High CPU after upgrade from R77.x to R80.x when running only Firewall and Monitoring blades

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk166700
Technical Level
Product	Quantum Security Gateways, SecureXL, Mobile Access / SSL VPN
Version	R80.20, R80.30, R80.40, R80.20SP, R80.30SP
OS	Gaia
Platform / Model	All
Date Created	06-May-2020
Last Modified	02-Dec-2020

Symptoms

High CPU (SI%) seen after an upgrade to R80.x (that was not present in R77.x).
A higher percentage of traffic is hitting PXL (SecureXL medium path), although IPS is not enabled.
All traffic on port 443 is not accelerated.
FastAccel on the traffic on port 443 resolves the issue.

Cause

When only Firewall and Monitoring blades are enabled, the TLS parser (which parses the TLS content) is enabled by default. This forces all SSL traffic to flow over the SecureXL Medium Path. Traffic going through PXL causes high CPU on fw_worker processes. This high CPU introduces latency and traffic impact, depending on how much traffic over port 443 is seen on the Gateway / Cluster.

Solution

Note: To view this solution you need to Sign In .