CloudGuard Controller for VMwaref NSX-T CPU and memory errors

Product: CloudGuard Controller
Version: R81.10 (EOS), R81.20
Last Modified: 2023-11-24

Symptoms

• High CPU utilization of the cloudguard process in the output of the htop command.

• There are Out of Memory errors in the $MDS_FWDIR/log/cloud_proxy.elg file:

  java.lang.OutOfMemoryError: Java heap space

• Connecting to the NSX-T data center from the SmartConsole Data Center menu takes a long time or times out.

• There are Out of Memory errors in the $MDS_FWDIR/log/cloud_proxy.elg file:

  ERROR scanner.nsxt.NsxTDeployment [scanner-NSXT-447276470]: Error while adding ip 0.0.0.0/0 - IP range is too big Not adding

• Unable to view Imported Objects in Smart Console.

Cause

CloudGuard Controller for VMware NSX-T introduces a new feature, enabling the automatic scanning of NSX-T IP ranges within Network Groups.

This feature can cause CPU & RAM usage issues when used in environments with many IP addresses in IP ranges.

The feature is enabled by default on the following releases:

• R81.10 Jumbo HF Take 110 - Take 128
• R81.20 GA - R81.20 Jumbo HF Take 38

The feature does not exist on:

• R81.10 GA - R81.10 Jumbo HF Take 94
• R81.10 Jumbo HF Take 130 and above

Solution

Upgrade to one of the following Jumbo HF takes or newer. On these takes, the feature is disabled by default:

• R81.10 Jumbo HF Take 130 and above
• R81.20 GA - R81.20 Jumbo HF Take 41 and above

If you cannot upgrade to one of these Jumbo HF takes, contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.

For faster resolution and verification, collect these files:

1. CPinfo file from the Management Server involved in the case.
2. CPinfo file from the Security Gateway / each Cluster Member involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2023-11-05
Last Modified: 2023-11-24