High CPU utilization on one core when having much VPN traffic (IPSEC or Remote Access)

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk165853
Technical Level
Product	IPSec VPN, Endpoint Security VPN, Quantum Security Gateways, VSX
Version	R80.20 (EOL), R80.20SP, R80.30 (EOL), R80.30SP, R80.40
OS	Gaia
Date Created	18-Mar-2020
Last Modified	20-Mar-2022

Symptoms

High CPU usage on one CPU core when high number of end users are connected to the network through Remote Access VPN (RAS / C2S).
High CPU usage on one CPU core when high IPSEC VPN (S2S) is used.
A significant amount of the traffic is processed through medium path.
cphwd_q_init_ke is causing high CPU when SecureXL is enabled in an environment with a lot of VPN traffic.
One CPU that is an SND is being utilized much more while other CPUs are not.

Cause

Each VPN connection is handled by specific CPU, the SND allocates the connection to the relevant CPU based on the tunnel.
The new behaviour is to enable the option to allocate the connection to relevant CPU based on the connection itself without the need of the tunnel.
The unequal load can be verified in CPView Utility in CPU usage and also in Advanced -> SecureXL -> Network-per-CPU:

PPS Distribution

Solution

Note: To view this solution you need to Sign In .