I think sfwd will always have some issues of sorts due to the fact it handles so much on the SMB appliances. I believe this process is unique to SMB appliances and seems to handle a lot all in one process, I also do not think its multithreaded.
If you look at the CheckPoint Processes and Daemons sk you'll see it handles:
- Logging
- Policy installation
- VPN negotiation
- Identity Awareness enforcement
- UserCheck enforcement
- etc.
Some issues I've seen have been related to stuff like the fact some blades will fail to update (namely AV) if the memory usage goes above a certain threshold and it will just keep trying to update while giving sfwd issues. There is lots you can see if you debug sfwd or if you look at the log file ($FWDIR/log/sfwd.elg).
What I find annoying is when sfwd starts having issues I find I often lose vpn's, security log access, and for some reason some https sites break.
I do hope that sfwd is made to be multithreaded with the newer SMB appliances or at least some functions carried out by sfwd are broken into new processes.
