topic Re: CVPND process consumes 100% CPU in SASE and Remote Access

CVPND process consumes 100% CPU

abihsot__ — Thu, 25 Apr 2019 14:36:11 GMT

Hi There,

I have a problem - during policy push cvpnd process is going 100% for 30 seconds during which existing or new connections are not served and users get page not displayed error.

I checked debug of cvpnd process and my findings are that 98% of the lines (out of 2 millions) are:

[12609][23 Apr 17:35:12][ROLES] [ROLES (NAC::IS::TD::Events)] NAC::IS::ROLE_MATCHER_API::RangeList::intersect: no intersection
[12609][23 Apr 17:35:12][ROLES] [ROLES (NAC::IS::TD::Events)] NAC::IS::ROLE_MATCHER_API::RangeList::intersect: intersecting: [x.x.x.x.,x.x.x.x] and [x.x..x.x,x.x..x.x.x.]
[12609][23 Apr 17:35:12][ROLES] [ROLES (NAC::IS::TD::Events)] NAC::IS::ROLE_MATCHER_API::RangeList::intersect: no intersection

What is this ROLE_MATCHER_API doing? It seems it is flooding the process hence it is busy with 100% load.

R80.20 latest JHF

Re: CVPND process consumes 100% CPU

PhoneBoy — Thu, 25 Apr 2019 23:49:19 GMT

My guess is this is related to Identity Awareness.
Do you have that enabled?
Version/JHF level?

Re: CVPND process consumes 100% CPU

abihsot__ — Fri, 26 Apr 2019 06:12:03 GMT

We do use identity awareness, but it is enabled on other gateways, but not on this one. However both gateways share the same management server.

The issue is present in R80.20 JHF47 and R80.20 kernel 3.10 Take11

Re: CVPND process consumes 100% CPU

PhoneBoy — Fri, 26 Apr 2019 15:36:05 GMT

Looks like a new issue that TAC will need to investigate. Even old TAC SRs didn't show similar messages.

Re: CVPND process consumes 100% CPU

abihsot__ — Fri, 26 Apr 2019 18:23:24 GMT

Yes, I have TAC ticket also.

It is really strange and I hope that there is a setting which can force to skip matching roles if IA blade is disabled, but TAC is also struggling to understand this issue.

Re: CVPND process consumes 100% CPU

Massimo_Manzato — Mon, 01 Jul 2019 13:35:53 GMT

Same problem on R80.20 JHF 47(GA) or JHF87 (ongoing) with or without IA blade.

Someone have news regarding this?

Massimo

Re: CVPND process consumes 100% CPU

abihsot__ — Tue, 06 Aug 2019 09:32:44 GMT

Technical support have build a fix for this. Once I try it I'll let you know.

Re: CVPND process consumes 100% CPU

abihsot__ — Thu, 14 Nov 2019 19:46:28 GMT

Forgot to give feedback - the fix worked.

Re: CVPND process consumes 100% CPU

Massimo_Manzato — Wed, 27 Nov 2019 23:14:29 GMT

In our case the problem was fixed removing all the network objects (groups in particular is a CPU consuming) from all the Roles

Re: CVPND process consumes 100% CPU

abihsot__ — Thu, 28 Nov 2019 11:34:07 GMT

Hello,

Can you clarify with an example? So you had access roles and just removed objects which were in "networks" section?

Re: CVPND process consumes 100% CPU

ErikTorres — Wed, 26 Feb 2025 18:20:56 GMT

Hello there,
@abihsot__
@Massimo_Manzato

Could you give an example of the solution?
Was it a specific hotfix you installed?

I currently have a FW 9100 R81.20 JHT 92, this firewall ONLY does VPN mobile access, users connect by client and/or browser, when I installed policies, when I finish the installation the CVPND process is elvated between 80% and 85%, this makes the mobile access web portal stop responding and new users can't connect (users that were already connected have no problem).

Currently I've been months with tickets with TAC and they have not been able to solve the incident, I would like to know how they have managed to solve this problem.

Best Regards!