fwd process consistently 99% utilized when system processing normal

[BarryStiefel]

fwd process consistently 99% utilized when system processing normal

What's happening and how can I fix it?





Answer fwd may show 99% utilization when an object that duplicates one of the firewalls interfaces is duplicated. The firewall isn't actually being hit with more than usual traffic, but the fwd process is sending the same log information over and over.



The code in most cases reads the objects information from top to bottom, and when the firewall is looking for one of its own IPs and encounters a host object with its IP but isn't labeled as a firewall problems can occur. As a proof of this causing the problem, move the duplicate object in the firewall module's $FWDIR/database/objects.C to a position underneath the firewall object. Then, stop and start just the fwd process, if it no longer spikes to 99% cpu and is behaving normally, voila. You'll then need to update your objects on the management station, and install the new policy.



-- RobertGraham - 06 Feb 2004

FAQForm FAQs.Class: TroubleshootingFAQs FAQs.OS: FAQs.Version:

[omahrez]

Hi,
I am experiencing the same problem...
do you think if an object hidden behind the firewall's interface IP address, could cause this kind of issue ?

thanks.

omahrez