NGX R65 Release Notes - Check Point

SecureXL
Platform Specific — Solaris
8. On Solaris platforms, Performance Pack does not support the following types of interfaces
• VLAN and virtual interfaces
• bge, dmfe and skge interfaces
Accelerated Features
9. When flows are enabled, full sanity checks are performed for flowed (accelerated) connections
for the IP layer. No sanity checks are performed on the UDP or TCP layer of flowed packets.
The workaround is to disable flows.
10. SmartView Monitor gets updates for every connection from SecureXL once every 30 seconds.
Because of the difference between the SecureXL update interval and the SmartView Monitor
update interval, you might not get a smooth line even when monitoring constant rate
connection.
This phenomenon is negligible when monitoring real life traffic that has many connections that
open and close at random. Regardless of the number of connections, over a significant period
of time, the average of the total number of monitored traffic, will be monitored accurately.
11. The SmartDefense protection PPTP Enforcement does not allow acceleration of the GRE protocol
over PPTP when enabled. In order to accelerate the GRE protocol over PPTP, disable this
protection (on the SmartDefense tab, select Application Intelligence > VPN Protocols > PPTP
Enforcement).
Unsupported Features
12. Fingerprint Scrambling causes a negative impact on performance. ISN Spoofing disables TCP
templates, and TTL and IPID cause traffic to be handled by the firewall module only.
13. The NetQuotas feature is not supported with SecureXL.
14. The Overlapping NAT feature is not supported with SecureXL.
15. WISP redundancy has the following limitations when working with SecureXL:
• Connections passing through interfaces configured with ISP redundancy are not
accelerated. Other connections (for example, an internal connection to a DMZ) are
accelerated and are not affected by this limitation.
• ISP redundancy over PPTP and PPPoE interfaces is not supported.
16. When configuring Remote Access > Office Mode on a gateway that has multiple external
interfaces with SecureXL enabled, make sure that Support connectivity enhancement for gateways
with multiple external interfaces is checked.
17. When SecureClient is connected to a Check Point gateway with two external interfaces and the
connected interface goes down, SecureClient will lose connectivity. In order to resume
connectivity, the user needs to disconnect and reconnect.
18. Performance Pack does not support source-based routing.
Unsupported Products
19. Check Point QoS is not supported with SecureXL.
20. PPTP and PPPoE interfaces are not supported by Performance Pack in configurations where
NAT and/or VPN are used.
VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 30