topic This is bug - CSCtl74475. in Network Security

High cpu utiization on IPS module

Colin Higgins — Sun, 10 Mar 2019 13:11:04 GMT

I have two Cisco ASA5540X firewalls with IPS modules configured in a failover pair.

Behind this firewall pair (on the inside) are about 140 hosts that use various web-enabled applications, minimal Internet, some email (maybe 10 hosts), and some light file-sharing/access

My IPS is configured for inline analysis, but I have noticed that the cpu runs 100% all the time (6 cores). Since I don't want any traffic by-passing the IPS, my configuration on the firewall looks like this

access-list ips_traffic extended permit ip any any

access-list ips_traffic extended permit udp any any

class-map ips_class

match access-list ips_traffic

policy-map global_policy

class ips_class

ips inline fail-open

Why is the utilization so high on the IPS? Anything I can do here?

Hi, Although not an expert in

luckymike33 — Mon, 14 Apr 2014 14:20:20 GMT

Hi,

Although not an expert in this particular field I have installed a handful of these and all of them have had a a CPU load of 100%, I was told by our support that the CPU load on an IPS is very inaccurate way of determining load, it is much better to use the inspection processing load.

After further digging I found this - the issue is discussed as part of this bug - CSCtl74475

HTH

Mike

This is bug - CSCtl74475.

Ravi Singh — Wed, 16 Apr 2014 20:45:52 GMT

This is bug - CSCtl74475.