{"id":39415,"date":"2019-10-31T22:32:08","date_gmt":"2019-10-31T19:32:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/check-point-optimizatsiya-cpu-i-ram\/"},"modified":"2019-10-31T22:32:08","modified_gmt":"2019-10-31T19:32:08","slug":"check-point-optimizatsiya-cpu-i-ram","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","title":{"rendered":"Check Point: optimizacija CPU-a i RAM-a","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/fa60de5a2f798b24b39e69b9e71569d2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nPozdrav kolege! Danas bih \u017eeleo raspraviti vrlo va\u017enu temu za mnoge administratore Check Pointa: \"Optimizacija CPU i RAM-a\". Nije neuobi\u010dajeno da gateway i\/ili menad\u017eerski server iznenada tro\u0161e mnogo ovih resursa, i \u017eeleo bih da razumem kuda oni \"curi\" i kako ih bolje iskoristiti. <\/p>\n<h3>1. Analiza<\/h3>\n<p>\nZa analizu optere\u0107enja procesora korisno je koristiti slede\u0107e komande koje se unose u ekspertskom re\u017eimu: <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<b>top<\/b> <i>prikazuje sve procese, koli\u010dinu resursa koje CPU i RAM tro\u0161e u procentima, uptime, prioritet procesa i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.fastwebhost.in\/blog\/what-is-top-command-and-how-to-read-top-command\/\">drugo<\/a><\/noindex> u realnom vremenu<\/i>i <\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/35b60512eacec44c4e6797cc8fa0682d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>cpwd_admin list<\/b> <i>Check Point WatchDog Daemon, koji prikazuje sve module ure\u0111aja, njihov PID, stanje i broj pokretanja<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/18df876c486836b33cb7826428bb1834.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>cpstat -f cpu os<\/b> <i>korisnost CPU-a, njihovu koli\u010dinu i raspodelu procesorskog vremena u procentima<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/f5ba8ea1ddca6fadc5f19eea5dad0b01.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>cpstat -f memory os<\/b> <i>korisnost virtuelne RAM, koliko je ukupno aktivnog, slobodnog RAM-a i drugo<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/87b2028b10d937a03719c633da819b4f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrvo pravilo je da sve komande cpstat mo\u017eete pogledati pomo\u0107u alata <b>cpview<\/b>. Da biste to uradili, jednostavno unesite komandu cpview iz bilo kog re\u017eima u SSH sesiji.<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/2607a5b9e120a6cd3f7120a9ffefc06d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/4e7a97d41326a4e6a723d66be0dc0fdf.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>ps auxwf<\/b> <i>dugi spisak svih procesa, njihovih ID, zauzetu virtuelnu memoriju i memoriju u RAM-u, CPU<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/b3ff5b04b47827edfeb948fbc01276d7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDruga varijacija komande: <\/p>\n<p><b>ps -aF<\/b> <i>prikazuje najvi\u0161e resursa tro\u0161e\u0107i proces<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/2513d28347427231840b5c730637a53d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>fw ctl affinity -l -a<\/b> <i>distribucija jezgara pod razli\u010dite instance vatrozida, odnosno tehnologija CoreXL<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/693d5d6932c08bb1d4d504a250004c4c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b> fw ctl pstat<\/b> <i>analiza RAM-a i op\u0161ti pokazatelji konekcija, kola\u010di\u0107a, NAT<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/f9b826e61723e196f70d8c698b89d76b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>free -m<\/b> <i>RAM baferi<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/3b773b54ce5929d4b9878c618ca86aa7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPosebnu pa\u017enju zaslu\u017euje komanda <b>netsat <\/b>i njene varijacije. Na primer, <b>netstat -i<\/b> mo\u017ee pomo\u0107i u re\u0161avanju zadatka nadzora bafera. Parametar RX dropped packets (RX-DRP) u izlazu ove komande obi\u010dno raste sam od sebe zbog gubitaka nelegitimnih protokola (IPv6, lo\u0161i\/nenamerni VLAN tagovi i drugi). Me\u0111utim, ako se gubici de\u0161avaju iz drugog razloga, treba koristiti ovu <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.tataranovich.com\/2014\/02\/ifconfig-rx-dropped-increasing.html\">\u010dlanak<\/a><\/noindex>, da biste zapo\u010deli istragu i shvatili za\u0161to ovaj mre\u017eni interfes gubi pakete. Kada saznate razlog, rad ure\u0111aja se mo\u017ee optimizovati.<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/772f10610474970cbd4c4f8007315189.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAko je uklju\u010den monitoring blade, mo\u017eete grafi\u010dki pratiti ove podatke u SmartConsole-u, klikom na objekat i odabirom opcije \"Device &amp; License Information\". <\/p>\n<p>Preporu\u010duje se da se blade Monitoring ne uklju\u010duje trajno, ali na dan za testiranje je sasvim u redu.<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/4330c5e0b296063c09000f8c1fe49c03.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0160tavi\u0161e, mo\u017eete dodavati jo\u0161 parametara za monitoring, jedan od njih je veoma koristan \u2014 Bytes Throughput (propusnost ure\u0111aja).<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/753d49e4fb1668def3ae57c00b0e6fc4.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAko postoji neki drugi sustav za pra\u0107enje, na primjer, besplatan <noindex><a rel=\"nofollow\" href=\"https:\/\/www.zabbix.com\/ru\/download\">Zabbix,<\/a><\/noindex>, temeljen na SNMP-u, tako\u0111er \u0107e poslu\u017eiti za otkrivanje tih problema.<\/p>\n<h3>2. \"Curjenje\" RAM-a tijekom vremena<\/h3>\n<p>\n\u010cesto se postavlja pitanje za\u0161to s vremenom pristupna ili menad\u017eerska server sve vi\u0161e i vi\u0161e koristi RAM. \u017delim vas umiriti: ovo je normalna pojava za Linux sli\u010dne sustave. <\/p>\n<p>Pogledom na izlaz naredbi <b>free -m<\/b> i <b>cpstat -f memory os<\/b> na ure\u0111aju iz stru\u010dnog na\u010dina rada, mo\u017eete izra\u010dunati i pogledati sve parametre povezane s RAM-om.<\/p>\n<p>Trenutna dostupna memorija na ure\u0111aju <b>Slobodno pam\u0107enje<\/b> + <b>Memorija u baferima<\/b> + <b>Ke\u0161irana memorija<\/b> = <b>+-1.5 GB<\/b>, obi\u010dno.<\/p>\n<p>Kao \u0161to ka\u017ee tehni\u010dka podr\u0161ka, s vremenom pristupni\/menad\u017eerski server se optimizira i koristi sve vi\u0161e memorije, dosegnuv\u0161i otprilike 80% upotrebe, i tada se zaustavlja. Mo\u017eete ponovno pokrenuti ure\u0111aj, i tada \u0107e se ovaj indikator resetirati. 1.5 GB slobodne RAM-a je sasvim dovoljno za obavljanje svih zadataka, a menad\u017ement rijetko dose\u017ee takve grani\u010dne vrijednosti.<\/p>\n<p>Tako\u0111er, izlazi spomenutih naredbi \u0107e pokazati koliko imate<b> Niska memorija<\/b> (operativna memorija u korisni\u010dkom prostoru) i <b>Visoka memorija<\/b> (operativna memorija u kernel prostoru) kori\u0161teno.<\/p>\n<p>Kernel procesi (uklju\u010duju\u0107i aktivne module, poput Check Point kernel modula) koriste samo nisku memoriju. Me\u0111utim, korisni\u010dki procesi mogu koristiti i nisku i visoku memoriju. \u0160tovi\u0161e, niska memorija je otprilike jednaka <b>Ukupna memorija<\/b>.<\/p>\n<p>Treba se brinuti samo ako u logovima budu padale gre\u0161ke <b>\"modules reboot or processes being killed to reclaim memory due to OOM (Out of memory)\"<\/b>. Tada je potrebno ponovno pokrenuti ure\u0111aj i obratiti se podr\u0161ci ako ponovni pokret ne pomogne.<\/p>\n<p>Puno obja\u0161njenje mo\u017eete prona\u0107i u <noindex><a rel=\"nofollow\" href=\"https:\/\/supportcenter.checkpoint.com\/supportcenter\/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk99547&amp;partition=Advanced&amp;product=X-Series%22\">sk99547 <\/a><\/noindex>i <noindex><a rel=\"nofollow\" href=\"https:\/\/supportcenter.checkpoint.com\/supportcenter\/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk99593&amp;partition=Advanced&amp;product=X-Series%22\">sk99593<\/a><\/noindex>.<\/p>\n<h3> 3. Optimizacija<\/h3>\n<p>\nU nastavku su pitanja i odgovori o optimizaciji CPU-a i RAM-a. Na njih treba iskreno odgovoriti samom sebi i poslu\u0161ati preporuke.<\/p>\n<h4>3.1. Je li ure\u0111aj pravilno odabran? Je li projekt bio pilot projekt?<\/h4>\n<p>\nUnato\u010d dobrom dimenzioniranju, mre\u017ea je mogla jednostavno rasti, a ova oprema se jednostavno ne mo\u017ee nositi s optere\u0107enjem. Druga mogu\u0107nost je da dimenzioniranje kao takvo nije bilo.<\/p>\n<h4>3.2. Je li uklju\u010dena HTTPS inspekcija? Ako jest, je li tehnologija postavljena prema najboljim praksama? <\/h4>\n<p>\nObratite se <noindex><a rel=\"nofollow\" href=\"https:\/\/sd.cpsupport.ru\/knowledge_base\/articles\/18\">\u010dlanku<\/a><\/noindex>, ako ste na\u0161 klijent, ili <noindex><a rel=\"nofollow\" href=\"https:\/\/supportcenter.checkpoint.com\/supportcenter\/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk108202&amp;partition=General&amp;product=HTTPS\">sk108202<\/a><\/noindex>.<\/p>\n<p>Redosljed pravila u politici HTTPS inspekcije igra zna\u010dajnu ulogu u optimizaciji otvaranja HTTPS stranica.<\/p>\n<p>Preporu\u010deni redosljed pravila:<\/p>\n<ol>\n<li>Pravila za izuze\u0107e s kategorijama\/URL-ovima<\/li>\n<li>Pravila inspekcije s kategorijama\/URL-ovima<\/li>\n<li>Pravila inspekcije za sve ostale kategorije<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/a8682438dcc65efa1fcfe83204fa21bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa sli\u010dan na\u010din kao kod pravila vatrozida, Check Point tra\u017ei podudaranja paketa odozgo prema dolje, stoga je bolje smjestiti bypass pravila na vrh, jer \u0107e propusni sustav u\u0161tedjeti resurse ne prolaze\u0107i kroz sva pravila ako je paket potrebno presko\u010diti.<\/p>\n<h4>3.3 Koriste li se objekti raspona adresa?<\/h4>\n<p>\nObjekti s rasponom adresa, na primjer, mre\u017ea 192.168.0.0-192.168.5.0, oduzimaju znatno vi\u0161e RAM-a od 5 objekata mre\u017ee. Op\u0107enito se smatra dobrom praksom ukloniti neiskori\u0161tene objekte u SmartConsole, jer svaki put prilikom postavljanja politike ure\u0111aj i upravlja\u010dki poslu\u017eitelj tro\u0161e resurse i, \u0161to je najva\u017enije, vrijeme na verifikaciju i primjenu politike.<\/p>\n<h4>3.4. Kako je postavljena politika prevencije prijetnji? <\/h4>\n<p>\nPrije svega, Check Point preporu\u010duje izdvajanje IPS-a u poseban profil i stvaranje posebnih pravila za ovu blade. <\/p>\n<p>Na primjer, administrator smatra da je segment DMZ potrebno za\u0161tititi samo pomo\u0107u IPS-a. Stoga, kako ure\u0111aj ne bi tro\u0161io resurse na obradu paketa drugim blade, potrebno je stvoriti pravilo posebno za taj segment s profilom u kojem je uklju\u010den samo IPS.<\/p>\n<p>\u0160to se ti\u010de postavki profila, preporu\u010duje se da ga konfigurirate prema najboljim praksama u ovom <noindex><a rel=\"nofollow\" href=\"https:\/\/downloads.checkpoint.com\/dc\/download.htm?ID=54842\">dokumentu<\/a><\/noindex>(stranice 17-20).<\/p>\n<h4>3.5. Koliko signatura u IPS postavkama radi u na\u010dinu detekcije? <\/h4>\n<p>\nPreporu\u010duje se temeljito obraditi signaturen, tako da treba onemogu\u0107iti neiskori\u0161tene (na primjer, signatur na iskori\u0161tavanje proizvoda Adobe zahtijevaju mnogo ra\u010dunalnih resursa, i ako klijent nema takve proizvode, ima smisla onemogu\u0107iti te signatur). Zatim postaviti Prevent umjesto Detect gdje god je to mogu\u0107e, jer ure\u0111aj tro\u0161i resurse na obradu cijele veze u na\u010dinu Detect, a u na\u010dinu Prevent odmah odbacuje vezu i ne tro\u0161i resurse na punu obradu paketa.<\/p>\n<h4>3.6. Koje se datoteke obra\u0111uju blade-ovima za emulaciju prijetnji, ekstrakciju prijetnji, antivirus?<\/h4>\n<p>\nNema smisla emulirati i analizirati datoteke s ekstenzijama koje va\u0161i korisnici ne preuzimaju ili koje smatrate nepotrebnima u va\u0161oj mre\u017ei (na primjer, bat, exe datoteke se lako mogu blokirati pomo\u0107u Blade Content Awareness na razini vatrozida, stoga \u0107e resursi gatewaya biti manje tro\u0161eni). \u0160tovi\u0161e, u postavkama Emulacije prijetnji mo\u017eete birati Okru\u017eenje (operacijski sustav) za emulaciju prijetnji u sandboxu, a postavljanje Okru\u017eenja Windows 7 kada svi korisnici rade s 10. verzijom tako\u0111er nema smisla.<\/p>\n<h4>3.7. Jesu li pravila vatrozida i pravila razine aplikacije postavljena u skladu s najboljim praksama? <\/h4>\n<p>\nAko pravilo ima puno hitova (podudarnosti), preporu\u010duje se postaviti ga na vrh, dok se pravila s malim brojem hitova trebaju staviti na dno. Glavno je osigurati da se ne preklapaju i ne ometaju jedno drugo. Preporu\u010dena arhitektura politike vatrozida:<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/7e5efaffe87edcb0f3d8d600a7912e57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nObja\u0161njenja: <\/p>\n<p>Prva pravila \u2014 ovdje se stavljaju pravila s najve\u0107im brojem podudarnosti<br \/>\nPravilo \u0161uma \u2014 pravilo za odbacivanje parazitskog prometa, poput NetBIOS-a<br \/>\nPravilo skrivenosti \u2014 zabrana pristupa gatewayima i upraviteljima svima, osim onim izvorima koji su navedeni u pravilima autentifikacije za pravila gatewaya<br \/>\nClean-Up, Last i Drop pravila obi\u010dno se kombiniraju u jedno pravilo za zabranu svega \u0161to nije prethodno dopu\u0161teno<\/p>\n<p>Ovi najbolji postupci opisani su u <noindex><a rel=\"nofollow\" href=\"https:\/\/supportcenter.checkpoint.com\/supportcenter\/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk106597&amp;partition=General&amp;product=Security\">sk106597<\/a><\/noindex>.<\/p>\n<h4>3.8. Koje su postavke usluga koje su kreirali administratori? <\/h4>\n<p>\nNa primjer, kreira se neka TCP usluga na odre\u0111enoj portu, i ima smisla u naprednim postavkama usluge ukloniti oznaku \u201eMatch for Any\u201c. U tom slu\u010daju \u0107e ta usluga biti to\u010dno pod pravilom u kojem sudjeluje i ne\u0107e sudjelovati u pravilima gdje u koloni Usluge pi\u0161e Any.<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/762bb379039cb34158f72b8ed3c976f8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGovore\u0107i o uslugama, treba spomenuti da ponekad mo\u017ee biti potrebno fino podesiti vrijeme \u010dekanja. Ova postavka omogu\u0107it \u0107e bolje kori\u0161tenje resursa gatewaya, kako ne bi zadr\u017eavala TCP\/UDP sesije protokola koje ne trebaju dugo vrijeme \u010dekanja. Na primjer, na slici ispod, premjestio sam vrijeme \u010dekanja usluge domain-udp s 40 sekundi na 30 sekundi.<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/f189f5722acee4abd8b6acf8f231c828.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h4>3.9. Se koristi li SecureXL i koliki je postotak ubrzanja? <\/h4>\n<p>\nKvalitetu rada SecureXL mo\u017eete provjeriti osnovnim naredbama u ekspertnom na\u010dinu rada na gatewayu <b>fwaccel stat<\/b> i <b>fw accel stats -s<\/b>. Zatim treba istra\u017eiti koji se promet ubrzava, koje se predlo\u0161ke (templates) mo\u017ee jo\u0161 stvoriti. <\/p>\n<p>Po defaultu, Drop Templates nisu uklju\u010deni; njihovo uklju\u010divanje pozitivno \u0107e utjecati na rad SecureXL-a. Da biste to u\u010dinili, idite na postavke gateway-a i na karticu Optimizations:<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/f65a4bbab4c406a64c550c9b3e502fcf.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTako\u0111er, pri radu s klasterom, radi optimizacije CPU-a, mo\u017eete isklju\u010diti sinkronizaciju nekriti\u010dnih servisa, kao \u0161to su UDP DNS, ICMP i drugi. Da biste to u\u010dinili, trebate oti\u0107i na postavke servisa \u2192 Advanced \u2192 Synchronize connections of State Synchronization is enabled on the cluster.<\/p>\n<p><img decoding=\"async\" alt=\"Check Point: optimizacija CPU-a i RAM-a\" src=\"\/wp-content\/uploads\/2019\/10\/4595e8bc9dafcad1c9b3ba37f9903772.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSve Best Practice su opisane u <noindex><a rel=\"nofollow\" href=\"https:\/\/supportcenter.checkpoint.com\/supportcenter\/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk98348#Best%20practices%20-%20SecureXL\">sk98348<\/a><\/noindex>.<\/p>\n<h4>3.10. Kako se koristi CoreXl? <\/h4>\n<p>\nTehnologija CoreXL, koja omogu\u0107ava kori\u0161tenje vi\u0161e CPU-a za firewall instance (moduli vatrozida), jednozna\u010dno poma\u017ee optimizirati rad ure\u0111aja. Prvo, komanda <b>fw ctl affinity -l -a <\/b>pokazat \u0107e kori\u0161tene firewall instance i procesore dodijeljene potrebama SND (modula koji distribuira promet na vatrozidne entitete). Ako nisu uklju\u010deni svi procesori, mo\u017eete ih dodati komandom <b>cpconfig <\/b>na gatewayu.<br \/>\nTako\u0111er, dobra opcija je instalirati <noindex><a rel=\"nofollow\" href=\"https:\/\/supportcenter.checkpoint.com\/supportcenter\/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk80940\">hotfix <\/a><\/noindex>za uklju\u010divanje Multi-Queue. Multi-Queue rje\u0161ava problem kada se procesor sa SND koristi po visokom postotku, dok firewall instance na drugim procesorima miruju. Tada bi SND imao mogu\u0107nost stvaranja vi\u0161e redova za jednu NIC i postavljanje razli\u010ditih prioriteta za razli\u010diti promet na razini jezgre. Kao rezultat, jezgre CPU-a \u0107e se koristiti u\u010dinkovitije. Metodologije su tako\u0111er opisane u <noindex><a rel=\"nofollow\" href=\"https:\/\/supportcenter.checkpoint.com\/supportcenter\/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk98348#Best%20practices%20-%20SecureXL\">sk98348<\/a><\/noindex>.<\/p>\n<p>Na kraju, \u017eelio bih re\u0107i da ovo nije sve Best Practices za optimizaciju rada Check Point-a, ve\u0107 samo najpopularnije. Ako \u017eelite zatra\u017eiti reviziju va\u0161e sigurnosne politike ili rije\u0161iti problem vezan uz Check Point, slobodno se obratite na sales@tssolution.ru. <\/p>\n<p>Hvala na pa\u017enji!<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/472864\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u043a\u043e\u043b\u043b\u0435\u0433\u0438! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u043e\u0431\u0441\u0443\u0434\u0438\u0442\u044c \u043e\u0447\u0435\u043d\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 Check Point \u0442\u0435\u043c\u0443 \u00ab\u041e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f CPU \u0438 RAM\u00bb. \u041d\u0435\u0440\u0435\u0434\u043a\u0438 \u0441\u043b\u0443\u0447\u0430\u0438, \u043a\u043e\u0433\u0434\u0430 \u0448\u043b\u044e\u0437 \u0438\/\u0438\u043b\u0438 \u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044e\u0442 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u044d\u0442\u0438\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u0438 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0443\u0434\u0430 \u043e\u043d\u0438 \u201c\u0443\u0442\u0435\u043a\u0430\u044e\u0442\u201d, \u0438 \u043f\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0433\u0440\u0430\u043c\u043e\u0442\u043d\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445. 1. \u0410\u043d\u0430\u043b\u0438\u0437 \u0414\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39416,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39415","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u043a\u043e\u043b\u043b\u0435\u0433\u0438!\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Check Point: \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f CPU \u0438 RAM | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u043a\u043e\u043b\u043b\u0435\u0433\u0438!\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:32:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:32:08+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Check Point: optimizacija CPU i RAM | ProHoster","description":"Pozdrav svima!","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Check Point: \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f CPU \u0438 RAM | ProHoster","og:description":"\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u043a\u043e\u043b\u043b\u0435\u0433\u0438!","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:32:08+00:00","article:modified_time":"2019-10-31T19:32:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39415","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 01:55:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:50:24","updated":"2026-01-24 01:55:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/39415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=39415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/39415\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/39416"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=39415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=39415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=39415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}