<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic vpnd high CPU utilization in General Topics</title>
    <link>https://community.checkpoint.com/t5/General-Topics/vpnd-high-CPU-utilization/m-p/281583#M46780</link>
    <description>&lt;P&gt;&lt;SPAN class=""&gt;Good morning.&lt;BR /&gt;&lt;BR /&gt;R82 take 122, Quantum NGFW&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&amp;nbsp;&lt;SPAN class=""&gt;We encountered a very strange problem. When we increased the gateway’s traffic processing, we noticed an unnatural increase in the gateway’s utilization, which manifested itself in inadequate VPND consumption. In the screenshot below, you can see how the situation looks when processing approximately 200 Mbps of traffic.&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;DIV class=""&gt;&amp;nbsp;&lt;/DIV&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Untitled.png" style="width: 400px;"&gt;&lt;img src="https://community.checkpoint.com/t5/image/serverpage/image-id/35137iEB8A46FE4ED4FBF5/image-size/medium?v=v2&amp;amp;px=400" role="button" title="Untitled.png" alt="Untitled.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;  enabled_blades&lt;BR /&gt;fw urlf av appi ips identityServer SSL_INSPECT anti_bot ThreatEmulation content_awareness mon zero_phishing&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN class=""&gt;As&lt;/SPAN&gt; &lt;SPAN class=""&gt;you&lt;/SPAN&gt; &lt;SPAN class=""&gt;can&lt;/SPAN&gt; &lt;SPAN class=""&gt;see&lt;/SPAN&gt;&lt;SPAN class=""&gt;,&lt;/SPAN&gt; &lt;SPAN class=""&gt;neither&lt;/SPAN&gt; &lt;SPAN class=""&gt;VPN&lt;/SPAN&gt;&lt;SPAN&gt;, nor &lt;/SPAN&gt;&lt;SPAN class=""&gt;RA&lt;/SPAN&gt;&lt;SPAN&gt;, nor &lt;/SPAN&gt;&lt;SPAN class=""&gt;mobile&lt;/SPAN&gt; &lt;SPAN class=""&gt;access&lt;/SPAN&gt; &lt;SPAN class=""&gt;is&lt;/SPAN&gt; &lt;SPAN class=""&gt;used&lt;/SPAN&gt;&lt;SPAN class=""&gt;.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN class=""&gt;Disabling&lt;/SPAN&gt;&lt;SPAN&gt; the &lt;/SPAN&gt;&lt;SPAN class=""&gt;blades&lt;/SPAN&gt; &lt;SPAN class=""&gt;that&lt;/SPAN&gt; &lt;SPAN class=""&gt;indirectly&lt;/SPAN&gt;&lt;SPAN&gt; use vpnd did &lt;/SPAN&gt;&lt;SPAN class=""&gt;not&lt;/SPAN&gt;&lt;SPAN&gt; yield &lt;/SPAN&gt;&lt;SPAN class=""&gt;any&lt;/SPAN&gt; &lt;SPAN class=""&gt;results&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN class=""&gt;—&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN class=""&gt;inspection&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class=""&gt;zero&lt;/SPAN&gt; &lt;SPAN class=""&gt;phishing&lt;/SPAN&gt;&lt;SPAN&gt;, and usercheck were &lt;/SPAN&gt;&lt;SPAN class=""&gt;disabled&lt;/SPAN&gt;&lt;SPAN&gt; one by one, &lt;/SPAN&gt;&lt;SPAN class=""&gt;but&lt;/SPAN&gt; &lt;SPAN class=""&gt;this&lt;/SPAN&gt; &lt;SPAN class=""&gt;only&lt;/SPAN&gt; &lt;SPAN class=""&gt;led&lt;/SPAN&gt; &lt;SPAN class=""&gt;to&lt;/SPAN&gt; &lt;SPAN class=""&gt;opposite&lt;/SPAN&gt;&lt;SPAN&gt; results; disabling usercheck resulted only &lt;/SPAN&gt;&lt;SPAN class=""&gt;in&lt;/SPAN&gt;&lt;SPAN&gt; a &lt;/SPAN&gt;&lt;SPAN class=""&gt;utilization&lt;/SPAN&gt;&lt;SPAN&gt; rate &lt;/SPAN&gt;&lt;SPAN class=""&gt;of&lt;/SPAN&gt; &lt;SPAN class=""&gt;around&lt;/SPAN&gt; &lt;SPAN class=""&gt;99&lt;/SPAN&gt;&lt;SPAN class=""&gt;%&lt;/SPAN&gt; &lt;SPAN class=""&gt;on&lt;/SPAN&gt; &lt;SPAN class=""&gt;each&lt;/SPAN&gt; &lt;SPAN class=""&gt;fwk&lt;/SPAN&gt; &lt;SPAN class=""&gt;core&lt;/SPAN&gt;&lt;SPAN&gt;.&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN class=""&gt;debugging VPND doesn’t provide any insight&amp;nbsp;—&amp;nbsp;only hundreds of thousands of records of standard TLS encryption operations.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&lt;SPAN class=""&gt;The most interesting thing is that the second gateway, which has similar settings and policies and is essentially a backup for this cluster, does not have similar problems, and the vpnd utilization there does not exceed 5%.&lt;BR /&gt;&lt;BR /&gt;We submitted a ticket to TAC, but so far they haven’t been able to help us. Perhaps this is some kind of bug that other administrators are also experiencing?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN class=""&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;</description>
    <pubDate>Thu, 27 Aug 2026 09:34:17 GMT</pubDate>
    <dc:creator>okatsladz454</dc:creator>
    <dc:date>2026-08-27T09:34:17Z</dc:date>
    <item>
      <title>vpnd high CPU utilization</title>
      <link>https://community.checkpoint.com/t5/General-Topics/vpnd-high-CPU-utilization/m-p/281583#M46780</link>
      <description>&lt;P&gt;&lt;SPAN class=""&gt;Good morning.&lt;BR /&gt;&lt;BR /&gt;R82 take 122, Quantum NGFW&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&amp;nbsp;&lt;SPAN class=""&gt;We encountered a very strange problem. When we increased the gateway’s traffic processing, we noticed an unnatural increase in the gateway’s utilization, which manifested itself in inadequate VPND consumption. In the screenshot below, you can see how the situation looks when processing approximately 200 Mbps of traffic.&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;DIV class=""&gt;&amp;nbsp;&lt;/DIV&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Untitled.png" style="width: 400px;"&gt;&lt;img src="https://community.checkpoint.com/t5/image/serverpage/image-id/35137iEB8A46FE4ED4FBF5/image-size/medium?v=v2&amp;amp;px=400" role="button" title="Untitled.png" alt="Untitled.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;  enabled_blades&lt;BR /&gt;fw urlf av appi ips identityServer SSL_INSPECT anti_bot ThreatEmulation content_awareness mon zero_phishing&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN class=""&gt;As&lt;/SPAN&gt; &lt;SPAN class=""&gt;you&lt;/SPAN&gt; &lt;SPAN class=""&gt;can&lt;/SPAN&gt; &lt;SPAN class=""&gt;see&lt;/SPAN&gt;&lt;SPAN class=""&gt;,&lt;/SPAN&gt; &lt;SPAN class=""&gt;neither&lt;/SPAN&gt; &lt;SPAN class=""&gt;VPN&lt;/SPAN&gt;&lt;SPAN&gt;, nor &lt;/SPAN&gt;&lt;SPAN class=""&gt;RA&lt;/SPAN&gt;&lt;SPAN&gt;, nor &lt;/SPAN&gt;&lt;SPAN class=""&gt;mobile&lt;/SPAN&gt; &lt;SPAN class=""&gt;access&lt;/SPAN&gt; &lt;SPAN class=""&gt;is&lt;/SPAN&gt; &lt;SPAN class=""&gt;used&lt;/SPAN&gt;&lt;SPAN class=""&gt;.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN class=""&gt;Disabling&lt;/SPAN&gt;&lt;SPAN&gt; the &lt;/SPAN&gt;&lt;SPAN class=""&gt;blades&lt;/SPAN&gt; &lt;SPAN class=""&gt;that&lt;/SPAN&gt; &lt;SPAN class=""&gt;indirectly&lt;/SPAN&gt;&lt;SPAN&gt; use vpnd did &lt;/SPAN&gt;&lt;SPAN class=""&gt;not&lt;/SPAN&gt;&lt;SPAN&gt; yield &lt;/SPAN&gt;&lt;SPAN class=""&gt;any&lt;/SPAN&gt; &lt;SPAN class=""&gt;results&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN class=""&gt;—&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN class=""&gt;inspection&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class=""&gt;zero&lt;/SPAN&gt; &lt;SPAN class=""&gt;phishing&lt;/SPAN&gt;&lt;SPAN&gt;, and usercheck were &lt;/SPAN&gt;&lt;SPAN class=""&gt;disabled&lt;/SPAN&gt;&lt;SPAN&gt; one by one, &lt;/SPAN&gt;&lt;SPAN class=""&gt;but&lt;/SPAN&gt; &lt;SPAN class=""&gt;this&lt;/SPAN&gt; &lt;SPAN class=""&gt;only&lt;/SPAN&gt; &lt;SPAN class=""&gt;led&lt;/SPAN&gt; &lt;SPAN class=""&gt;to&lt;/SPAN&gt; &lt;SPAN class=""&gt;opposite&lt;/SPAN&gt;&lt;SPAN&gt; results; disabling usercheck resulted only &lt;/SPAN&gt;&lt;SPAN class=""&gt;in&lt;/SPAN&gt;&lt;SPAN&gt; a &lt;/SPAN&gt;&lt;SPAN class=""&gt;utilization&lt;/SPAN&gt;&lt;SPAN&gt; rate &lt;/SPAN&gt;&lt;SPAN class=""&gt;of&lt;/SPAN&gt; &lt;SPAN class=""&gt;around&lt;/SPAN&gt; &lt;SPAN class=""&gt;99&lt;/SPAN&gt;&lt;SPAN class=""&gt;%&lt;/SPAN&gt; &lt;SPAN class=""&gt;on&lt;/SPAN&gt; &lt;SPAN class=""&gt;each&lt;/SPAN&gt; &lt;SPAN class=""&gt;fwk&lt;/SPAN&gt; &lt;SPAN class=""&gt;core&lt;/SPAN&gt;&lt;SPAN&gt;.&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN class=""&gt;debugging VPND doesn’t provide any insight&amp;nbsp;—&amp;nbsp;only hundreds of thousands of records of standard TLS encryption operations.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&lt;SPAN class=""&gt;The most interesting thing is that the second gateway, which has similar settings and policies and is essentially a backup for this cluster, does not have similar problems, and the vpnd utilization there does not exceed 5%.&lt;BR /&gt;&lt;BR /&gt;We submitted a ticket to TAC, but so far they haven’t been able to help us. Perhaps this is some kind of bug that other administrators are also experiencing?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN class=""&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 27 Aug 2026 09:34:17 GMT</pubDate>
      <guid>https://community.checkpoint.com/t5/General-Topics/vpnd-high-CPU-utilization/m-p/281583#M46780</guid>
      <dc:creator>okatsladz454</dc:creator>
      <dc:date>2026-08-27T09:34:17Z</dc:date>
    </item>
  </channel>
</rss>

