topic Re: SMB causes high CPU on all cores in Firewall and Security Management

GW causes high CPU on all cores

ChungNguyen — Mon, 10 Jan 2022 07:50:48 GMT

Hi everyone, I have noticed that uploading some kind of files from the inside network and VPN to the local network using share file smb causes cpu appliance to reach 50 ~ 60% during the file transfer.

I can try disable IPS, AV, AntiBot but it doen't work

Thank for help

Re: SMB causes high CPU on all cores

_Val_ — Sun, 09 Jan 2022 11:26:42 GMT

What kind of VPN? Remote Access, Site to Site? IPSec, SSL?

Re: SMB causes high CPU on all cores

Chris_Atkinson — Sun, 09 Jan 2022 11:31:01 GMT

Which appliance model and software version?

Re: SMB causes high CPU on all cores

ChungNguyen — Mon, 10 Jan 2022 02:04:50 GMT

I use VPN Remote Access, IPsec and SSL,

Re: SMB causes high CPU on all cores

ChungNguyen — Mon, 10 Jan 2022 02:07:29 GMT

I use Check Point Appliance 5600 and software servison R80.30 hotfix 241,

Re: SMB causes high CPU on all cores

the_rock — Mon, 10 Jan 2022 02:10:04 GMT

If you run top, free -m, ps -auxw commands...does it show any specific process consuming high CPU when performing those operations?

Andy

Re: SMB causes high CPU on all cores

ChungNguyen — Mon, 10 Jan 2022 02:25:02 GMT

I try cli top but i see fwk1_dev_0 high CPU,

Re: SMB causes high CPU on all cores

Chris_Atkinson — Mon, 10 Jan 2022 03:59:06 GMT

Which encryption algorithms are used, are you using those that are AES-NI friendly?

Please refer: sk98950 - Slow traffic speed (high latency) when transferring files over VPN tunnel with 3DES encryption

Re: SMB causes high CPU on all cores

ChungNguyen — Mon, 10 Jan 2022 03:45:25 GMT

I'm sory, I not sure if it's this?

Re: SMB causes high CPU on all cores

the_rock — Mon, 10 Jan 2022 03:55:21 GMT

I literally had 1 customer ask me if they should change those in 15 years...no one ever touches them, if ever...

You may want to consider upgrade to R80.40 based on below article:

https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-User-Mode-Firewall-vs-Kernel-Mode/m-p/70759/highlight/true#M14330

Re: SMB causes high CPU on all cores

ChungNguyen — Mon, 10 Jan 2022 04:19:35 GMT

Thank for support,

I will consider it.

Re: SMB causes high CPU on all cores

the_rock — Mon, 10 Jan 2022 04:21:18 GMT

No worries. If you dont wish to upgrade, thats fine, but please read that link...its super helpful and I believe it would benefit you in this situation by running those commands.

Andy

Re: SMB causes high CPU on all cores

Chris_Atkinson — Mon, 10 Jan 2022 10:05:07 GMT

With respect I disagree, 3DES / DES should be avoided for security and performance reasons.

Further to the SK posted above, refer also: sk73980 - Relative speeds of algorithms for IPSec and SSL

Re: SMB causes high CPU on all cores

_Val_ — Mon, 10 Jan 2022 07:52:20 GMT

Just for your information.

We usually refer SMB to Spark gateways, not Enterprise GWs as in your case. As a result, the post was classified to the wrong category. I have changed the title and moved it to the correct space now.

Re: SMB causes high CPU on all cores

the_rock — Mon, 10 Jan 2022 14:14:32 GMT

For security yes, but as far as performance, I had never experienced it myself or with any customers, ever. Just my own experience. Besides, that screenshot @ChungNguyen posted is for supported enc methods in global properties, does not necessarily mean he is using des or 3des in the vpn community at all. But I do agree with you, I would certainly avoid des/3des. for sure.

Re: SMB causes high CPU on all cores

Chris_Atkinson — Sat, 15 Jan 2022 02:30:41 GMT

If your clients are using Visitor mode R80.40 JHF and above has some enhancements in this regard, refer: sk168297

Re: GW causes high CPU on all cores

genisis__ — Sat, 15 Jan 2022 16:13:59 GMT

Is this a large file transfer? If so, it maybe an elephant flow issue, which generally locks up a core.

Re: SMB causes high CPU on all cores

HeikoAnkenbrand — Sat, 15 Jan 2022 17:38:36 GMT

Hi @ChungNguyen

It is normal for a user mode firewall (before there was only a kernel mode firewall without this process) that the process fwk1_dev_0 has a high CPU load and also over 100%. My guess as to the purpose of the fwk1_dev_0 is that it acts as the liaison between the multiple fwk firewall worker processes (fw instance thread that takes care for the packet processing) and the single fwmod kernel driver instance and the process for high priority cluster thread.

                          max_CoreXL_number          max_CoreXL_number
fwk1_dev_0 = ∑ fwk0_x                     +    ∑ fwk0_dev_x               + fwk0_kissd       +         fwk0_hp
                          x=0                                          x=0

More read here: R80.x - Performance Tuning Tip – User Mode Firewall vs. Kernel Mode Firewall

Here is what I would do:

1) Enable AES NI in the BIOS on open server (It should be enabled on a CP appliances).
     More here: R8x - Performance Tuning Tip - AES-NI, R8x - Performance Tuning Tip - BIOS

2) Use the following VPN encryption algorithms AES-128 or AES-256. It is directly supported by AES NI from the processor.
    The SHA256 or SHA 384 settings are not important because they are only used for a short time when negotiating the VPN (vpnd daemon).

3) If you have an elephant flow, it becomes difficult. In this case, I would check that priority queuing is enabled so that the
    remaining connections are distributed more fairly.
    More read here R8x - Performance Tuning Tip - Elephant Flows (Heavy Connections).

4) With R80.30 you should also check whether a 2.6 kernel or a 3.10 kernel is installed. The 3.10 kernel works much more efficiently.

Re: SMB causes high CPU on all cores

Timothy_Hall — Sat, 15 Jan 2022 18:37:02 GMT

Agree with Chris here disable 3DES and DES immediately in favor of AES-128 or AES-256, it will definitely improve performance and may do so drastically if the AES-NI feature set is present on the firewall's processor architecture.

Re: SMB causes high CPU on all cores

ChungNguyen — Mon, 17 Jan 2022 02:23:41 GMT

Hi @HeikoAnkenbrand

I have worked with 3 TACs but they say my system works without problems, due to current hardware requirements it does not meet the requirements, and now need to upgrade hardware.

But I will try your tip.

Thanks for support