Solved

Checkpoint NG - high cpu usage on fwssd.exe

Posted on 2004-09-23
6
3,859 Views
Last Modified: 2013-11-16
I have recently replaced my old firewall that was running CP 4.1 with a new system running Checkpoint NG. During the day when I have VPN users connected I notice there are many fwssd.exe process' running. One of the process' is eating up 95-98 % of the CPU.
When I check the system late at night or early in the morning all seems to be ok and the system idle process is about 97%. The Server is NT4.0 SP6a. I appreciate any help I can get with this problem.

Thanks.
0
Comment
Question by:vinnyd79
  • 3
  • 2
6 Comments
 
LVL 23

Expert Comment

by:Tim Holman
Comment Utility
It's the CheckPoint Security Server Daemon.  One of these will be kicked off every time a user logs on.
Check Point running on NT is pretty easy to swamp - I would recommend moving to a faster platform.
The problem is probably caused by an excessive amount of VPN tunnel traffic, generated by a single user.  It's quite possible one of your remote users is infected with a virus/worm or maybe just abusing their connections and downloading lots of MP3s, or something...
0
 
LVL 3

Assisted Solution

by:dschwartzer
dschwartzer earned 250 total points
Comment Utility
Security server (SS) is used whenever you have  a 'resource' usage in the rulebase. For example - you are doing a UFP of CVP on the http/ftp traffic. If so, all the traffic is forwarded to the SS, and then to the appropriate 3rd party AV/server.
Anyway, look through the rulebase and try to remove the unneeded 'resource' usage. Otherwise, SS's are known for their CPU utilization. There're number of alternatives to some stuff SS's are used for. E.g. there's a URL logging mechanism, which is now also implemented in kernel - and is much faster - so you should check out kernel alternatives...

Tim, it can't be VPN, because all VPN solutions (besides SSL) are kernel based - so no user process is involved.
And, just FYI, it has been tested and proven that Intel processors are much better performers on VPN related stuff, then say Sparcs. So Intel is better then Sparc, but SPlat is better then Windows, especially NT...

Daniel
0
 
LVL 28

Author Comment

by:vinnyd79
Comment Utility
Sorry guys,I was away from EE for a while and had forgotten about this question.
If it is not VPN,do you think it could be caused by a rule allowing UserAuth telnet access to one of my servers?The problem occurs during the day when users are logged on,and goes away in the evenings when they log off.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 23

Expert Comment

by:Tim Holman
Comment Utility
Yes - it could well be caused by one of Check Point's user authentication mechanisms.  Can you disable and retest to check this ?
0
 
LVL 28

Author Comment

by:vinnyd79
Comment Utility
Disabling it would stop a bunch of people from being able to do their work but I guess it would be a good test. I'll give it a try tomorrow morning and see what happens.
0
 
LVL 23

Accepted Solution

by:
Tim Holman earned 250 total points
Comment Utility
I mean turn off the telnet authentication mechanism (I assume you mean the Check Point User Auth whereby users have to authenticate with the firewall in order to use telnet ??), so users can access the telnet server direct...
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
ISA Replacement 8 111
check firmware version - draytek vigor 2860 2 35
Watchguard test environment ? 3 54
Do I need a hardware firewall? 12 73
Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now