> Source: [sk181483](https://support.checkpoint.com/results/sk/sk181483)

# sk181483 - Traffic flow through an interface is slower when it is assigned to the MDPS Management Plane (mplane)

| Property | Value |
|----------|-------|
| Solution ID | sk181483 |
| Date Created | 2023-09-18 |
| Last Modified | 2023-10-02 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |
| Platform | VMWare ESX |

## Symptoms

- * Traffic flow through an interface is significantly slower when it is assigned to the MDPS Management Plane (mplane). The issue does not occur when the interface is assigned to the MDPS Data Plane (dplane).

* There is no correlated increase in RX/TX errors/drops on the interface when it is in dplane/mplane.

* The "`cpstop`" command resolves the issue, but the issue occurs again after you run the "`cpstart`" command.

* General packet captures (`# "cppcap -I lo"`) taken from the two scenarios (when the interface is assigned to mplane and dplane) shows that the interface receives fewer packets while on mplane, and therefore there are fewer replies.

* The "`fw monitor -p all`" packet capture does not show latency between the chains.

* The routing to and from the management interface while on the dplane is the same as the routing to and from the mplane.

* The "`ethtool -k INTERFACE_NAME | grep large-receive-offload`" command shows that the LRO feature of the interface driver is ON.

## Cause

The driver's Large Receive Offload (LRO) feature causes this behavior.  

LRO allows a network interface controller to combine incoming TCP/IP packets that belong to the same connection into one large receive segment before passing it to the Operating System. This accelerates the overall performance and speed of the connections.

<br />

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

*** ** * ** ***

As a **workaround**, do the procedure below, which disables LRO on the problematic interface. The procedure has an effect only on the problematic interface and not on each interface sharing the driver.

1. Verify the interface LRO feature is ON:  
   `# ethtool -k `**<interface_name>**`| grep large-receive-offload`  

   Replace the `<interface_name>` section with the applicable one. In our example:  
   `# ethtool -k `**Mgmt**`| grep large-receive-offload`  

2. Turn off LRO (this should not cause traffic outage):  
   `# ethtool -K `**<interface_name>**` lro off`  

   Replace the `<interface_name>` section with the applicable one. In our example:  
   `# ethtool -K `**Mgmt**`lro off`  

3. Make sure LRO is OFF:  
   `# ethtool -k `**<interface_name>**` | grep large-receive-offload`  

4. Make the changes permanently:  

   `# cp /etc/rc.d/rc.local /etc/rc.d/rc.local_BAK; sed -i '2i source /etc/profile.d/mdpsenv.sh' /etc/rc.d/rc.local; sed -i '$a \ \nmplane\n/sbin/ethtool -K `**<INTERFACE_NAME>**` lro off\ndplane\n' /etc/rc.d/rc.local`  

   <br />

   Replace the \<INTERFACE_NAME\> with the interface name. In our example the command will look like that:   

   `# cp /etc/rc.d/rc.local /etc/rc.d/rc.local_BAK; sed -i '2i source /etc/profile.d/mdpsenv.sh' /etc/rc.d/rc.local; sed -i '$a \ \nmplane\n/sbin/ethtool -K `**Mgmt**`lro off\ndplane\n' /etc/rc.d/rc.local`  

5. Make sure the issue is resolved. Make sure the changes survive a reboot of the system.  

6. If the issue persists, [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content