This is from an older posting -------------------------------------------------------------------- CheckPoint's knowledge base yields the following info.
"FireWall-1 supports multiple CPU platform, but because the FireWall-1 Kernel is a single threaded process, it does not take full advantage of multiple CPUs. In FireWall-1 NG, multiple CPU platforms are better utilised, because the FireWall-1 single executable is divided into different FireWall-1 Daemons which can each use a different CPU. Note that each daemon is itself a single threaded processes." The FP3 OPSEC release notes also make the following statements (not sure I quite follow the their significance though, maybe someone else could elaborate for us): "Multi-Threading - The multi-thread level of OPSEC APIs (Except ELA and CPMI) is "Reentrant". This means that: Multiple threads may use the same API concurrently. - Authentication and encryption methods are Thread-Safe (except opsec-ssl, opsec_ssl_clear and FWN1 methods". Extra Comments... For more comprehensive multi-cpu support you need (i.e. must purchase) the performance pack. Unfortunately this is only available on limited platforms. As of FP3 it can be utilised on SecurePlatform (Linux) and allegedly 64bit Solaris (at least that is what the FP3 release notes say). You can find out more info on the Performace Pack on Check Point's web http://www.checkpoint.com/products/accelerate/performancepack_overview.html <http://www.checkpoint.com/products/accelerate/performancepack_overview.html > ---------------------------------------------------------------------------- ---- We run Checkpoint on Sun E220R with single CPU with a similar kind of setup as yours. And the CPU usage is insignificant. Ofcourse, it also depends on your rulebase size too. More important is the memory. This might give you some idea about server sizing. http://www.checkpoint.com/products/protect/vpn-1_firewall-1_perfdetails.html I think dual-CPU servers are really not required for firewalls. Even higher-end PIXs that handle large loads are single CPU boxes. HTH, Siddhartha -----Original Message----- From: Covington, Chris [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 11, 2003 3:45 AM To: [EMAIL PROTECTED] Subject: Re: [FW-1] Checkpoint NG AI CPU Requirement Danny, I'm sure a dual processor 1Ghz+ (Intel) box with the Performance Pack would be more than suitable. We have approximately the same amount of users on an HP DL360 G2 (dual 1.26 GHz with 1.5GB RAM and 36.4GB 10K RAID drives) and its CPU utilization is fairly low. This is with Secureplatform FP3 Edition 2. Chris -----Original Message----- From: Sutantyo, Danny [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 10, 2003 11:40 AM To: [EMAIL PROTECTED] Subject: [FW-1] Checkpoint NG AI CPU Requirement Hi ... If I'd like to run NG AI w/ SmartDefense and VPN module in 1 server, what's the hardware requirement? I will need to have 6 ethernet interfaces in the server. We have about 1500 users, and we have about 15 servers on DMZ on one of the Checkpoint interface. I've checked Checkpoint web site but it does not say anything about it. Thanks Danny ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= "This email message is intended for the named recipient only. It may be privileged and/or confidential. If you are not the intended named recipient of this email then you should not copy it or use it for any purpose, nor disclose its contents to any other person which is strictly prohibited and unlawful" ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
