# High CPU Utilization on Single Core Due to Excessive VPN Probing and SEP Correction in ClusterXL HA Mode

**Product**: Site-to-Site VPN  
**Version**: R81.20, R82  
**OS**: Gaia  
**Platform**: VMWare ESX  
**Last Modified**: 2026-07-23

## Symptoms

- Multiple VPN peer public Internet Protocol (IP) addresses in DEAD state in the `crypt_resolver_db` table, with continuous Remote Desktop Protocol (RDP) probing and no response from secondary addresses.
- Issue persists after removing _DEAD_ state peers from VPN community and after various kernel parameter changes.

## Cause

The issue is triggered by excessive CPU load on a single core of the Security Gateway. This load results from continuous processing of VPN probing traffic (specifically on RDP port 259) and Internet Key Exchange (IKE) packets.

This behavior occurs when multiple VPN peers become unreachable and remain in the _DEAD_ state within the link selection redundancy configuration.

The Security Gateway repeatedly sends probing requests and updates kernel tables for these DEAD peers, which leads to CPU saturation.

Additionally, the Secure External Processing (SEP) correction mechanism for IKE packets was unnecessarily enabled in ClusterXL High Availability (HA) mode. This further increases CPU usage and contributes to the instability.

## Solution

This problem was fixed. The fix is included in:

- [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 103
- [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 158

If you choose not to upgrade, Check Point can supply a **Hotfix**. [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**

Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

#### NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

## Article Properties

**Access Level**: General  
**Status**: Approved by TAC  
**Date Created**: 2025-08-20  
**Last Modified**: 2026-07-23