7. NGFW for small businesses. Performance and general guidelines

1. NGFW solutions of the SMB family do not have the ability to hardware upgrade system components (CPU, RAM, HDD), depending on the model, there is support for SD cards, this allows you to expand the disk capacity, but not significantly.

2. The operation of network interfaces requires monitoring. There are not many monitoring tools in Gaia 80.20 Embedded, but you can always use a well-known command in the CLI via Expert mode

   # ifconfig

   

   Pay attention to the underlined lines, they will allow you to estimate the number of errors on the interface. It is highly recommended to check these parameters during the initial deployment of your NGFW, as well as periodically during operation.

3. For a full-fledged Gaia, there is a command:

   > show diag

   With its help it is possible to obtain information about the temperature of the hardware. Unfortunately, 80.20 Embedded does not have this option, we will indicate the most popular SNMP traps:

   Name	Description
   Interface disconnected	Disable an interface
   VLAN removed	Vlan removal
   High memory utilization	High RAM utilization
   Low disk space	Little HDD space
   High CPU utilization	High CPU utilization
   High CPU interrupts rate	High interrupt rate
   High connection rate	High flow of new connections
   High concurrent connections	High level of competitive sessions
   High Firewall throughput	High throughput Firewall
   High accepted packet rate	High packet reception
   Cluster member state changed	Cluster state change
   Connection with log server error	Lost Communication with Log-Server

4. Your gateway requires RAM control. For Gaia to work (Linux like OC) it is normal situationwhen the RAM consumption reaches 70-80% of use.

   The architecture of SMB solutions does not provide for the use of SWAP memory, in contrast to the older Check Point models. However, was seen in the Linux system files, which suggests that it is theoretically possible to change the SWAP parameter.

1. View SecureXL Templates

   # fwaccel stat

   

2. View boot by core

   # fw ctl multik stat

   

3. View the number of sessions (connections).

   # fw ctl pstat

   

4. * View cluster status

   # cphaprob stat

   

5. Classic Linux TOP command

1. System messages (contains less information than full Gaia)

   # tail -f / var / log / messages2

   

2. Blade error messages (quite useful file when troubleshooting)

   # tail -f /var/log/log/sfwd.elg

   

3. Viewing messages from the buffer at the system kernel level.

   # dmesg

   

• It is recommended to avoid the conditions ANY, ANY (Source, Destination) in the rules.

• In the case of specifying a custom URL resource, it will be more efficient to use regular expressions like: (^ | ..) checkpoint.com

• Avoid excessive use of rule-based logging and displaying block pages (UserCheck).

• Make sure the technology is working correctly “SecureXL”… Most of the traffic must go through accelerated / medium path… Also, do not forget to filter the rules by the most used (field Hits ).

It’s no secret that 70-80% of user traffic comes from HTTPS connections, so this requires resources from your gateway processor. In addition, HTTPS-Inspection is involved in the work of IPS, Antivirus, Antibot.

Since version 80.40 possibility work with HTTPS rules without Legacy Dashboard, here is some recommended rule order:

• Bypass for a group of addresses and networks (Destination).

• Bypass for a group of urls.

• Bypass for internal IP and networks with privileged access (Source).

• Inspect for required networks, users

• Bypass for everyone else.

* It is always best to manually select HTTPS or HTTPS Proxy services, not leaving Any. Log events according to Inspect rules.

The IPS blade can cause a policy installation error on your NGFW if too many signatures are used. According to article from Check Point, SMB device architecture is not designed to run the full recommended IPS configuration profile.

To fix or prevent the problem, follow these steps:

1. Clone the Optimized profile called “Optimized SMB” (or whatever you like).

2. Edit the profile, go to IPS → Pre R80.Settings and turn off Server Protections.

   

3. At your discretion, you can deactivate CVEs older than 2010, these vulnerabilities can rarely be found in small offices, but they affect performance. To disable some of them go to Profile -> IPS -> Additional Activation -> Protections to deactivate list