CVPND process consumes 80% CPU

[ErikTorres]

Hello there,

I currently have a FW 9100, R81.20 JHF 90, the Mobile Access portal does not respond for 8 min after the policy installation finishes, I have identified that the CVPND process rises in CPU going from 0.X to 80% average and at this point is when the Mobile Access portal does not respond, when the CPU usage of the CVPND Process returns to its normal state (0.X) the mobile access portal returns to work correctly.

This causes that the new users that want to connect cannot connect, BUT the users that were connected, continue working correctly.

This FW ONLY has the VPN Mobile Access blade enabled, acceleration is also enabled.

I have months with the issue, I have gone through different cases with TAC, but so far they have not been able to find the solution.

Before having the issue, we had a FW 5600 where we did not have the issue, then we went through a FW 6200 and started to have the issue and currently we have a 9100 with the same issue.

I have read a similar case in:
https://community.checkpoint.com/t5/Remote-Access-VPN/CVPND-process-consumes-100-CPU/td-p/51854

But they don't mention the solution

I hope you can help me

Best Regards!

[the_rock]

This is what Massimo said in November 2019.

In our case the problem was fixed removing all the network objects (groups in particular is a CPU consuming) from all the Roles

Now, Abhisot mentioned about some sort of custom fix.

Andy

[ErikTorres]

Hello @the_rock 

Thank you for your comments, I have the following questions

So, the recommendation would be to delete the network groups?

Would it be replaced by host objects?

Is this really useful when there are rules with so many hosts?

I would also like to comment that some users use the mobile access client (example E87) and others through the web portal, my question is if these network objects are deleted from the Access Control rules or from the mobile access rules of the smartdashboard?

Best Regards!

[the_rock]

I cant say for certain if that indeed would be recommendation, its simply my logical conclusion reading previous post. Personally, I would open TAC case and see what they suggest.

Andy

[the_rock]

Hey @ErikTorres 

Any luck if you tried what was suggested in the other post?

Andy