Skip to main content

​
Overview

Check Point SecureXL accelerates traffic processing on Check Point Security Gateways by offloading packet processing to dedicated network processors and hardware. OneFirewall’s WCF Agent works with SecureXL to push and continuously update large rule sets — thousands to millions of rules — without degrading gateway performance.

​
Compatibility

SecureXL support depends on the Gaia OS and Security Gateway version:

​
How SecureXL Works

Components:
  • SecureXL Acceleration: bypasses the slower packet-inspection path when possible.
  • SecureXL Devices: NICs and Network Processing Units (NPUs) that accelerate traffic.
  • Templates: created per connection type; matching connections are processed faster.
  • Flows: handle ongoing connections so packets in an established session are processed efficiently.
Packet flow:
  1. The first packet of a new connection undergoes full inspection (security policy checks, DPI).
  2. Once the packet is allowed, SecureXL creates a template containing source, destination, protocol, and other connection data.
  3. Subsequent packets matching the template use the fast path and bypass full inspection.
  4. SecureXL maintains state for established connections and routes their packets directly.
  5. Supported connections and packet types are offloaded to SecureXL hardware, reducing CPU load.

​
Integration with the WCF Agent

The WCF Agent includes a sub-module for SecureXL that pushes and updates security rules on the gateway without significant delay, using Check Point’s standard command-line interface. No changes to Check Point scripts are required. The implementation used depends on the client configuration (blades, no blades, or performance constraints): or

​
Monitoring and Configuration

  • Monitoring: fwaccel stat shows SecureXL status and performance.
  • Configuration: SecureXL settings can be adjusted from the Check Point CLI to enable or disable specific acceleration features.

​
Notes

  • SecureXL combined with the WCF Agent supports real-time rule updates without impacting throughput or latency.
  • Scales to large, dynamic rule sets by combining SecureXL acceleration with the WCF Agent’s update mechanism.