Checkpoint CPAC-Falcon-10G-B Instruction Manual

11 May 2019
Administration Guide
FALCON ACCELERATION
CARDS
R80.20
Classification: [Protected]

CHAPT E R 1
2019 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and
distributed under licensing restricting their use, copying, distribution, and decompilation. No part
of this product or related documentation may be reproduced in any form or by any means without
prior written authorization of Check Point. While every precaution has been taken in the
preparation of this book, Check Point assumes no responsibility for errors or omissions. This
publication and features described herein are subject to change without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in
subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and FAR 52.227-19.
TRADEMARKS:
Refer to the Copyright page https://www.checkpoint.com/copyright/ for a list of our trademarks.
Refer to the Third Party copyright notices
https://www.checkpoint.com/about-us/third-party-trademarks-and-copyrights/ for a list of
relevant copyrights and third-party licenses.

Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date
with the latest functional improvements, stability fixes, security enhancements and
protection against new and evolving attacks.
Certifications
For third party independent certification of Check Point products, see the Check Point
Certifications page
https://www.checkpoint.com/products-solutions/certified-check-point-solutions/.
Check Point R80.20 for Falcon Acceleration Cards
For more about this release, see sk116242
http://supportcontent.checkpoint.com/solutions?id=sk116242.
Latest Version of this Document
Open the latest version of this document in a Web browser
https://sc1.checkpoint.com/documents/Falcon/EN/CP_R80.20_FalconAccelerationCar
ds_AdminGuide/html_frameset.htm.
Download the latest version of this document in PDF format
http://downloads.checkpoint.com/dc/download.htm?ID=80006.
Feedback
Check Point is engaged in a continuous effort to improve its documentation.
Please help us by sending your comments
mailto:[e-mail]?subject=Feedback on Falcon
Acceleration Cards R80.20 Administration Guide.
Revision History
Date Description
11 May 2019 First release of this document

Contents
Important Information...................................................................................................3
Introduction...................................................................................................................5
Supported Falcon Acceleration Cards and Security Appliances ...................................5
Falcon Acceleration Cards ............................................................................................8
CPAC-Falcon-10G-B .................................................................................................9
CPAC-Falcon-40G-B ............................................................................................... 10
Initial Configuration ................................................................................................ 11
Configuring the Link Speed on the Falcon-10G Ports .................................................12
Breakout Mode for the Falcon-40G Card ....................................................................15
Introduction to the Breakout Mode .........................................................................15
Configuring the Breakout Mode ..............................................................................18
Configuration in Gaia Portal ..........................................................................................19
Configuration in Gaia Clish ............................................................................................21
Configuration in Expert Mode ........................................................................................25
Limitations in the Breakout Mode ...........................................................................28
Monitoring Falcon Acceleration Cards in Gaia Portal .................................................29
Viewing the Appliances with Installed Cards ..........................................................29
Viewing the Network Interfaces on the Installed Cards.......................................... 30
Viewing the Hardware Sensors on the Installed Cards...........................................32
Monitoring Falcon Acceleration Cards in Gaia Clish ...................................................33
Viewing the Network Interface Type ....................................................................... 33
Viewing the Hardware Information on the Appliance..............................................34
Viewing the Hardware Sensors on the Installed Cards...........................................36
Monitoring Falcon Acceleration Cards in the Expert Mode ......................................... 38
Viewing the Network Interface Type ....................................................................... 38
Viewing the Hardware Information on the Appliance..............................................39
Viewing the Hardware Sensors on the Installed Cards...........................................41
Monitoring Falcon Acceleration Cards over SNMP ..................................................... 42
List of SNMP OIDs for Throughput ..........................................................................42
List of SNMP OIDs for Notifications......................................................................... 43
List of SNMP OIDs for Drops ...................................................................................43
List of SNMP OIDs for Interfaces............................................................................. 45
List of SNMP OIDs for Memory Utilization...............................................................46
List of SNMP OIDs for CPU Utilization..................................................................... 47
List of SNMP OIDs for General Information ............................................................48
Additional Information about Falcon Acceleration Cards ........................................... 49
The 'fwaccel stat' Command ...................................................................................49
The 'cpview' Command............................................................................................50
The 'adp_slots' and 'adp_ifs' Files .......................................................................... 52
Troubleshooting.......................................................................................................... 53
General Guidelines.................................................................................................. 53
Log Files.................................................................................................................. 53
Viewing the Performance Statistics ........................................................................ 54
Automatically Saving Messages from the Falcon Acceleration Cards ....................58

Introduction
Falcon Acceleration Cards Administration Guide R80.20 | 5
Introduction
The Check Point Falcon Acceleration Cards provide a high performance, low-latency, flexible and
scalable solution for Check Point 5900, 6800, 15000, and 23000 appliances.
Falcon Acceleration Card is a dedicated network I/O card solution with an integrated Network
Processor, which supports multiple connectivity options at 10 GbE (CPAC-Falcon-10G-B) and 40
GbE (CPAC-Falcon-40G-B).
The Check Point Falcon Acceleration Cards provide:
•For HTTPS Inspection acceleration - increase in the throughput by utilizing the dedicated
hardware engines on the acceleration cards.
•For Threat Prevention - increase in the throughput by implementing Deep Inspection in the
acceleration cards hardware. This applies to Threat Prevention with SandBlast Zero Day
protections and to NGFW.
•For Firewall-only acceleration - increase in the throughput for Firewall-only traffic, low traffic
latency, session rate improvement.
•VSX and QoS support.
Supported Falcon Acceleration Cards
and Security Appliances
Falcon Acceleration Cards available for Security Appliances:
Orderable SKU
Abbreviated Name
Acceleration Module Description
CPAC-Falcon-10G-B Falcon-10G Acceleration Module with 4 x 10 GbE Fiber
Ports
CPAC-Falcon-40G-B Falcon-40G Acceleration Module with 2 x 40 GbE Fiber
Ports
Supported Security Appliances for each Falcon Acceleration Card:
Acceleration Module
Supported Security Appliance Models
Falcon-10G
5900
6800
15400, 15600
23500, 23800, 23900
Falcon-40G
5900
6800
15400, 15600
23500, 23800, 23900

Supported Falcon Acceleration Cards and Security Appliances
Falcon Acceleration Cards Administration Guide R80.20 | 6
Supported combinations and number of Falcon Acceleration Cards in Security
Appliances:
Security Appliance Model
Falcon-10G
Falcon-40G
Maximal Number of Cards
5900
6800 Yes Yes 2
15400, 15600 Yes Yes 3
23500, 23800, 23900 Yes Yes 5
Note -It is supported to install Falcon-10G and Falcon-40G acceleration cards in the same
Security Appliance.
Supported transceivers for each of the acceleration cards:
Acceleration Module
Supported Transceivers
Falcon-10G •CPAC-TR-10SR-B (also supports 1 GbE)
•CPAC-TR-10LR-B (also supports 1 GbE)
•
CPAC-TR-1T-B
Falcon-40G •CPAC-TR-40SR-QSFP-300m (supports the breakout mode
(on page 15))
For configuration details, see the
Falcon Acceleration Cards
Administration Guide
https://sc1.checkpoint.com/documents/Falcon/EN/CP_R80.
20_FalconAccelerationCards_AdminGuide/html_frameset.ht
m.
•CPAC-TR-40LR-QSFP-10K
•CPAC-TR-40SR-QSFP-BiDi
Supported DAC cables:
•Check Point DAC cables (CPAC-DAC-10G-... and CPAC-DAC-40G-...) are supported only for
connection to Check Point Maestro Hyperscale Orchestrators.
•Check Point DAC breakout cables 40G to 4x10G (CPAC-DAC-40/10G-...) are
not supported.

Supported Falcon Acceleration Cards and Security Appliances
Falcon Acceleration Cards Administration Guide R80.20 | 7
Additional interfaces the Gaia on the appliance shows:
Acceleration
Module
Number of
additional
interfaces
Names of
additional
interfaces
Falcon-10G 4 eth
<Slot#> -01, eth <Slot#> -02,
eth
<Slot#>
-03
, and
eth
<Slot#>
-04
Falcon-40G 2
eth
<Slot#>
-01
and
eth
<Slot#>
-05
Notes:
•"<
Slot# >" denotes the ordinal number of the front-facing I/O slot, which the acceleration card
populates.
For example:
•For the first Falcon-10G acceleration card, Gaia OS would show eth1-01, eth1-02,
eth1-03, and eth1-04.
•For the second Falcon-10G acceleration card, Gaia OS would show eth2-01, eth2-02,
eth2-03, and eth2-04.
•In addition to the interfaces noted above, the Gaia OS on the appliance shows logical interfaces
called bcmnet-np
<Slot#> .
Only the ifconfig -a command in the Expert mode shows these interfaces. Ignore these
logical interfaces.

Falcon Acceleration Cards Administration Guide R80.20 | 8
CHAPT E R 2
Falcon Acceleration Cards
In This Section:
CPAC-Falcon-10G-B.......................................................................................................9
CPAC-Falcon-40G-B.....................................................................................................10
Initial Configuration......................................................................................................11
Refer to this generic illustration when you install, remove, or replace Falcon Acceleration Cards in
Check Point Security Appliances:
Item
Description
1 Captive screws
2 Dummy panel for the expansion slot

Falcon Acceleration Cards
Falcon Acceleration Cards Administration Guide R80.20 | 9
CPAC-Falcon-10G-B
Item
Component
Description
1 Port
Activity
LED
•Off - LAN link is not established
•Steady Green - LAN link is established
•Blinking Green - LAN activity
2 Link
Speed
LED
•Off
•Steady Amber - 1 Gbit/sec data rate is selected
•Steady Blue - 10 Gbit/sec data rate is selected

Falcon Acceleration Cards
Falcon Acceleration Cards Administration Guide R80.20 | 10
CPAC-Falcon-40G-B
Item
Component
Description
1 Port
Activity
LED
•Off - LAN link is not established
•Steady Green - LAN link is established
•Blinking Green - LAN activity
2 Link
Speed
LED
•Off
•Steady White - 40 Gbit/sec data rate is selected

Falcon Acceleration Cards
Falcon Acceleration Cards Administration Guide R80.20 | 11
Initial Configuration
See the Falcon Acceleration Cards Getting Started Guide
https://sc1.checkpoint.com/documents/Falcon/EN/CP_R80.20_FalconAccelerationCards_Getting
StartedGuide/html_frameset.htm.

Falcon Acceleration Cards Administration Guide R80.20 | 12
CHAPT E R 3
Configuring the Link Speed on the
Falcon-10G Ports
Because of hardware limitations, you must take additional steps when you configure the link
speed on the Falcon Acceleration Cards 10 GbE (CPAC-Falcon-10G-B).
Configuring the Link Speed in Gaia Operating System:
See the R80.20 Gaia Administration Guide
https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_Gaia_Admin
Guide/html_frameset.htm - Chapter
Network Management - Section Network Interfaces .
Where Instructions
Gaia Portal
1.
In the navigation tree, click Network Management > Network Interfaces.
2.
Select the Falcon Acceleration Card port from the list and click Edit.
3.
On the Ethernet tab, select a link speed and duplex setting from the list:
•1000 Mbps / Full Duplex
•10 Gbps / Full Duplex
4.
Click OK.
Gaia Clish
1.
set interface eth< Slot# >-< Port# > link-speed {1000M/full |
10G/full }
2.
save config
General Notes:
•For the Falcon-10G ports, you must configure the same link speeds on ports in these pairs:
•Ports 1 and 2.
•Ports 3 and 4.
You can configure different link speeds on different port pairs.
For example, you can configure 1000 Mbps on ports 1 and 2, and 10 Gbps on ports 3 and 4.
•Configuration of the link speed on the Falcon-10G ports disables and then enables
all ports on
the acceleration card.
This brief reset applies even to ports, whose link speed is not changed.
This brief reset does not affect other Falcon Acceleration Cards or other physical interfaces on
the appliance.

Configuring the Link Speed on the Falcon-10G Ports
Falcon Acceleration Cards Administration Guide R80.20 | 13
•Configuration of the link speed on the Falcon-10G ports generates this warning in both Gaia
Portal and Gaia Clish:
Module and
Ports
Warning
Falcon-10G
Ports 1 and 2
Warning: Please note that the link speed of eth< Slot# >-
01 and
eth< Slot# >-02 is paired, link speed of < Link Speed
> will be
applied for both.
For the change to take effect, all interfaces on the AC card
need be reset, link will be down eth< Slot# >-01, eth< Slot# >-
02,
eth< Slot# >-03 and eth< Slot# >-04 for 1 to 5 seconds.
Are you sure you want to continue?
Falcon-10G
Ports 3 and 4
Warning: Please note that the link speed of eth< Slot# >-
03 and
eth< Slot# >-04 is paired, link speed of < Link Speed
> will be
applied for both.
For the change to take effect, all interfaces on the AC card
need be reset, link will be down eth< Slot# >-01, eth< Slot# >-
02,
eth< Slot# >-03 and eth< Slot# >-04 for 1 to 5 seconds.
Are you sure you want to continue?
You must approve this action explicitly.
If in the Gaia Portal you click No, the Gaia Portal cannot allow to commit other changes you
made in the same window. You must cancel out of the current window, and start again.
•The Falcon Acceleration Cards Falcon-10G do
not support the auto-negotiation of the link
speed.
As a result, on the peer networking device, the link with the Falcon-10G ports may appear as
down in these cases:
•When you change the link speed of an interface on the peer networking device.
•When you physically move the connection on the peer networking device to another
interface with a different port configuration.
In order to establish a link with the Falcon-10G ports, you may be required to disable the
auto-negotiation and configure the link speed statically on the peer networking device. Refer to
the device vendor's documentation for instructions.

Configuring the Link Speed on the Falcon-10G Ports
Falcon Acceleration Cards Administration Guide R80.20 | 14
•The Falcon Acceleration Cards support only these ethtool
https://linux.die.net/man/8/ethtool commands:
Command
Description
ethtool
eth<
Slot#
>-<
Port#
>
Shows the basic link status.
ethtool -S
eth<
Slot#
>-<
Port#
>
Shows network statistics.
ethtool -i
eth<
Slot#
>-<
Port#
>
Shows the version of the adp_eth_if driver.
ethtool -t
eth<
Slot#
>-<
Port#
>
Runs an internal loopback test (from the card to Gaia OS stack
and return).
ethtool -p
eth<
Slot#
>-<
Port#
>
Identifies the port by sight. Blinks one or more LEDs on the
specific network port.
Important -Link speed negotiation (ethtool -s) and auto-negotiation restart (ethtool -r)
commands are not supported.
Performance Notes:
The Falcon Acceleration Cards achieve high performance by specialized software that runs
directly on the cards.
General performance parameters normally accessible to regular NIC drivers may not be
accessible or relevant to configure for the Falcon Acceleration Cards.
•It is not supported to query and configure Tx/Rx ringsize with these commands:
•show interface eth< Slot# >-<Port#> rx-ringsize
•set interface eth<
Slot# >-<Port#> rx-ringsize < Size >
•show interface eth<
Slot# >-<Port#> tx-ringsize
•set interface eth<
Slot# >-<Port#> tx-ringsize < Size >
•ethtool -G eth<
Slot# >-<Port#>
•ethtool -g eth<
Slot# >-<Port#> rx < Size > tx < Size >
•It is not supported (or necessary) to adjust per-interface Multi-Queue with this command:
•cpmq set

Falcon Acceleration Cards Administration Guide R80.20 | 15
CHAPT E R 4
Breakout Mode for the Falcon-40G Card
In This Section:
Introduction to the Breakout Mode..............................................................................15
Configuring the Breakout Mode...................................................................................18
Limitations in the Breakout Mode ...............................................................................28
Introduction to the Breakout Mode
The Check Point Falcon-40G-B acceleration card supports an optical breakout cable (also known
as a "fanout", "splitter", or "octopus" cable). You can connect this cable to split a Multimode OM3
or OM4 MPO connector into four LC optical connectors.
The Falcon-40G-B acceleration card supports a breakout configuration of 1x40 GbE to 4x10 GbE.
This turns every 40 GbE port into four ports of 10 GbE. These "child interfaces" of 10 GbE are
essentially unique individual interfaces, with their own MAC addresses, IP addresses, netmasks,
MTU, and so on. You can also use these "child" interfaces to configure a Bond interface, a Bridge
interface, and so on.
The Gaia operating system on the Security Appliance shows these interfaces for the ports of each
installed Falcon-40G acceleration card:
Breakout mode
Interfaces in Gaia
Disabled for both ports (default) •
eth <Slot#> -01 (works at 40 GbE)
•
eth
<Slot#>
-05
(works at 40 GbE)
Enabled for Port #1 only •eth
<Slot#> -01 (works at 10 GbE)
•eth
<Slot#> -02 (works at 10 GbE)
•eth
<Slot#> -03 (works at 10 GbE)
•
eth
<Slot#>
-04
(works at 10 GbE)
•
eth
<Slot#>
-05
(works at 40 GbE)
Enabled for Port #2 only •
eth
<Slot#>
-01
(works at 40 GbE)
•eth
<Slot#> -05 (works at 10 GbE)
•eth
<Slot#> -06 (works at 10 GbE)
•eth
<Slot#> -07 (works at 10 GbE)
•eth <Slot#> -08 (works at 10 GbE)

Breakout Mode for the Falcon-40G Card
Falcon Acceleration Cards Administration Guide R80.20 | 16
Breakout mode
Interfaces in Gaia
Enabled for both ports
•eth <Slot#> -01 (works at 10 GbE)
•eth
<Slot#> -02 (works at 10 GbE)
•eth
<Slot#> -03 (works at 10 GbE)
•
eth
<Slot#>
-04
(works at 10 GbE)
•eth
<Slot#> -05 (works at 10 GbE)
•eth
<Slot#> -06 (works at 10 GbE)
•eth
<Slot#> -07 (works at 10 GbE)
•
eth
<Slot#>
-08
(works at 10 GbE)
Note -"<Slot#>" denotes the ordinal number of the front-facing I/O slot, which the Falcon-40G
acceleration card populates. For example, for the first Falcon-40G acceleration card with disabled
breakout mode, Gaia OS would show eth1-01 and eth1-05. For example, for the second
Falcon-40G acceleration card with disabled breakout mode, Gaia OS would show eth2-01 and
eth2-05.
Example 1 from Gaia Portal - Breakout mode is disabled for both ports (default):

Breakout Mode for the Falcon-40G Card
Falcon Acceleration Cards Administration Guide R80.20 | 17
Example 2 from Gaia Portal - Breakout mode is enabled for Port #2 only:

Breakout Mode for the Falcon-40G Card
Falcon Acceleration Cards Administration Guide R80.20 | 18
Configuring the Breakout Mode
Important:
•When you enable or disable the Breakout Mode on a port, you must treat the procedure as if
you install or remove network interfaces on the appliance. Schedule a maintenance window.
•When you enable or disable the Breakout Mode on a port, all IP configuration is lost on the
port and its "child" interfaces. You must configure the applicable IP addresses again.
•When you enable the Breakout Mode on a port, auto-configuration and link speed are not
dynamic for the "child" interfaces. Therefore, those options are greyed out.
Due to the nature of the breakout cable, it is not possible to perform an "autodetect" of this
feature when you connect this cable.
Workflow to enable the breakout feature on a Falcon-40G port:
Step
Description
1 Enable the breakout mode on the port.
2 Connect the breakout cable between the port and the peer devices.
3 Reboot the appliance.
4 Configure the applicable IP addresses on the "child" interfaces.
Workflow to disable the breakout feature on a Falcon-40G port:
Step
Description
1 Disable the breakout mode on the port.
2 Disconnect the breakout cable between the port and the peer devices.
3 Reboot the appliance.
4 Connect the optical cable between this port and the peer device.
5 Configure the applicable IP address on the port.
You can configure the breakout mode in:
•Gaia Portal (on page 19)
•Gaia Clish (on page 21)
•Expert mode (on page 25) (only as a last resort)

Breakout Mode for the Falcon-40G Card
Falcon Acceleration Cards Administration Guide R80.20 | 19
Configuration in Gaia Portal
To enable the Breakout Mode on a port:
Step
Description
1 Insert the supported Short Range transceiver (on page 28) into this port.
Note - If you insert an invalid transceiver, Gaia OS shows a warning dialog. However, it
does not prevent the configuration of the breakout mode.
2 With a web browser, connect to the Gaia Portal on the Security Appliance at:
https://<
IP Address of Gaia Management Interface
>
3 From the navigation tree, click Network Management > Network Interfaces.
4 Select the applicable interface (eth<
Slot# >-01 or eth< Slot# >-05) and click Edit.
Interface properties pop-up window opens.
5 At the top, select Enable.
6 At the bottom, click the Breakout Mode tab.
7 In the Selected Mode field, select 10G/full(breakout).
8 Click OK to close the interface properties pop-up window.
9 Connect the breakout cable between this port and the remote peer devices.
10 Reboot the Security Appliance:
a) In the navigation tree, click Maintenance > Shut Down.
b) Click Reboot.
11 With a web browser, connect to the Gaia Portal on the Security Appliance at:
https://<
IP Address of Gaia Management Interface
>
12 From the navigation tree, click Network Management > Network Interfaces.
Make sure you see the applicable interface and its "child" interfaces:
•eth<
Slot# >-01, eth< Slot# >-02, eth< Slot# >-03, and eth< Slot# >-04
•
eth<
Slot#
>-05
,
eth<
Slot#
>-06
,
eth<
Slot#
>-07
, and
eth<
Slot#
>-08
13 Configure the IP addresses on the applicable "child" interfaces.
See the
R80.20 Gaia Administration Guide
https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_Gaia
_AdminGuide/html_frameset.htm - Chapter
Network Management - Section Network
Interfaces
- Subsection Physical Interfaces .

Breakout Mode for the Falcon-40G Card
Falcon Acceleration Cards Administration Guide R80.20 | 20
To disable the Breakout Mode on a port:
Step
Description
1 With a web browser, connect to the Gaia Portal on the Security Appliance at:
https://<
IP Address of Gaia Management Interface
>
2 From the navigation tree, click Network Management > Network Interfaces.
3 Select the applicable interface (eth<
Slot# >-01 or eth< Slot# >-05) and click Edit.
Interface properties pop-up window opens.
4 At the bottom, click the Breakout Mode tab.
5 In the Selected Mode field, select 40G/full.
6 Click OK to close the interface properties pop-up window.
7 Disconnect the breakout cable between this port and the remote peer devices.
8 Reboot the Security Appliance:
a) In the navigation tree, click Maintenance > Shut Down.
b) Click Reboot.
9 With a web browser, connect to the Gaia Portal on the Security Appliance at:
https://<
IP Address of Gaia Management Interface
>
10 From the navigation tree, click Network Management > Network Interfaces.
Make sure you see only the applicable port interface (eth<
Slot# >-01 or eth< Slot# >-05)
without its "child" interfaces.
11 Connect the optical cable between this port and the remote peer device.
12 Configure the IP address on this port.
See the
R80.20 Gaia Administration Guide
https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_Gaia
_AdminGuide/html_frameset.htm - Chapter
Network Management - Section Network
Interfaces
- Subsection Physical Interfaces .
To determine what slot number the acceleration card populates:
Shell
Commands
Gaia Clish Run one of these commands:
•show asset ac
•
fwaccel stat
Expert mode Run one of these commands:
•clish -c "show asset ac"
•
fwaccel stat