> Source: [sk145652](https://support.checkpoint.com/results/sk/sk145652)

# sk145652 - When a VLAN is not configured on the Scalable Chassis 40000 / 60000, a large amount of irrelevant traffic is sent to the SGMs

| Property | Value |
|----------|-------|
| Solution ID | sk145652 |
| Date Created | 2019-01-28 |
| Last Modified | 2021-05-06 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R81 (EOS) |
| OS | Gaia |
| Platform | 41000 (EOL), 44000, 64000 |

## Symptoms

- In VLAN interfaces that are not configured on the 40000 / 60000 chassis, a large amount of irrelevant packets is sent to the SGMs.

As a result, the following symptoms can be observed:

* SecureXL or the `softirqd` process consume CPU at 100%.
* Traffic is dropped.

Despite the above, the `asg_perf` command shows that normal traffic is passing.

## Cause

In cases of internal network problems, like a loop in the connections between switches, this can result in a flood of packets into the NIC.

The NIC driver in 40000 / 60000 Chassis does not drop traffic with invalid (or an un-configured) VLAN tags because it runs in promiscuous mode. The operating system responsible for processing such packets. As a result, the SGMs are affected when traffic rate is very high.

Packets are sent to VMAC addresses of each SGM for each of its pseudo interfaces (not the SSM's interface MAC address). The real interface belongs to the SSM. The packets are passed to the SGMs through the two BPEth interfaces. The promiscuous mode is enabled on the two BPEth interfaces to allow the traffic pass from the SSMs to the SGMs. As a result, packets with invalid VLAN tags also pass through the BPEth interfaces, only to be dropped by the OS.

Appliances other than 40000 / 60000 Chassis reject packets with invalid (or an un-configured) VLAN tags at the level of the NIC driver and NIC hardware.

## Solution

This problem was fixed. The fix is included in:

* **[R80.20SP Jumbo HFA - Take 210](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk155832)**
* **[R76SP.50 Jumbo HFA - Take 159](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117633)**

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue for other versions.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

### Description of the fix:

A new BFM infrastructure that collects BFM statistics and displays them per pseudo-interface of each SGM was implemented.

The collected statistics are:

* A list of VLAN interfaces that are not configured in the Chassis.
* Received (RX) packets for incoming traffic (per pseudo interface):
  * RX packets that are verified as multicast.
  * RX packets that are verified as broadcast.
* Received (RX) total bytes.

The information is collected in this directory:

`/proc/bfm/pseudo-interfaces/<Name of Interface>/`

### Working with the BFM statistics

Syntax (in the Expert mode):

`bfm -h`

`bfm vlan_stats -i <Name of Pseudo Interface> -s <{enable | disable | reset}>`

Options:

* `-h` = prints the built-in help usage

* `-i` = Specifies the name of the pseudo interface

* `-s` = Specifies the action for the BFM statistics

The BFM statistics feature is disabled by default. To activate it, use the new utility that fetches all input from all SGMs and shows it per system:

**`asg_vlan_verifier`**

This utility shows the number of invalid (un-configured) VLAN tags for each pseudo-interface in the chassis and the received (RX) packet rate. This utility collects the BFM statistics for 3 seconds and then stops.

**Note** : This utility is now part of the "`asg diag`" command.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content