18301250
Descrição
FlashCards por Usuário eliminado, atualizado more than 1 year ago
Mais
|
Criado por brian gustavo triviño taborda
mais de 7 anos atrás
|
|
|
|
Copiado por brian gustavo triviño taborda
mais de 7 anos atrás
|
|
| Questão | Responda |
| What features are supported by Performance Pack (SecureXL)? | Supported Features: security functions that are enhanced by Performance Pack • Access control • Encryption • NAT • Accounting and logging • Connection/session rate • General security checks • IPS features • CIFS resources • ClusterXL High Availability and Load Sharing • TCP Sequence Verification • Dynamic VPN • Anti-Spoofing verifications • Passive streaming • Drop rate |
| TCP end timeout? | TCP end timeout determines the amount of time a TCP connection will stay in the Firewall connection table after a TCP session has ended. |
| UDP virtual session timeout? | UDP virtual session timeout determines the amount of time a UDP connection will stay in the Firewall connection table after the last UDP packet was seen by the gateway. |
| What does Security Gateway TCP state check avoid? | The Security Gateway TCP state check detects invalid TCP sequences, and drops the packets |
| Is Performance Pack automatically installed? | Performance Pack is automatically installed when you run the First Time Wizard. |
| What is SecureXL? | Acceleration solution: When SecureXL is enabled on a Security Gateway, some CPU intensive operations are processed by virtualized software instead of the Firewall kernel. The Firewall can inspect and process connections more efficiently and accelerate throughput and connection rates. |
| What are the SecureXL flows? | SecureXL traffic flows: • Slow path - Packets and connections that are inspected by the Firewall and are not processed by SecureXL. • Accelerated path - Packets and connections that are offloaded to SecureXL and are not processed by the Firewall. • Medium path Packets that require deeper inspection cannot use the accelerated path. It is not necessary for the Firewall to inspect these packets, they can be offloaded and do not use the slow path. Example: IPS PSL (Passive Streaming Library) |
| What is the IPS PSL (Passive Streaming Library) used for in SecureXL? | packets that are inspected by IPS cannot use the accelerated path and can be offloaded to the IPS PSL (Passive Streaming Library). SecureXL processes these packets more quickly than packets on the slow path. |
| What happens to SecureXL when there is a match in a rule where Blades other than Blade VPN are enabled? | Performance Pack fully accelerates packets when none of the Software Blades (except for VPN) is enabled. |
| What is the purpose of SecureXL? | minimize the connections that are processed on the slow path. |
| Connections are identified by the 5 tuple attributes, What are they? | source address destination address source port destination port protocol |
| What happens to a packet when the source address, destination address, source port, destination port and protocol match a connection with these 5 attributes and SecureXL is enabled? | When the packets in a connection match all the 5 tuple attributes, the traffic flow can be processed on the accelerated path. |
| The first packet of a TCP connection is evaluated on which SecureXL's flow? | TCP connection (first packet) The first packets of a new TCP connection require more processing and they are processed on the slow path. The other packets of the connection can be processed on the accelerated path |
| How does SecureXL accelerate the rate of new connections? | SecureXL improves the rate of new connections (connections per second). To accelerate the rate of new connections, connections that do not match a specified 5 tuple are still processed by SecureXL. When a connection is processed on the accelerated path, SecureXL creates a template of that connection that does not include the source port tuple, the source port is masked and only the other 4 tuple attributes require a match. A new connection that matches the other 4 tuples is processed on the accelerated path because it matches the template |
| What is a Connection Templates (SecureXL)? | Connection templates are generated from active connections according to the policy rules. The connection template feature accelerates the speed at which a connection is established by matching a new connection to a set of attributes. When a new connection matches the template, connections are established without performing a rule match and therefore are accelerated |
| What are the restrictions for Connection Templates? | Connection Templates will be created only for plain UDP or TCP connections Global restrictions: If the Rule Base contains a rule regarding one of these components, the Connection Templates will be disabled for connections matching this rule • SYN Defender — Connection Templates for TCP connections will not be created • VPN connections • Complex connections (H323, FTP, SQL) • NetQuotas • ISN Spoofing • Security Server connections. • Services of type "other" with a match expression. Exceptions: traceroute, dhcp-request and dhcp-reply • User/Client/Session Authentication actions. • Services of type RPC/DCERPC/DCOM. |
| What is the relationship between Delayed Synchronization (Delayed Notification) and SecureXL? | Delayed Synchronization is performed only for connections matching a connection template |
| What happens if a service with Delayed Notification is applied to a rule with Track option "log"? | Delayed synchronization is disabled if the log or account are enabled |
| In which Cluster solutions is SecureXL NAT templates supported? | - High Availability - VRRP - load Sharing modes |
| What is CoreXL? | CoreXL is a performance-enhancing technology for Security Gateways on multi-core processing platforms. CoreXL enhances Security Gateway performance by enabling the processing cores to concurrently perform multiple tasks. The increase in performance is achieved without requiring any changes to management or to network topology. CoreXL joins ClusterXL Load Sharing and SecureXL as part of Check Point's fully complementary family of traffic acceleration technologies |
| What is the goal of creating multiple instances of the firewall kernel and assigning each instance a processing kernel? | With CoreXL the Firewall kernel is replicated multiple times, each replicated instance runs on one processing core. These instances handle traffic concurrently and each instance is a complete Firewall kernel that inspects traffic. All Firewall instances in the Security Gateway process traffic through the same interfaces and apply the same gateway security policy |
| What is the default NIC affinity mode when performance pack is enabled? | The default affinity setting for all interfaces is automatic when Performance Pack is installed. Traffic from all interfaces is directed to the core running the Secure Network Distributor (SND). |
| What is the relationship in CoreXL between the number of IPv4 and IPv6 instances? | The number of IPv4 instances range from a minimum of two to a number equal to the maximum number of cores on the gateway. By default, the number of IPv6 firewall instances is set to two, to number equal to the number of IPv4 instances. The number of IPv6 instances cannot exceed the number of IPv4 instances |
| What is the maximum number of IPv4 and IPv6 instances in CoreXL? | 40 |
| Should the IPv6 kernel instances run on a separate processing core from the IPv4 instance? | For each firewall kernel instance that works with IPv4 traffic, there is a corresponding firewall kernel instance that also works with IPv6 traffic. Both instances run on the same core. |
| What is SDN and what is it part of? | The SND is responsible for: • Processing incoming traffic from the network interfaces, also known as interface's affinity. Traffic entering network interface cards (NICs) is directed to a processing core running the SND. • Securely accelerating authorized packets (if Performance Pack is running). Performance Pack fully accelerates packets when none of the Software Blades (except for VPN) is enabled. • Distributing non-accelerated packets among kernel instances. SDN is part of SecureXL and CoreXL |
| If URL Filtering Blade is enabled, does SecureXL acceleration continue to work for packages that require inspection? | Performance Pack fully accelerates packets when none of the Software Blades (except for VPN) is enabled. |
| How do you assign more processing cores to the SDN? | Allocate proccesing cores to the SND by setting interface affinities to the cores. Affinity causes the interface's traffic to be directed to that core and the SND to run on that core |
| What is affinity? | The assignment of a specified process, Firewall instance, VSX Virtual System, interface or IRQ with one or more CPU cores. |
| What demon is in charge of logging and should be taken into account to establish a process affinity in case of heavy logging? | fwd daemon performs the logging. Allocating a Core for this process will reduce the number of cores available for kernel instances. If interface affinities are set to Automatic, any core that is not running a kernel instance can be used for the fwd daemon, and interface traffic will be automatically diverted to other cores. |
| If in the fwaffinity.conf file the affinity of a process or instance for a processing kernel is set, this core will still be available to account for the affinity of an interface when using the automatic mode? | No, the core is unavailability for interface's affinity. In both manual and authomatic mode, any processing core running a kernel instance, or defined as the affinity for another process, is considered unavailable and will not be set as the affinity for any interface. To ensure CoreXL's efficiency, all interface traffic must be directed to cores not running kernel instances. |
| What does automatic affinity mean when Performance Pack is installed? | Automatic affinity means that if Performance Pack is running, the affinity for each interface is automatically reset every 60 seconds, and balanced between available cores. Interface affinities are automatically distributed among cores that are not running kernel instances and that are not set as the affinity for any other process. |
| Can two interfaces sharing the same bus and therefore IRQ be assigned to two different processing cores? | Interfaces that share an IRQ cannot have different cores as their affinities, including when one interface is included in the default affinity setting. |
| Just add more physical processing cores to the Hardware to automatically create instances of the firewall kernel? | Increasing the number of processing cores on the hardware platform does not automatically increase the number of kernel instances. If the number of kernel instances is not increased, CoreXL does not utilize some of the processing cores |
| How should a change in the number of kernel instances in clustered environments be addressed? | In a clustered deployment, changing the number of kernel instances should be treated as a version upgrade. |
| What is Multi-Queue? | By default, the traffic for each interface is processed on one CPU core. If there are more CPU cores than interfaces, not all of the CPU cores are used to process traffic. Multi-Queue is an acceleration feature that lets you assign more than one packet queue and CPU to an interface. |
Quer criar seus próprios Flashcards gratuitos com GoConqr? Saiba mais.