SecureXL is automatically enabled on Security Gateway with Dynamically Assigned IP (DAIP) and it is not possible to disable it in "cpconfig" menu.
During First Time Configuration Wizard select "Security Gateway" and select "Dynamically Assigned IP"
Complete the Wizard
Machine is rebooted
Traffic over PPPoE is dropped with "...is dropped by cphwd_offload_conn Reason: VPN and/or NAT traffic between accelerated and non-accelerated interfaces or between non-accelerated interfaces is not allowed" message per sk79880, which means that SecureXL is currently enabled
Connect to command line
In "cpconfig" menu, there is no option "Disable Check Point SecureXL" (which is by design, because SecureXL is not supported on Security Gateway with Dynamically Assigned IP)
First Time Configuration Wizard automatically enables SecureXL before verifying if this machine is Security Gateway with Dynamically Assigned IP (DAIP).