SecureClient / dtps / SC.NDB

[brendon62]

My R60 module had CPU running at nearly 100% - worked out it was the dtpsd process. I followed the Nokia article 1350658 and determined I had an unlicensed OS X SecureClient connection:

dtps lic
SecureClient Policy Server license summary
------------------------------------------
| OS | Total Licenses | Used Licenses | Free Licenses |
| Windows | 100 | 8 | 92 |
| MAC | 0 | 1 | 0 |

I then cpstop, renamed $FWDIR/database/SC.NDB then rebooted the module. The CPU now runs at around 5% so basically problem solved. But now:

dtps lic
SecureClient Policy Server license summary
------------------------------------------
Failed to open /opt/CPsuite-R60/fw1/database/SC, file does not exist

which makes sense because SC.NDB no longer exists but I am able to connect with SecureClient successfully.

The Nokia article says I need to install the missing SecureClient license on the Mgt Server and push the policy to the module. However, I don't have an OS X SecureClient license so what I need or want to do is reset the OS X SecureClient license count on the module (basically start again) and then ensure no one connects with OS X SecureClient again.

Does anyone have any idea how I do this?

Many thanks

[mcnallym]

Having an OSX client connect without a license shouldn't make a gateway go 100% on the CPU.

I had a customer I support have a MAC user connect and other then getting a log entry it made no difference.

I think you just need to add the license and push and you will be fine.

[brendon62]

The Nokia article states:
"Windows or Mac OS SecureClients cause dtpsd to consume up to 100% CPU on NGX (R60) firewall module. If this problem is seen in the base build of NGX (R60) and builds patched with HFA_01 or HFA_02 it is caused by a license issue. Installing a SecureClient user license or an evaluation license on the management station will resolve the problem."

We already have 100 SecureClient licenses attached to the Mgt Station and I have pushed the policy to the module but I still get the dtps lic - file not exists error.