obr\u00e1tit na sales@tssolution.ru. <\/p>\n

    D\u011bkujeme za pozornost!
    \n
    Zdroj:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u043a\u043e\u043b\u043b\u0435\u0433\u0438! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u043e\u0431\u0441\u0443\u0434\u0438\u0442\u044c \u043e\u0447\u0435\u043d\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 Check Point \u0442\u0435\u043c\u0443 \u00ab\u041e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f CPU \u0438 RAM\u00bb. \u041d\u0435\u0440\u0435\u0434\u043a\u0438 \u0441\u043b\u0443\u0447\u0430\u0438, \u043a\u043e\u0433\u0434\u0430 \u0448\u043b\u044e\u0437 \u0438\/\u0438\u043b\u0438 \u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044e\u0442 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u044d\u0442\u0438\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u0438 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0443\u0434\u0430 \u043e\u043d\u0438 \u201c\u0443\u0442\u0435\u043a\u0430\u044e\u0442\u201d, \u0438 \u043f\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0433\u0440\u0430\u043c\u043e\u0442\u043d\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445. 1. \u0410\u043d\u0430\u043b\u0438\u0437 \u0414\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39416,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39415","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Check Point: optimalizace CPU a RAM | ProHoster","description":"Dobr\u00fd den, kolegov\u00e9!","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Check Point: \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f CPU \u0438 RAM | ProHoster","og:description":"\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u043a\u043e\u043b\u043b\u0435\u0433\u0438!","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:32:08+00:00","article:modified_time":"2019-10-31T19:32:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39415","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 01:55:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:50:24","updated":"2026-01-24 01:55:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/39415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=39415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/39415\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/39416"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=39415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=39415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=39415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}