Identity sync latency between PEP and PDP daemons

Symptoms

• The "pdp task stat" command shows the PDP and PEP identities sync is progressing slowly.
• Some AD users fail to match the Access Role.
• High CPU utilization is not seen.
• After enabling the pdp debug by executing "pdp debug set all all", pdp debug fails. Also, when running "pdp debug off" to disable the pdp debug, it fails with the error "daemon did not respond or not running".
• The CP commands (such as, cpview, cphaprob, asg, pdp etc.) stuck without outputs after the pdp debug.
• Rebooting the affected security gateway doesn't remediate the issue.
• Restarting the pdpd daemon by executing "kill -9 pidof pdpd" or "fw kill pdpd" can let the CP commands work. However, PDP and PEP identities sync still running slowly.
• There are more than 200 Access Role objects.
• The "$FWDIR/log/pepd.elg.x" log file shows the below example snippet:

fwasync_conn_get: get max buffer size (268435456) . fwasync_conn_get: requested length too big (497573567). Closing the connection.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R82 starting from Take 10
• Jumbo Hotfix Accumulator for R81.20 starting from Take 96
• Jumbo Hotfix Accumulator for R81.10 starting from Take 173

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

Quick remediation: Reduce the Role Access object amount to less than 100.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General

Status: Approved by TAC

Date Created: 2024-08-29

Last Modified: 2025-02-23