Support Center > Search Results > SecureKnowledge Details
Dynamic Balancing for CoreXL Technical Level

Table of Contents

  • Introduction
  • Key Features
  • Usage
  • System requirements
  • Monitoring
  • Smart Console Extension
  • FAQ
  • Known Limitations


Dynamic Balancing (Dynamic Split) is a performance-enhancing daemon that balances the load between CoreXL SNDs and CoreXL Firewalls. It dynamically changes the split between CoreXL SNDs and CoreXL Firewalls and does not require a reboot or cause an outage.

Each Check Point Security Gateway CPU belongs to one of two groups, each of which performs a different task: 

  • Firewall instance
  • SND (with the exception of a single CPU running FWD in large User-Space appliances). 

The distribution of jobs across a Security Gateways CPUs is referred to as the Security Gateway's split. As the distribution of work across these groups depends on your security policy and traffic, we highly recommend that you configure your split to fit your specific needs.

CoreXL's Out-of-the-Box Dynamic Balancing performs a dynamic change of the split. It monitors your system and makes changes as needed.

Key Features

  • Out-of-the-box optimization
  • A flexible split to suit your profile


To enable Dynamic Balancing

  1. From the Expert mode, run # dynamic_split -o enable
  2. If your current CoreXL split is not the default, you may receive a prompt to change the number of instances. Enter y.
  3. Reboot your appliance.
Important note for cluster environments: You must configure all cluster members in the same way. In the High the Availability mode, start with the Standby member.


-o { enable | disable | stop | start }

Action Description
enable Starts dynamic split from the gateway’s default split.
disable Returns the gateway to its default configuration.
stop Stops the dynamic split from making changes. Restores to the configuration when the command was executed.
start Starts the dynamic split after it was stopped by a user

System requirements

  • Supported Platforms: Dynamic Balancing is supported only on Check Point Appliances. 

  • Supported Models: Dynamic Balancing is supported only on these models:
    • All models in these series: 7000, 15000, 16000, 23000, 26000 and 28000
    • 5000 series: 5600, 5800 and 5900
    • 6000 series: 6200T, 6400, 6500, 6600, 6700, 6800 and 6900
    • 3000 series: 3100, 3200, 3600 and 3800
    Note: On models with fewer than 8 cores, a GNAT port allocation feature must be enabled. Refer to sk165153.
  • Supported versions: Check Point R80.40 with Jumbo Hotfix Take 25 and higher

  • Supported configurations: Security Gateway (Kernel or USFW), Stand-Alone

  • Supported features: IPv6, Management Data Plane Separation (MDPS), Bridge mode 

  • Not supported: Check Point Appliances that run in VSX mode (regardless of the number of CPU cores), Check Point Maestro


  • You can verify this via CPView, under the SysInfo tab:

  • You can monitor Dynamic Balancing via CPView, under the CPU tab:

  • You can check for Dynamic Balancing status via Expert Mode. To do so, run:

    [Expert@Host]# dynamic_split -p
    Output: Dynamic Split is currently on/off

Smart Console Extension

The SmartConsole Extension provides both monitoring and control over Dynamic Balancing.

To enable this feature, use the "Import SmartConsole Extension..." option in your SmartConsole with the following URL: 

For more details, see the following CheckMates article.


Click Here to Show the Entire Article


Dynamic Balancing manages network card ports that have Multi-Queue enabled. The "mq_mng --show" command shows such ports as "Dynamic".
While Dynamic Balancing is active, it assumes control over several resources (listed below). Manual changes may not work, or cause Dynamic Balancing to stop its work (refer to sk163815 for more details):

  • Changes in affinity of CoreXL Firewall instances, starting or stopping CoreXL Firewall instances, and changing the number of CoreXL Firewall instances.
  • Changes in Multi-Queue affinity/mode, or changes in the number of RxTx queue weights.
To perform the below operations, Dynamic Balancing must first be disabled, and then re-enabled:
  1. Disabling/enabling Hyper Threading
  2. Configuring a new network card port which did not have Multi-Queue enabled.

Known Limitations

Issue ID Description Comments
PMTR-59810 Dynamic Balancing is not supported on VSX Gateways and VSX Clusters. -
PRJ-15874 When you downgrade to Jumbo Hotfix Take where the Dynamic Balancing is not supported, it remains enabled. In this case, the affinity of the Security Gateway will be configured incorrectly.  Disable the Dynamic Balancing before you uninstall the Jumbo Hotfix 

Give us Feedback
Please rate this document