Kernel Memory usage increases persistently each day on a Security Gateway / Security Group when CGNAT is enabled

Product

Maestro HyperScale Firewall, Scalable Chassis, Security Gateways

Version

R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20

OS

Gaia

Last Modified

2024-10-22

Symptoms

• Kernel Memory usage increases persistently each day on a Security Gateway / Scalable Platform Security Group.

Memory usage can be monitored with these commands:

• On a Security Gateway: fw ctl pstat
• On a Security Group: asg perf

Cause

When Carrier Grade NAT (CGNAT) is enabled (see sk120296), it may cause a memory leak in the kernel table for CoreXL global connections (use the "fw ctl multik gconn -s" command to see this table).

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 79
• Jumbo Hotfix Accumulator for R81.10 starting from Take 158
• Jumbo Hotfix Accumulator for R81 starting from Take 106

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General Status: Approved by TAC Date Created: 2024-03-25 Last Modified: 2024-10-22