> Source: [sk98229](https://support.checkpoint.com/results/sk/sk98229) # sk98229 - Enabling QoS support for acceleration technologies (SecureXL and CoreXL) in R77.10, R77.20, and R77.30 | Property | Value | |----------|-------| | Solution ID | sk98229 | | Date Created | 2014-01-18 | | Last Modified | 2024-08-03 | | Technical Level | General | | OS | Gaia | ## Solution **Note** - This article applies only to R77.10, R77.20, and R77.30 versions. In versions **R80.10** and higher, you can enable the QoS Software Blade without additional configuration steps. **Table of Contents:** * Introduction * Enabling support for QoS with SecureXL and CoreXL on Security Gateway * Disabling support for QoS with SecureXL and CoreXL on Security Gateway * Related documentation Click Here to Show Entire Article Introduction {#Introduction} ---------------------------- * By default, the QoS Software Blade is not supported with SecureXL and CoreXL on a Security Gateway. Either QoS, or acceleration (SecureXL and/or CoreXL) can be used. * If only SecureXL is enabled on a Security Gateway (meaning, CoreXL is disabled), then enabling the QoS Software Blade on a Security Gateway and installing a QoS policy will disable SecureXL and enable QoS. * If CoreXL is enabled on Security Gateway, then installing a QoS policy will fail with this error: `QoS cannot be enabled at the same time as CoreXL. Either remove QoS from the list of Software Blades, or use `*cpconfig*` to disable CoreXL.` * In the versions **R77.10** , **R77.20** , and **R77.30** , the QoS support for SecureXL and CoreXL is included, but it is *disabled* by default. There is one exception: QoS Express policy is **not** supported with SecureXL and CoreXL (QoS policy should be set to "Traditional mode" (go to the '`File`' menu \> click '`New...`' \> select the checkbox '`QoS`' \> select the checkbox '`QoS policy (Recommended)`' \> install the Security Policy). Note: For *Small and Medium Business Appliances* running the Gaia Embedded OS, the QoS support for SecureXL and CoreXL is included starting from the firmware [R77.20.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110875), and it is *enabled* by default. * If you wish to enable the QoS Software Blade along with SecureXL and CoreXL on a Security Gateway R77.10 / R77.20 / R77.30, then follow the procedure below. Refer to [R77.10 Quality of Service Administration Guide](http://supportcontent.checkpoint.com/documentation_download?ID=28418) \> Chapter 1 'Introduction to QoS' \> Check Point's QoS Solution \> Enabling QoS Acceleration Support. * If you have a QoS policy created on a Security Management Server / Multi-Domain Security Management Server that runs the version R77 and lower, then these features are **not** supported when you enable the QoS Software Blade along with SecureXL and CoreXL on a Security Gateway R77.10 / R77.20 / R77.30: * Security Gateways running on IPSO OS * Security Gateways R77 and lower * SmartView Monitor - QoS views do not correctly show traffic accelerated by SecureXL * Multicast acceleration (multicast traffic will not be accelerated via SecureXL) * UserAuthority Server * Citrix printing rules For QoS limitations, refer to [sk97619 - R77.10 Known Limitations.](http://supportcontent.checkpoint.com/solutions?id=sk97619#QoS) Enabling support for QoS (FloodGate-1) with SecureXL and CoreXL on a Security Gateway {#Enabling support for QoS} ----------------------------------------------------------------------------------------------------------------- Show / Hide hotfix instructions **Note:** In a cluster environment, this procedure must be performed on all members of the cluster. 1. Connect to command line on the Security Gateway / each Cluster Member (over SSH, or console). 2. Log in to the Expert mode. 3. Enable the accelerated mode for FloodGate-1 (QoS) in Check Point Registry: **`[Expert@HostName]# cpprod_util CPPROD_SetValue FG1 FgWithAcceleration 1 1 1`** **Notes:** * When issuing the '`cpprod_util CPPROD_SetValue FG1 FgWithAcceleration 1 1 1`' command, it returns 0 (zero) on success. * This command sets the value of the attribute '`:FgWithAcceleration`' to '1' in the Check Point Registry file (`$CPDIR/registry/HKLM_registry.data`): Note: If this attribute does not exist in the Check Point Registry file, this command will also add it. ``` : (FG1 :CurrentVersion (6.0) : (6.0 :CurrentLabel (R77) :CurrentSP (4) :FGDIR ("/opt/CPsuite-R77/fg1") :PRODDIR ("/opt/CPsuite-R77/fg1") :AutoStart (1) :ProdActive (1) :IsConfigured (1) :FgWithAcceleration (1) : (SP4 :CurrentMSP (0) : (MSP0 :SilentUninstall ("rpm -e CPsuite-R77") ) ) ) ) ``` * If you do not add the required attribute '`:FgWithAcceleration (1)`' to Check Point Registry, you would receive the following error during a QoS policy installation: ``` QoS cannot be enabled at the same time as CoreXL. Either remove QoS from the list of Software Blades, or use cpconfig to disable CoreXL. ``` 4. Enable SecureXL in the '`cpconfig`' menu: **`[Expert@HostName]# cpconfig`** Select '`Enable Check Point SecureXL`'. **Note:** If you already have SecureXL enabled, then skip this step. 5. Enable and configure CoreXL in the '`cpconfig`' menu: **`[Expert@HostName]# cpconfig`** Select '`Check Point CoreXL`' - configure the desired number of firewall instances. **Note:** If you already have CoreXL enabled and configured, then skip this step. 6. Reboot the Security Gateway / each Cluster Member. In a cluster, this can cause a failover. 7. Connect with SmartDashboard to the Security Management Server / Domain Management Server. 8. Open the Security Gateway / Cluster object \> go to the '`General Properties`' pane \> go to the '`Network Security`' tab \> select the checkbox '`QoS`'. 9. Go to the '`Topology`' pane \> select each required interface \> click '`Edit...`' \> go to '`QoS`' tab \> configure the QoS limits \> click OK. 10. Install the Security Policy - make sure to select the '`QoS`' policy. 11. On the Security Gateway / each Cluster Member, check that SecureXL / CoreXL / QoS are enabled and working as expected. 1. Connect to command line on Security Gateway / each Cluster Member (over SSH, or console). 2. Log in to the Expert mode. 3. Check the state and performance of SecureXL / CoreXL / QoS by running these commands: * **SecureXL** **`[Expert@HostName]# fwaccel stat`** *Example output* : > > ``` > Accelerator Status : on > Accept Templates : enabled > Drop Templates : disabled > NAT Templates : disabled by user > ``` **`[Expert@HostName]# fwaccel stats`** *Example output* : > > ``` > Name Value Name Value > -------------------- --------------- -------------------- --------------- > > Accelerated Path > ------------------------------------------------------------------------------ > accel packets 443192 accel bytes 63122102 > conns created 53 conns deleted 23 > C total conns 30 C templates 2 > C TCP conns 27 C delayed TCP conns 20 > C non TCP conns 3 C delayed nonTCP con 5 > ......output is truncated for brevity...... > ``` **`[Expert@HostName]# fwaccel stats -s`** *Example output* : > > ``` > Accelerated conns/Total conns : 40/44 (90%) > Accelerated pkts/Total pkts : 443192/701322 (63%) > F2Fed pkts/Total pkts : 258130/701322 (36%) > PXL pkts/Total pkts : 0/701322 (0%) > QXL pkts/Total pkts : 211103/701322 (30%) > ``` * **CoreXL** **`[Expert@HostName]# fw ctl multik stat`** *Example output* : > > ``` > ID | Active | CPU | Connections | Peak > ---------------------------------------------- > 0 | Yes | 3 | 14 | 24 > 1 | Yes | 2 | 20 | 44 > 2 | Yes | 1 | 15 | 24 > ``` * **QoS** **`[Expert@HostName]# fgate stat`** *Example output* : > > ``` > Product: FloodGate-1 > Version: R77.10 > Kernel Build: 66 > Policy Name: Any_Any_Accept_noLogs > Install time: Tue Jan 21 18:48:12 2014 > Interfaces Num: 1 > > > Interface table > ---------------------------------------------------------------- > |Name|Dir|Limit (Bps)|Avg Rate (Bps)|Conns|Pend pkts|Pend bytes| > ---------------------------------------------------------------- > |eth0|in | 125000000| 13530| 37| 0| 0| > |eth0|out| 125000000| 25| 31| 0| 0| > ---------------------------------------------------------------- > ``` Disabling support for QoS (FloodGate-1) with SecureXL and CoreXL on a Security Gateway {#Disabling support for QoS} ------------------------------------------------------------------------------------------------------------------- Show / Hide hotfix instructions **Note:** In cluster environment, this procedure must be performed on all members of the cluster. 1. Connect to command line on the Security Gateway / each Cluster Member (over SSH, or console). 2. Log in to the Expert mode. 3. Disable the accelerated mode for FloodGate-1 (QoS) in Check Point Registry file: **`[Expert@HostName]# cpprod_util CPPROD_SetValue FG1 FgWithAcceleration 1 0 1`** **Notes:** * When issuing the '`cpprod_util CPPROD_SetValue FG1 FgWithAcceleration 1 0 1`' command, it returns 0 (zero) on success. * This command sets the value of the attribute '`:FgWithAcceleration`' to '0' in the Check Point Registry file (`$CPDIR/registry/HKLM_registry.data`): ``` : (FG1 :CurrentVersion (6.0) : (6.0 :CurrentLabel (R77) :CurrentSP (4) :FGDIR ("/opt/CPsuite-R77/fg1") :PRODDIR ("/opt/CPsuite-R77/fg1") :AutoStart (1) :ProdActive (1) :IsConfigured (1) :FgWithAcceleration (0) : (SP4 :CurrentMSP (0) : (MSP0 :SilentUninstall ("rpm -e CPsuite-R77") ) ) ) ) ``` 4. If needed, disable SecureXL in the '`cpconfig`' menu: **`[Expert@HostName]# cpconfig`** Select '`Disable Check Point SecureXL`'. 5. If needed, disable CoreXL in the '`cpconfig`' menu: **`[Expert@HostName]# cpconfig`** Select '`Check Point CoreXL`' - select '`Disable Check Point CoreXL`'. 6. Reboot the Security Gateway / each Cluster Member. In a cluster, this can cause a failover. 7. In SmartDashboard, open the Security Gateway / Cluster object \> go to the '`General Properties`' pane \> go to the '`Network Security`' tab \> **clear** the checkbox '`QoS`' \> click OK. 8. Install the Security Policy - make sure that the '`QoS`' policy is unchecked. 9. On the Security Gateway / each Cluster Member, check the state of SecureXL / CoreXL / QoS. 1. Connect to command line on Security Gateway / each Cluster Member (over SSH, or console). 2. Log in to the Expert mode. 3. Check the state of SecureXL / CoreXL / QoS by running these commands: * **SecureXL** **`[Expert@HostName]# fwaccel stat`** *Output if QoS blade was disabled in SmartDashboard* : > > ``` > Accelerator Status : off > > Accelerator Features Mask : not available > Cryptography Features Mask : not available > ``` > > *Output if QoS blade is still enabled in SmartDashboard* : > > ``` > SecureXL acceleration cannot be started while FloodGate-1 is running in non accelerated mode Accelerator Features Mask : not available Cryptography Features Mask : not available > ``` * **CoreXL** **`[Expert@HostName]# fw ctl multik stat`** *Output* : > > ``` > fw: CoreXL is disabled > ``` * **QoS** **`[Expert@HostName]# fgate stat`** *Output if QoS blade was disabled in SmartDashboard* : > > ``` > FloodGate-1 service is not started, cannot obtain status (localhost). > ``` Related documentation {#Related documentation} ---------------------------------------------- * Quality of Service Administration Guide ([R77.10](http://supportcontent.checkpoint.com/documentation_download?ID=28418)) * Performance Tuning Administration Guide ([R77.X](http://supportcontent.checkpoint.com/documentation_download?id=24808)) * [sk97619 - R77.10 Known Limitations](http://supportcontent.checkpoint.com/solutions?id=sk97619) * [sk101209 - R77.20 Known Limitations](http://supportcontent.checkpoint.com/solutions?id=sk101209) * [sk104860 - R77.30 Known Limitations](http://supportcontent.checkpoint.com/solutions?id=sk104860) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content