CheckPoint 15400 Gateway - R81.20

[stuart2020]

Hello, 

I've recently upgraded our CheckPoint 15400 ClusterXL Gateways to R81.20 Take 53. Since the upgrade we have 10-15 minutes of extreme slowness where everything grinds to a halt before performing normally again. This happens once maybe twice per day.

I've checked the cpview history and there doesn't seem to be a correlation with increased traffic, high CPU but from SolarWinds I can see that latency to Google increases to over 10,000ms. 

Has anyone else experienced performance issues in R81.20. Any tips for troubleshooting the issue please?

Many Thanks

[Bob_Zimmerman]

I have a lot of firewalls on R81.20 with various jumbos including 53. I haven't seen a problem like you describe.

If the issue isn't correlated to high processor usage on the firewall, maybe it's some traffic the firewall drops such as traffic from an internal DNS server out to DNS servers on the public Internet? When DNS misbehaves, so does basically everything else.

[stuart2020]

Thanks for the suggestion. I've checked DNS and no drops have been detected. I know it could probably be a number of different issues but any more suggestions on possible causes? 

[the_rock]

Can you check output of fw tab -t connections -s?

Also, does cpview show u top services/connections?

Andy

[stuart2020]

fw tab -t connections -s

HOST NAME ID #VALS #PEAK #SLINKS
localhost connections 8158 7239 19761 14263

I'm unable to view historical connections in cpview and top connections under the network tab need to be activated. I've uploaded screenshots of real time network and CPU top connections.

[the_rock]

Make sure gateway object has connections set to auto setting as well. Please open TAC case, sounds like a pretty serious issue.

[stuart2020]

Where in the gateway object is the connection auto setting? 

Yes, I have raised it with TAC. Just waiting for someone to pick up the ticket. 

[stuart2020]

Is it the setting in the screenshot that you're referring to? 

[the_rock]

Thats it, you got the right option selected.

[stuart2020]

I've been reading through sk167903 to enable data collection for Network --> Protocols / Connections. The article mentions enabling this feature may cause a performance impact. 

Do you know how much of an impact this has? Is it likely to cause performance issues? 

[the_rock]

I can totally see the point @Bob_Zimmerman is making. I had never seen this issue myself, so highly unlikely its code problem.

Andy