> Source: [sk103422](https://support.checkpoint.com/results/sk/sk103422) # sk103422 - Resource Advisor (RAD) does not reuse connections (opens new connection for each request) | Property | Value | |----------|-------| | Solution ID | sk103422 | | Date Created | 2015-01-06 | | Last Modified | 2021-02-23 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | ## Symptoms - * Random issues with HTTP / HTTPS traffic through a Security Gateway with enabled URL Filtering blade and/or Application Control blade. * Traffic capture on the Security Gateway shows that the Resource Advisor (RAD) does not send more than 1 session per connection. * SmartView Tracker might show multiple alert logs "`Internal System Error occurred`" for HTTP / HTTPS traffic (as described in [sk64162](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk64162)). * Output of the *netstat* command on the Security Gateway shows many connections on port 80 opened to Akamai server: ``` [Expert@FW:0]# netstat -anp | grep ':80' tcp 0 0 x.y.z.w:n a.b.c.d:80 TIME_WAIT tcp 0 0 x.y.z.w:n a.b.c.d:80 TIME_WAIT tcp 0 0 x.y.z.w:n a.b.c.d:80 TIME_WAIT ... tcp 0 0 x.y.z.w:n a.b.c.d:80 TIME_WAIT ``` where: `x.y.z.w:n` is the Security Gateway's IP address and Source Port from which the connection was opened `a.b.c.d:80` is the current Destination IP address of Akamai server - Check Point updates. * Output of *top* / *ps auxw* commands shows that the RAD daemon consumes CPU at a high level, especially when the traffic volume is high. * The issue is more likely to occur on VSX Gateways. ## Cause 1. (Issue 01400769) Resource Advisor (RAD) daemon does not reuse connections (opens new connection for each request). 2. (Issue 01861543) Resource Advisor (RAD) daemon sends one categorization query to Check Point cloud in one connection. As a result, the rate of the connections' creation/deletion can be low, which in turn impacts performance. ## Solution **Code was improved:** * The RAD daemon will send more than 1 session (up to 50) per connection. * To increase the speed of connections creation/deletion, it is now possible to configure the number of categorization queries sent by RAD daemon to Check Point cloud in one connection. **Note:** This solution is no longer relevant for the following versions, as of the below Takes of the Jumbo Hotfix Accumulator, RAD process scalability has been improved, and will always reuse connections regardless of the value of "*RAD_QUERIES_NUMBER_PER_CONNECTION*" configured. * **[Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) - since *Take_127*** * [**R80.20SP Jumbo Hotfix Accumulator**](https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk155832) - ***since Take 273*** * **[Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) - since *Take_107*** [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case. **Hotfix installation and configuration instructions for Gaia/SecurePlatform/IPSO OS:** 1. Hotfix has to be installed on ***Security Gateway***. Notes: * In cluster environment, this procedure must be performed on *all* members of the cluster. * The fix is already included in (skip to *Step 2* ): * [Check Point R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111841) * [Jumbo Hotfix Accumulator for R77.30](http://supportcontent.checkpoint.com/solutions?id=sk106162) - since *Take_95* * [Jumbo Hotfix Accumulator for R76SP.50](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117633) - since *Take_16* Procedure: 1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). 2. Unpack and install the hotfix package: ***\[Expert@HostName\]# cd /some_path_to_fix/*** ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\.tgz*** ***\[Expert@HostName\]# ./fw1_wrapper_\*** **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. 3. Do NOT reboot yet. Proceed to the next Step 2 2. Configure the number of RAD queries per connection to a value between 20 and 40. **Note:** If no value is configured, then the default value of 1 query per connection will be used. ***\[Expert@HostName:0\]# ckp_regedit -a SOFTWARE\\\\CheckPoint\\\\FW1\\\\$(cpprod_util CPPROD_GetCurrentVersion FW1) RAD_QUERIES_NUMBER_PER_CONNECTION \*** *Example* : `[Expert@HostName:0]# ckp_regedit -a SOFTWARE\\CheckPoint\\FW1\\$(cpprod_util CPPROD_GetCurrentVersion FW1) RAD_QUERIES_NUMBER_PER_CONNECTION 30` **Important Note:** On ***40000 / 60000*** chassis, the above command has to be executed on *each* SGM. Do ***NOT*** use any of the global methods (`gexec` / `g_all`). 3. Verify that the new attribute was added to the registry: ***\[Expert@HostName:0\]# grep --color -C 1 RAD_QUERIES_NUMBER_PER_CONNECTION $CPDIR/registry/HKLM_registry.data*** 4. Reboot the machine. **Important Note:** On ***40000 / 60000*** chassis, it is necessary to change the registry value on *all* SGMs before rebooting any SGMs. **Hotfix uninstall instructions for Gaia/SecurePlatform/IPSO OS:** 1. Uninstall the hotfix: Notes: * In cluster environment, this procedure must be performed on *all* members of the cluster. * This procedure does *not* apply to: * [Jumbo Hotfix Accumulator for R77.30](http://supportcontent.checkpoint.com/solutions?id=sk106162) - since *Take_95* * [Jumbo Hotfix Accumulator for R76SP.50](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117633) - since *Take_16* For these versions, skip to Step 2. Procedure: 1. ***\[Expert@HostName:0\]# cd /opt/CPsuite-R77/*** 2. ***\[Expert@HostName:0\]# ./uninstall_fw1_wrapper_\*** 3. Do NOT reboot yet. Proceed to Step 2. 2. Remove the configuration of RAD queries per connection from the Check Point registry: ***\[Expert@HostName:0\]# ckp_regedit -d SOFTWARE\\\\CheckPoint\\\\FW1\\\\$(cpprod_util CPPROD_GetCurrentVersion FW1) RAD_QUERIES_NUMBER_PER_CONNECTION*** **Important Note:** On ***40000 / 60000*** chassis, the above command has to be executed on *each* SGM. Do ***NOT*** use any of the global methods (`gexec` / `g_all`). 3. Verify that the attribute was removed from the registry: ***\[Expert@HostName:0\]# grep --color -C 1 RAD_QUERIES_NUMBER_PER_CONNECTION $CPDIR/registry/HKLM_registry.data*** 4. Reboot the machine. **Related solutions:** * [sk64162 - "Internal System Error occurred" log in SmartView Tracker while trying to categorize resource](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk64162) * [sk109897 - How use "Categorize HTTPS websites" configuration with non-RFC compliant HTTPS traffic](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109897) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content