Firewall is freezing/crashing randomly after upgrade to R82

[mfernandez1]

Hello,

Recently we upgraded our firewall to version R82, but after a few days it started freezing/crashing (it stays like that for a good while), after a reboot it works fine for a few days and then it happens again (while its frozen we are not able to reboot it). We noticed that the resource use spikes when it happens. We are hosting our firewall on VMWare hypervisor, and all the configurations stayed the same from the previous version except for the provisioning, which was thick and the new one is thin, but I'm not sure if that is the problem since our other firewalls have thin provisioning too. I'm posting on here to get some recommendations on what I can check (I do not have a lot of experience with Checkpoint). Thank you!

[the_rock]

I would suggest installing recommended jumbo, if you have not already, which is currently take 39. Now, if you had done so already, please send outputs of below:

cpwd_admin list

top

ps -auxw

free -g

fw ctl multik print_heavy_conn

Also, examine what you see in cpview, specially top services, connections. Worth checking as well if its running in user or kernel mode, which you can verify via cpconfig, corexl option.

HTH

Andy

[Duane_Toler]

Hm this sounds like a VMware resource allocation issue.  I would suggest you edit the VM properties and make certain you dedicate the CPUs and RAM to the VM.  This is in the VM properties and "reservation" for the RAM, and CPU affinity.  If you can switch the disk type to thick provision, that would be ideal. These kinds of VMs need to have their resources available immediately and have to wait on the hypervisor scheduler to rob another resource to allocate.

[the_rock]

Great point Duane!

[Chris_Atkinson]

Agree and for context Is the latest/recommend JHF applied, did you build from iso or ova or upgrade in-place?

See also: sk104848, sk169252, sk101214

[PhoneBoy]

Thick/thin provisioning refers to the virtual disk.
Technically, we only support thick provisioning, but I don't believe it's relevant in this case.

What resources (RAM / disk / CPU) do you have allocated to the VM?