> Source: [sk175890](https://support.checkpoint.com/results/sk/sk175890)

# sk175890 - SND connection outbound distribution issue when running VPN

| Property | Value |
|----------|-------|
| Solution ID | sk175890 |
| Date Created | 2021-11-11 |
| Last Modified | 2025-09-14 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * When there is a lot of VPN traffic, some SND CPUs may be highly utilized while other SND CPUs are not.
* In CPView, "Advanced \> SecureXL \> Network-per-CPU" shows unequal outbound bps distribution.

## Cause

Each VPN connection is handled by a specific CPU, Secure Network Distributor (SND) allocates the connection to the relevant CPU.  
The distribution of SND is based on the hash function that uses connection tuple, making it not equally distributed in different kinds of Network Topologies and VPN configurations.

## Solution

This problem was fixed. It is now possible to leave the connection on the same CPU, based on the inbound distribution of the Network Interface Card, and it will handle all VPN connections that need to be encrypted.

The fix is included in:

* [Jumbo Hotfix Accumulator for R81.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175186) starting from Take 38
* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 60
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 150
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 241
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 208

<br />

This fix adds a new kernel parameter `cphwd_medium_path_qid_by_cpu_id.`  

**Notes**:

* In versions R82 and higher, this kernel parameter is **enabled** by default.
* In versions R81.20 and lower, this kernel parameter is **disabled** by default.
* We recommend to use this parameter in a scenario were most of the encrypted traffic pass through one tunnel.  
  In a scenario when there is a high number of tunnels with about the same amount of traffic, we recommend to use the parameter *cphwd_medium_path_qid_by_mspi* (Refer to [sk165853](https://support.checkpoint.com/results/sk/sk165853)).

**To verify the value of the parameter** :  
`cphwd_medium_path_qid_by_cpu_id` with:   
`# fw ctl get int cphwd_medium_path_qid_by_cpu_id`  

`value`  
`Feature status`  

`cphwd_medium_path_qid_by_cpu_id = 0 `  
When the feature is disabled, SNDs may not be balanced.  

`cphwd_medium_path_qid_by_cpu_id = 1`  
When the feature is enabled, there is a better balance between SNDs.  

<br />

**To activate the feature** **on the fly** , run:   
`[Expert@HostName:0]# fw ctl set int cphwd_medium_path_qid_by_cpu_id 1`  

<br />

**To disable the parameter** **on the fly** :  
`[Expert@HostName:0]# fw ctl set int cphwd_medium_path_qid_by_cpu_id 0`  

<br />

**Note** : Changing the value of `cphwd_medium_path_qid_by_cpu_id` on the fly may cause connectivity issues. Refer to [sk26202](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk26202) to set the parameter permanently.  

**Note:** To fully resolve the issue and align the behavior with the new default for R82, it is recommended to enable the parameter documented in [sk165853](https://support.checkpoint.com/results/sk/sk165853).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content