> Source: [sk166700](https://support.checkpoint.com/results/sk/sk166700)

# sk166700 - High CPU after upgrade from R77.x to R80.x when running only Firewall and Monitoring blades

| Property | Value |
|----------|-------|
| Solution ID | sk166700 |
| Date Created | 2020-05-06 |
| Last Modified | 2022-08-29 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * High CPU (SI%) seen after an upgrade to R80.x (that was not present in R77.x).
* A higher percentage of traffic is hitting PXL (SecureXL medium path), although IPS is not enabled.
* All traffic on port 443 is not accelerated.
* FastAccel on the traffic on port 443 resolves the issue.

## Cause

When only **Firewall** and **Monitoring** blades are enabled, the TLS parser (which parses the TLS content) is enabled by default. This forces all SSL traffic to flow over the SecureXL Medium Path. Traffic going through PXL causes high CPU on *fw_worker* processes. This high CPU introduces latency and traffic impact, depending on how much traffic over port 443 is seen on the Gateway / Cluster.

## Solution

This problem was fixed. The fix checks the blades enabled on the gateway, and only enables TLS Parser functionality if it is needed. The fix is included in:

* [Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715)
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 78
* [Jumbo_Hotfix_Accumulator_for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 219
* [Jumbo_Hotfix_Accumulator_for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 183

<br />

NOTE: If you are running a fixed version from the list above, and in the past have followed the instructions below to set tls_parser_enable=0, you should undo the change, and re-enable TLS Parser. Note that both IPS and APPI have many signatures that depend on TLS Parser, so by disabling it, you are silently disabling such protections.   

<br />

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

<br />

Also the following workaround is available:  

To disable the TLS Parser:

1. Check the current value of the kernel parameter:

   `[Expert@HostName]# fw ctl get int tls_parser_enable`

   **Note:** Value should be "1" (confirmed on a session)
2. Edit the *$FWDIR/boot/modules/fwkern.conf* file in Vi editor:

   **Note:** Create the file if it does not exist

   `[Expert@HostName]# vi $FWDIR/boot/modules/fwkern.conf`

   Add the following line (spaces are not allowed):

   `tls_parser_enable=0`
3. Save the changes and exit from Vi editor.

4. Check the contents of the *$FWDIR/boot/modules/fwkern.conf* file:

   `[Expert@HostName]# cat $FWDIR/boot/modules/fwkern.conf`
5. Reboot the gateway / Cluster members.

**Note:** The TLS parser is responsible for forwarding SSL/TLS connections to the other blades after Inspection, for example; to IPS, Application Control \& URL Filtering, Threat Prevention, etc.  

**Note:** If you installed the hotfix after applying the workaround, remember to revert the change, meaning to remove the tls_parser_enable=0 line from *$FWDIR/boot/modules/fwkern.conf* .  

While only **Firewall** and **Monitoring** blades are enabled - there will be no change in security or functionality, as neither the Firewall nor the Monitoring blade, uses the tls_parser.

**Note:** The relevant fix allows TLS Parser to turn itself off automatically when no blade or feature requires it on a per-connection basis. It doesn't change the value of the global "tls_parser_enable" off switch.  
Basically, the fix allows the "tls_parser_enable" switch to remain at "1" (enabled), as it should be, without TLS parser actually being active when it's not necessary on a per-connection basis.  

To check if TLS Parser is active on a connection use the "#fw_mux all" command.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content