> Source: [sk183814](https://support.checkpoint.com/results/sk/sk183814)

# sk183814 - High CPU Utilization on Single Core Due to Excessive VPN Probing and SEP Correction in ClusterXL HA Mode

| Property | Value |
|----------|-------|
| Solution ID | sk183814 |
| Date Created | 2025-08-20 |
| Last Modified | 2026-07-23 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20 |
| OS | Gaia |
| Platform | VMWare ESX |

## Symptoms

- * Multiple VPN peer public Internet Protocol (IP) addresses in DEAD state in the `crypt_resolver_db` table, with continuous Remote Desktop Protocol (RDP) probing and no response from secondary addresses.
* Issue persists after removing *DEAD* state peers from VPN community and after various kernel parameter changes.

## Cause

The issue is triggered by excessive CPU load on a single core of the Security Gateway. This load results from continuous processing of VPN probing traffic (specifically on RDP port 259) and Internet Key Exchange (IKE) packets.  

This behavior occurs when multiple VPN peers become unreachable and remain in the *DEAD* state within the link selection redundancy configuration.   

The Security Gateway repeatedly sends probing requests and updates kernel tables for these DEAD peers, which leads to CPU saturation.  

Additionally, the Secure External Processing (SEP) correction mechanism for IKE packets was unnecessarily enabled in ClusterXL High Availability (HA) mode. This further increases CPU usage and contributes to the instability.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 103
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 158

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content