Checkpoint performance... is this all right ?

Maybe for a Checkpoint! But that is Terrible.

Take a look at these numbers.

I haven't used Checkpoint or Stonebeat for a long time but you may want to check out

Eric McWilliams sends

Dogbert wrote:

Msr. Dogbert,

No, this isn't typical behaviour. I've run on the same hardware myself with no such problems in the past. There's a lot of details lacking, but consider some of the following:

-Do you have many or most of the Solaris services running? (e.g. much of rc3.d starting up? and/or the inetd.conf services?) - Do a 'top' and see which processes are taking the lion's share of the processor. You can get top (if you don't already have it) at sunfreeware.com

Do you have a lot of the 'SmartDefense' protections enabled? Open your SmartConsole (the GUI) and click the SmartDefense tab. Look to see what is, and isn't checked. If many of those are checked, you can tune some of this down, particularly 'TCP Fingerprint Scrambling' and 'Header spoofing,' if applicable.

-There's a few kernel tweaks you can do, but they tend to have more to do with memory use...

I think I would reload it and make it a syslogger and call my local Sidewinder G2 rep and get a firewall that you don't have to worry about getting Patches for the OS then Patches for the Firewall.

Just my .02 cents

Well, running Check Point on a Sun box was a 'choice,' as Check Point is OEM'ed on several 'appliance' solutions (e.g. Crossbeam, Nokia) that don't require separate patch trains for OS and Firewall application, and if one runs Check Point on 'SPLAT' (short for SecurePlatform) it too is patched as an appliance, rather than a 'separate' OS.

I myself would prefer a firewall with a dominant marketshare (as there's likely to be a reason for that dominance) rather than a niche player with limited scalability, and which is essentially packaged

Just my nickel

Well for that matter Windows XP should be free to. But you don't see Bill Gates handing it out.

And what would you call a limited scalability?

Well someone had to rewrite the Code for the Secure OS.

Did someone write the code of Check Point? Yea I think they did, and did a piss poor job at it aswell.

Common Criteria EAL Sidewinder 29 4+ Medium Robust Checkpoint 22 4

And you tell me what checkpoint can do that the sidewinder can't?

First off, Check Point is EAL4 'augmented' Medium Robustness (aka 'PP') as well, albeit the latest version is 'in-process' (which is understandable since the process can take a bit and they just released this mid 05), take another look at NIAP's site. Not that certifications from a government agency should mean something to a user in and of themselves.

As for your question, I think it misses the point entirely. There's probably a reason sidewinders aren't trusted as pervasively across the industry, because they're niche, they're an 'also-ran', and and they haven't done anything innovative as a company. check point brought stateful inspection to market(!!), and they were first to market with 'deep inspection'. That's the point, they innovate, and others play 'catch-up' and merely drop the price because it took no R&D on their part. Security isn't a product, much less a cloned one, it's a process and requires people to *think* about security and develop countermeasures, not say 'me too'.

Joshua Reed wrote:

Mr. Reed,

I've checked my firewall configurations and the smartdefense settings are stripped to the core. There are also few services running on the box so it doesn't seem a problem related to the number of active processes.

I've tested the box with a simple http transfer of a big file from an http server. Actually HTTP connections are enabled at the 1st rule and the firewall has less than 10 active sessions. Immediately after starting the transfer the CPU load goes up to 100% while the transfer settle for 8 mbytes/s transfer rate. If I try to start other transfer as well I get only up to 9 mbytes/s of aggregate bandwith. I've also checked the NIC status and they are all cofigured at 100 mbit Full Duplex.

Here is the result from Stonebeat Fullcluster command line end VMSTAT.

SBFC>

CLUSTER STATUS Node Load Status

------------------ 1 96% online 2 -- standby

vmstat 1 procs memory page disk faults cpu r b w swap free re mf pi po fr de sr m1 m1 m1 m2 in sy cs us sy id 0 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 354 515 129 0 0 100 0 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 334 471 104 0 0 100 0 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 336 386 117 0 0 100 0 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 333 420 106 0 0 100 0 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 341 503 118 0 0 100 0 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 343 370 120 0 0 100 0 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 406 497 100 0 33 67 2 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 669 72 30 0 99 1 9 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 409 15 8 0 96 4 8 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 429 38 14 0 93 7 13 0 0 1222760 233440 0 0 0 0 0 0 0 0 0 0 0 580 136 76 2 94 4 9 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 391 14 9 0 100 0 6 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 563 64 35 0 97 3 0 1 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 622 72 57 0 98 2 2 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 646 111 82 1 93 6 0 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 777 113 70 0 96 4 2 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 565 76 25 0 100 0 1 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 606 86 53 0 97 3 2 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 709 59 35 0 96 4 0 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 689 112 54 0 95 5 3 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 600 55 20 0 99 1 3 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 541 69 45 0 96 4 0 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 641 110 77 0 88 12 1 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 604 69 46 0 93 7 2 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 405 352 95 0 28 72 0 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 335 451 101 0 0 100 0 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 334 337 106 0 0 100 0 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 343 479 126 0 0 100 0 0 0 1222752 233432 0 0 0 0 0 0 0 0 0 0 0 331 486 103 0 0 100

If you want I can give you plenty of other iformations from this box.

p.s.: I'm trying to download TOP from sunfreeware but it seems to be down today.

many thanks, Riccardo Fontana

Thanks,

I will give it a try. I've also found this paper on checkpoint site:

Rick

Gosh, that is odd, the good news is that it's probably not smartdefense!...you didn't configure http with a 'resource' did you? (e.g. in the services field in the rulebase it just says http instead of 'http->somename')

I suspect a couple things here. One is that there could be a hotfix available for this symptomology, check out secureknowledge and do a search. Are you on R55 (or 'W') or R54?

The other thing is that, prior to NGX (R60) much of the http inspection was done by the http security server (and thus was user mode), instead of in the kernel. An upgrade might fix this if there's no hotfix (though i suspect there is), but you'd have to consider that it would most likely require a solaris upgrade :(

Let me know what happens with 'top' and we'll take it to the next step with testing some solaris kernel variables.

"I will give it a try. I've also found this paper on checkpoint site:

Rick "

Be sure not to change that autoup setting friend! You're running stonebeat, and the autoup kernel var isn't support in situations where you're using a 3rd party HA.

Also, have you tried breaking the HA pair and renaming stonebeat's startup script so it doesn't start, and just try running a single firewall with no stonebeat, to see if it's the CP itself, or the stonebeat HA?

I have to ask, because I've had such bad experiences with Stonebeat in the past on solaris.

Ok... done a rapid test with TOP, here is the result:

BEFORE LOADING THE FIREWALL: last pid: 1984; load averages: 0.75, 0.68, 0.30 11:17:14

PID USERNAME LWP PRI NICE SIZE RES STATE TIME CPU COMMAND 358 root 5 59 0 29M 27M sleep 2:25 0.04% sbfcd 1984 root 1 59 0 2592K 1648K cpu 0:00 0.02% top 498 root 5 59 0 30M 23M sleep 0:27 0.00% vpn 433 root 8 59 0 32M 19M sleep 0:33 0.00% cpd 499 root 8 59 0 26M 20M sleep 0:09 0.00% fwssd 488 root 5 59 0 43M 25M sleep 0:08 0.00% fw 576 root 5 59 0 24M 18M sleep 0:06 0.00% fwssd 503 root 4 59 0 25M 19M sleep 0:03 0.00% dtps 496 root 5 32 0 25M 19M sleep 0:02 0.00% fwssd 497 root 5 59 0 24M 17M sleep 0:02 0.00% fwssd 372 root 1 18 0 3408K 1560K sleep 0:01 0.00% sshd 485 root 5 59 0 9664K 7264K sleep 0:01 0.00% cphamcset 567 root 1 38 0 1872K 1288K sleep 0:00 0.00% ttymon 1862 root 1 40 0 1088K 920K sleep 0:00 0.00% sh 317 root 1 46 0 1976K 1288K sleep 0:00 0.00% cron

DURING THE HIGH LOAD TEST: last pid: 1984; load averages: 1.09, 0.75, 0.34 11:17:42

PID USERNAME LWP PRI NICE SIZE RES STATE TIME CPU COMMAND 1984 root 1 59 0 2592K 1648K cpu 0:00 0.11% top 358 root 5 59 0 29M 27M sleep 2:25 0.05% sbfcd 433 root 8 59 0 32M 19M sleep 0:33 0.00% cpd 498 root 5 59 0 30M 23M sleep 0:27 0.00% vpn 499 root 8 59 0 26M 20M sleep 0:09 0.00% fwssd 488 root 5 59 0 43M 25M sleep 0:08 0.00% fw 576 root 5 59 0 24M 18M run 0:06 0.00% fwssd 503 root 4 59 0 25M 19M sleep 0:03 0.00% dtps 497 root 5 59 0 24M 17M run 0:02 0.00% fwssd 496 root 5 32 0 25M 19M sleep 0:02 0.00% fwssd 485 root 5 59 0 9664K 7264K run 0:01 0.00% cphamcset 372 root 1 18 0 3408K 1560K sleep 0:01 0.00% sshd 567 root 1 38 0 1872K 1288K sleep 0:00 0.00% ttymon 1862 root 1 40 0 1088K 920K sleep 0:00 0.00% sh 317 root 1 46 0 1976K 1288K sleep 0:00 0.00% cron

It seems that 100% of the cpu load is taken by kernel process. Now I'm thinking that maybe there is some problem with the QFE drivers installations.