High CPU Utilization due to IPS Policy

[Ditter]

Hi to all,

i am posting this in order to have your opinion about it.

Today our users behind the FTD faced timeouts as well as high RTTs.

Digging a little bit i noticed that CPU core 16 (not the other cores)  was continuously steady at 100%. 

After disabling the IPS policy for the outgoing traffic  the timeouts stopped and the RTTs returned to normal.

So i decided to keep  the IPS process only for the incoming traffic. 

How could i identify the offending host or hosts ?  In addition is there any possibility for this to happen due to elephant flows passing through the firewall or probably a huge backup from inside to the Internet?

Any views/opinions are most welcome.

Thanks 

Ditter.

[ckleopa]

Well if this is still causing issues for you I would recommend opening up a TAC case. They can work with you to isolate where most of the CPU resources are going and propose optimizations on the access control rules around this.

[Ditter]

@ckleopa @MHM Cisco World Update: Going one step further and by accepting Cisco IPS Recommendations the rules increased from 584 active rules to 2996 rules (alert:158 and block:2838)