High CPU Utilization on Single Core Due to Excessive VPN Probing and SEP Correction in ClusterXL HA Mode

Product: Site-to-Site VPN
Version: R81.20, R82
OS: Gaia
Platform: VMWare ESX
Last Modified: 2026-07-23

Symptoms

• Multiple VPN peer public Internet Protocol (IP) addresses in DEAD state in the crypt_resolver_db table, with continuous Remote Desktop Protocol (RDP) probing and no response from secondary addresses.
• Issue persists after removing DEAD state peers from VPN community and after various kernel parameter changes.

Cause

The issue is triggered by excessive CPU load on a single core of the Security Gateway. This load results from continuous processing of VPN probing traffic (specifically on RDP port 259) and Internet Key Exchange (IKE) packets.

This behavior occurs when multiple VPN peers become unreachable and remain in the DEAD state within the link selection redundancy configuration.

The Security Gateway repeatedly sends probing requests and updates kernel tables for these DEAD peers, which leads to CPU saturation.

Additionally, the Secure External Processing (SEP) correction mechanism for IKE packets was unnecessarily enabled in ClusterXL High Availability (HA) mode. This further increases CPU usage and contributes to the instability.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R82 starting from Take 103
• Jumbo Hotfix Accumulator for R81.20 starting from Take 158

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2025-08-20
Last Modified: 2026-07-23