Remote Access users unable to connect and high IKED daemon CPU utilization

Product: Endpoint Security - Remote Access VPN
Version: R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20
OS: Gaia
Platform: All
Last Modified: 2023-03-22

Symptoms

• Harmony Connect Remote Access users are unable to connect and this log is printed in SmartConsole:

    Client Encryption: Could not obtain user object. Timeout reached.
    ```
- The IKED daemon CPU utilization is very high.
- The _iked.elg_ file contains these logs for nested groups:

[iked 16552 4071520256]@Hostname[20 Feb  9:45:10][CPLDAPCL] m_currentNestingState 1 m_nextNestingState 1

[iked 16552 4071520256]@Hostname[20 Feb 9:45:10][CPLDAPCL] currentNestingState: 1 ```

• LDAP Servers receive thousands of LDAP requests from the Check Point Remote Access VPN Gateway and have a load higher than usual.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 8
• Jumbo Hotfix Accumulator for R81.10 starting from Take 93
• Jumbo Hotfix Accumulator for R81 starting from Take 82
• Jumbo Hotfix Accumulator for R80.40 starting from Take 196

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect:

• CPinfo file from the Management Server involved in the case.
• CPinfo file from the Security Gateway / each Cluster Member involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.