{"id":94118,"date":"2020-09-13T07:42:29","date_gmt":"2020-09-13T05:42:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii"},"modified":"2020-09-13T07:42:29","modified_gmt":"2020-09-13T05:42:29","slug":"7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii","title":{"rendered":"7. NGFW for small businesses. Performance and general recommendations","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"7.<\/p>\n

The time has come to conclude the series of articles on the new generation of Check Point SMB (1500 series). We hope this has been a useful experience for you, and you will continue to stay with us on the TS Solution blog. The topic for the final article is not widely covered, but it is no less important \u2014 tuning the performance of SMB. In this article, we will discuss the configuration options for the hardware and software components of the NGFW, describe the available commands, and ways to interact.<\/p>\n

All articles in the NGFW series for small businesses: <\/p>\n

    \n
  1. \n

    New Check Point 1500 Security Gateway Line<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  2. \n

    Unboxing and Setup<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  3. \n

    Wireless Data Transmission: WiFi and LTE<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  4. \n

    VPN<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  5. \n

    Cloud Management SMP<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  6. \n

    Smart-1 Cloud<\/u><\/a><\/noindex><\/p>\n<\/li>\n<\/ol>\n

    Currently, there aren\u2019t many sources of information on performance tuning for SMB solutions due to limits<\/u><\/a><\/noindex> the internal OS \u2014 Gaia 80.20 Embedded. In our article, we will use a layout with centralized management (dedicated Management Server) \u2014 it allows the use of a greater number of tools when working with NGFW.<\/p>\n

    Hardware components<\/h2>\n

    Before addressing the architecture of the Check Point SMB family, you can always consult your partner to use the utility Appliance Sizing Tool<\/em>, to select the optimal solution based on specified characteristics (throughput, expected number of users, etc.).<\/p>\n

    Important notes when interacting with the hardware part of your NGFW<\/p>\n

      \n
    1. \n

      NGFW solutions from the SMB family do not have the capability of hardware upgrades for system components (CPU, RAM, HDD); depending on the model, there is support for SD cards, which allows you to expand disk capacity, but not significantly.<\/p>\n<\/li>\n

    2. \n

      The operation of network interfaces requires monitoring. In Gaia 80.20 Embedded, there aren\u2019t many tools for monitoring, but you can always use the well-known command in CLI through Expert mode <\/p>\n

      # ifconfig<\/em><\/p>\n

      \"7.<\/p>\n

      Note the underlined lines; they will allow you to assess the number of errors on the interface. It is highly recommended to check these parameters during the initial deployment of your NGFW, as well as periodically during operation.<\/p>\n<\/li>\n

    3. \n

      For full Gaia, there is the command: <\/p>\n

      > show diag <\/p>\n

      With it, you can obtain information about the temperature of the hardware. Unfortunately, this option is not available in 80.20 Embedded, so we will indicate the most popular SNMP traps:<\/p>\n

      Title <\/strong><\/p>\n

      Description<\/strong><\/p>\n

      Interface disconnected<\/em><\/p>\n

      Interface disconnection<\/p>\n

      VLAN removed<\/em><\/p>\n

      VLAN removal<\/p>\n

      High memory utilization<\/em><\/p>\n

      High RAM utilization<\/p>\n

      Low disk space<\/em><\/p>\n

      Low HDD space<\/p>\n

      High CPU utilization<\/em><\/p>\n

      High CPU utilization<\/p>\n

      High CPU interrupts rate<\/em><\/p>\n

      High interrupt frequency<\/p>\n

      High connection rate<\/em><\/p>\n

      High rate of new connections<\/p>\n

      High concurrent connections<\/em><\/p>\n

      High Level of Competitive Sessions<\/p>\n

      High Firewall Throughput<\/em><\/p>\n

      High Firewall Bandwidth Capacity<\/p>\n

      High Accepted Packet Rate<\/em><\/p>\n

      High Packet Reception Rate<\/p>\n

      Cluster Member State Changed<\/em><\/p>\n

      Cluster State Change<\/p>\n

      Connection with Log Server Error<\/em><\/p>\n

      Lost Connection with Log-Server<\/p>\n<\/li>\n

    4. \n

      Your gateway's operation requires RAM monitoring. For Gaia (Linux-like OS) this is a normal situation<\/u><\/a><\/noindex>, when RAM usage reaches 70-80%. <\/p>\n

      The architecture of SMB solutions does not provide for the use of SWAP memory, unlike older Check Point models. However, a parameter <vm.swappiness> has been observed in Linux system files, suggesting the theoretical possibility to modify the SWAP parameter.<\/p>\n<\/li>\n<\/ol>\n

      Software Component<\/h2>\n

      At the time of this article's publication, the current<\/u><\/a><\/noindex> Gaia versions \u2014 80.20.10. You should know that there are limitations when working in CLI: in Expert mode, some Linux commands are supported. To evaluate the operation of the NGFW, an assessment of the demons and services is required, more details about this can be found in article<\/u><\/a><\/noindex> my colleague's work. We will review possible commands for SMB.<\/p>\n

      Working with Gaia OS<\/p>\n

        \n
      1. \n

        Viewing SecureXL Templates<\/p>\n

        # fwaccel stat<\/strong><\/p>\n

        \"7.<\/li>\n

      2. \n

        View Load by Cores<\/p>\n

        # fw ctl multik stat<\/strong><\/p>\n

        \"7.<\/li>\n

      3. \n

        View Number of Sessions (Connections).<\/p>\n

        # fw ctl pstat<\/strong><\/p>\n

        \"7.<\/li>\n

      4. \n

        *View Cluster Status<\/p>\n

        # cphaprob stat<\/strong><\/p>\n

        \"7.<\/li>\n

      5. \n

        Classic Linux Command TOP<\/p>\n<\/li>\n<\/ol>\n

        Logging<\/h3>\n

        As you already know, there are three ways to work with NGFW logs (storage, processing): locally, centrally, and in the cloud. The last two options imply the existence of an entity \u2014 Management Server. <\/p>\n

        Possible Management Schemes for NGFW\"7.<\/p>\n

        Most Valuable Log Files<\/p>\n

          \n
        1. \n

          System Messages (contains less information than full Gaia)<\/p>\n

          # tail -f \/var\/log\/messages2<\/strong><\/p>\n

          \"7.<\/li>\n

        2. \n

          Error Messages from the Blades (a useful file for troubleshooting)<\/p>\n

          # tail -f \/var\/log\/log\/sfwd.elg<\/strong><\/p>\n

          \"7.<\/li>\n

        3. \n

          View Messages from Kernel-Level Buffer.<\/p>\n

          # dmesg<\/strong><\/p>\n

          \"7.<\/li>\n<\/ol>\n

          Blade Configuration<\/h2>\n

          This section will not provide full instructions on configuring your Check Point NGFW; it contains our recommendations gathered through experience. <\/p>\n

          Application Control \/ URL Filtering<\/p>\n