Memory leak in 14xx appliances with IPS enabled

[Hugo_vd_Kooij]

Hi,

Do any of you have ticket(s) open in regard to memory leak issue in the 14xx appliances with IPS enabled?

So far we have seen this in 2 distinct setups. In on of these it only happened on 1 of the 30 remote offices. But we have run about a dozen different firmware versions and the issue was never resolved.

If anyone want to share their ticket number(s) in a private message we can join forces and make Check Point more aware of the problem.

Regards, Hugo.

[Nik_Bloemers]

Hi Hugo,

In the environment I'm currently working in we have multiple, different model 14xx series appliances running IPS and I'm not aware of any memory leak issues in the R77.20.86 / .87 releases. We're running the Optimized profile on these models.

Nik

[G_W_Albrecht]

Did you follow Optimizing an IPS profile for SMB and use a specially created SMB IPS profile ?

[Hugo_vd_Kooij]

I have not gone into those details as another team member is doing the technical part of the ticket. But we have had a good set of Check point escalation engineers going over the setup in remote sessions as well.
(But we all make mistakes or have our blind spots.)
So I don't know the exact profile specifics. But there is a seperate IPS profile for the 14xx units.

[HristoGrigorov]

These appliances have very limited "ability" to leak memory because the amount of free memory is so low that it goes in aggressive mode real quick and then things go real bad. Are you sure it only leaks memory without any processes crashing or kernel panics ?

[Maarten_Sjouw]

Hugo,

Was that specific unit ever replaced by another box?
Recently we had a problem with a 1470 with VPN's that would drop out every early morning, as the company we support these units for is an internationally operating company with some very important site in ASIA, they were calling us every time in the early morning.
We had one in stock preconfigured it and shipped to the site, since then the issue is gone.

[Hugo_vd_Kooij]

In the most recent case we have a confirmed memory leak that is under investigation by R&D.

In the previous case that customer gave up on IPS after 1 year and about a dozen hardware swaps.