|General Performance Considerations |
Followings are general recommendations that can significantly improve the VPN-1 performance:
Make sure SecureXL mechanism is enabled. This will optimize the flow of certain types of packets. For more details, refer to KB1354215.
For IPSO 3.8 and above: This can be enabled with cpconfig option to 'Enable Check Point SecureXL'
For IPSO-3.7 and IPSO-3.7.1, Make sure FLOWS mechanism is enabled
On Nokia console run:
nokia[admin]# ipsofwd list
Note- if switch_mode is not flowpath, then set the switch_mode to FLOWS as below:
Expanding the VPN-1 concurrent connections limits - tuning the table space, hash and memory allocations
In NG versions of VPN-1 product, the concurrent connections limits can be tuned per enforcement module via the Check Point GUI Client interface. In Check Point Gateway Properties > Capacity Optimization, set the supported number of concurrent connections to a maximum you foresee for you VPN-1 installation (allow for a sufficient margin). Also specify the size of the connections hash table as well as the default and maximal enforcement module memory pool sizes. Again, allow for sufficient margins.
For large connection table size, Nokia recommends to set it manually, using the following table:
Table 1 Disk-Based IP Security Platforms
Table 2 Flash-Based IP security Platforms:
Note: (*) 512MB PCMCIA card required on the IP265 in order to achieve the number (39,000) above.
In case you need to customize these settings, use the following data to determine the exact value as per your need:
The memory required depends on the kind of connections used:
Assuming the worst case scenario (NAT):
For 100000 connections it is:
Keep in mind that FireWall-1 doesn't actually release the memory used for a TCP connection until about a minute after the connection ends. You should take this into account when planning how many connections you expect to handle.
If you are not using SecureXL and instead using FLOWS- along with adjusting the VPN-1 connections table size, expand the FLOWS tables:
By default, Nokia FLOWS tables canhold up to 131,072 connections without NAT or 65536 NAT-ed connections. To adjust the FLOWS table size do the following (in /var/etc/rc.local):
run several instances of security servers, in case of HTTP security server, in $FWDIR/conf/fwauthd.conf:
Along with the change above, increase the per-system open files limit to support 4 HTTP security servers:
You should also increase the Maximum Segment Size in Nokia IPSO. In IPSO 3.7 and later, the MSS setting can be configured in the Advanced System Tuning page of the System Configuration section of Nokia Network Voyager. The default MSS size is now 1024. Change this to 1460.