Traffic rate is decreased significantly when assigning any IPS profile other than 'Default

Support Center > Search Results > SecureKnowledge Details

Traffic rate is decreased significantly when assigning any IPS profile other than 'Default_Protection'

Technical Level

Solution ID	sk92527
Technical Level
Product	IPS / Web Intelligence
Version	R70, R70.1, R70.20, R70.30, R70.40, R70.50, R71, R71.10, R71.20, R71.30, R71.40, R71.45, R71.50, R75, R75.10, R75.20, R75.30, R75.40, R75.40VS, R75.45, R75.46, R76, R76SP, R76SP.10
Platform / Model	All
Date Created	15-Mar-2013
Last Modified	08-Dec-2016

Symptoms

Traffic rate through Security Gateway is decreased significantly when assigning any IPS profile other than 'Default_Protection'.
Output of memory leak procedure per sk35496 shows:
FW-1: In fw_hmem_report_leaks fw_drv_fini: N bytes allocated by 'ws_header_value_get' leaked at ...
R75.40VS GA1 for 61000 Security System might crash / unexpectedly reboot.

Cause

By the current design, Web Security Parameter Parser is activated on specific HTTP/HTTPS Request, which inside Check Point code has special parameters set on its URL, on its Body, or on its Multipart. Web Security Parameter Parser extracts the 'context' and sends it for further processing. Even if no one has registered to receive this specific context to perform for further processing, the Web Security Parameter Parser is still activated (thus, valuable time might be lost).

The performance impact will be high only when significant amount of the HTTP traffic is of the following types:

multipart/form-data
application/x-www-form-urlencoded

In other cases, there should be no performance impact.

Solution

Note: To view this solution you need to Sign In .