Check Point IP690 - Flash Based Sys, Installation Manual

Page: 68 / 118

6
Installing, Using, and Replacing ADP Services Modules
68 Check Point IP690 Security Platform Installation Guide
Check Point ADP Module Interface Names for IP690 Appliances
ADP module interface naming conventions differ from those for PMC NICs.
IP690 appliances support one ADP module which occupies both slots 1 and 2. However, the
ADP module appears to the host as though it logically occupies only slot 1 of the appliance. The
eight ports on your ADP module are named as follows:
eth-s1p1, eth-s1p2, eth-s1p3, eth-s1p4, eth-s1p5, eth-s1p6, eth-s1p7, eth-s1p8
Since the ADP interface names are not exactly the same as other PMC NIC interface names, you
need to reconfigure your appliance when you replace PMC NICs with an ADP module or an
ADP module with PMC NICs.
Configuring Network Topology with an IP690 Appliance
There are several constraints that are relevant to your network topology after you install an ADP
module in an IP690 appliance that are also relevant to the interaction of ADP interfaces and NIC
interfaces.
When you install an ADP module in an IP690 appliance, Check Point recommends that you
configure your network so that your appliance does not forward traffic between ADP interfaces
and PMC NIC interfaces even if the NIC interfaces are Gigabit Ethernet. Using a configuration
of this type can significantly degrade throughput.
When you install an ADP module in an IP690 appliance, the network processor in the module
performs all VPN encryption and decryption, even for VPN packets that are sent through PMC
NIC interfaces. The built-in Check Point encryption accelerator continues to accelerate IKE
traffic but does not perform any other processing. If VPN traffic ingresses or egresses through a
NIC interface, throughput is negatively affected because the packets must transit the IP690
appliance backplane to reach the network processor in the ADP module. Check Point
recommends that you configure your VPNs to use only ADP interfaces to avoid this
performance loss.