Checkpoint NG - high cpu usage on fwssd.exe

Posted on 2004-09-23
Medium Priority
Last Modified: 2013-11-16
I have recently replaced my old firewall that was running CP 4.1 with a new system running Checkpoint NG. During the day when I have VPN users connected I notice there are many fwssd.exe process' running. One of the process' is eating up 95-98 % of the CPU.
When I check the system late at night or early in the morning all seems to be ok and the system idle process is about 97%. The Server is NT4.0 SP6a. I appreciate any help I can get with this problem.

Question by:vinnyd79
  • 3
  • 2
LVL 23

Expert Comment

by:Tim Holman
ID: 12143125
It's the CheckPoint Security Server Daemon.  One of these will be kicked off every time a user logs on.
Check Point running on NT is pretty easy to swamp - I would recommend moving to a faster platform.
The problem is probably caused by an excessive amount of VPN tunnel traffic, generated by a single user.  It's quite possible one of your remote users is infected with a virus/worm or maybe just abusing their connections and downloading lots of MP3s, or something...

Assisted Solution

dschwartzer earned 1000 total points
ID: 12154413
Security server (SS) is used whenever you have  a 'resource' usage in the rulebase. For example - you are doing a UFP of CVP on the http/ftp traffic. If so, all the traffic is forwarded to the SS, and then to the appropriate 3rd party AV/server.
Anyway, look through the rulebase and try to remove the unneeded 'resource' usage. Otherwise, SS's are known for their CPU utilization. There're number of alternatives to some stuff SS's are used for. E.g. there's a URL logging mechanism, which is now also implemented in kernel - and is much faster - so you should check out kernel alternatives...

Tim, it can't be VPN, because all VPN solutions (besides SSL) are kernel based - so no user process is involved.
And, just FYI, it has been tested and proven that Intel processors are much better performers on VPN related stuff, then say Sparcs. So Intel is better then Sparc, but SPlat is better then Windows, especially NT...

LVL 28

Author Comment

ID: 12608565
Sorry guys,I was away from EE for a while and had forgotten about this question.
If it is not VPN,do you think it could be caused by a rule allowing UserAuth telnet access to one of my servers?The problem occurs during the day when users are logged on,and goes away in the evenings when they log off.
We Need Your Input!

WatchGuard is currently running a beta program for our new macOS Host Sensor for our Threat Detection and Response service. We're looking for more macOS users to help provide insight and feedback to help us make the product even better. Please sign up for our beta program today!

LVL 23

Expert Comment

by:Tim Holman
ID: 12608765
Yes - it could well be caused by one of Check Point's user authentication mechanisms.  Can you disable and retest to check this ?
LVL 28

Author Comment

ID: 12617589
Disabling it would stop a bunch of people from being able to do their work but I guess it would be a good test. I'll give it a try tomorrow morning and see what happens.
LVL 23

Accepted Solution

Tim Holman earned 1000 total points
ID: 12618882
I mean turn off the telnet authentication mechanism (I assume you mean the Check Point User Auth whereby users have to authenticate with the firewall in order to use telnet ??), so users can access the telnet server direct...

Featured Post

SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
The video will let you know the exact process to import OST/PST files to the cloud based Office 365 mailboxes. Using Kernel Import PST to Office 365 tool, one can quickly import numerous OST/PST files to Office 365. Besides this, the tool also comes…
Suggested Courses

597 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question