topic Memory leak in 14xx appliances with IPS enabled in Spark Firewall (SMB)

Memory leak in 14xx appliances with IPS enabled

Hugo_vd_Kooij — Tue, 03 Dec 2019 10:08:42 GMT

Hi,

Do any of you have ticket(s) open in regard to memory leak issue in the 14xx appliances with IPS enabled?

So far we have seen this in 2 distinct setups. In on of these it only happened on 1 of the 30 remote offices. But we have run about a dozen different firmware versions and the issue was never resolved.

If anyone want to share their ticket number(s) in a private message we can join forces and make Check Point more aware of the problem.

Regards, Hugo.

Re: Memory leak in 14xx appliances with IPS enabled

Nik_Bloemers — Tue, 03 Dec 2019 10:22:26 GMT

Hi Hugo,

In the environment I'm currently working in we have multiple, different model 14xx series appliances running IPS and I'm not aware of any memory leak issues in the R77.20.86 / .87 releases. We're running the Optimized profile on these models.

Nik

Re: Memory leak in 14xx appliances with IPS enabled

G_W_Albrecht — Tue, 03 Dec 2019 11:44:47 GMT

Did you follow Optimizing an IPS profile for SMB and use a specially created SMB IPS profile ?

Re: Memory leak in 14xx appliances with IPS enabled

Maarten_Sjouw — Tue, 03 Dec 2019 15:40:34 GMT

Hugo,

Was that specific unit ever replaced by another box?
Recently we had a problem with a 1470 with VPN's that would drop out every early morning, as the company we support these units for is an internationally operating company with some very important site in ASIA, they were calling us every time in the early morning.
We had one in stock preconfigured it and shipped to the site, since then the issue is gone.

Re: Memory leak in 14xx appliances with IPS enabled

Hugo_vd_Kooij — Tue, 03 Dec 2019 16:01:45 GMT

In the most recent case we have a confirmed memory leak that is under investigation by R&D.

In the previous case that customer gave up on IPS after 1 year and about a dozen hardware swaps.

Re: Memory leak in 14xx appliances with IPS enabled

Hugo_vd_Kooij — Tue, 03 Dec 2019 16:05:03 GMT

I have not gone into those details as another team member is doing the technical part of the ticket. But we have had a good set of Check point escalation engineers going over the setup in remote sessions as well.
(But we all make mistakes or have our blind spots.)
So I don't know the exact profile specifics. But there is a seperate IPS profile for the 14xx units.

Re: Memory leak in 14xx appliances with IPS enabled

HristoGrigorov — Tue, 03 Dec 2019 17:11:37 GMT

These appliances have very limited "ability" to leak memory because the amount of free memory is so low that it goes in aggressive mode real quick and then things go real bad. Are you sure it only leaks memory without any processes crashing or kernel panics ?