The cpu % of our vpn firewall started to climb from last week it's constantly hitting 85-87% during peak times
I raised a case with cisco they found that "cert-api" was hogging the cpu and hence they asked be add a command.
The exact explanation given by them:
"By default the ASA processes crypto packets in software. The high CPU of being caused by the CERT API process. That is being caused by two things, the ASA platform you are on and DH group 5. So it is the combination of those two things that is causing the CERT API process to go high and thus causing the higher than normal CPU."
Because in the firewall that we were using (5520) the dh keying is done in the software not seems and they wanted to move it to hardware
So they suggested nthe following command:
crypto large-cert-acceleration enable
That's all fine but when I check if we are running dh5 with the command sh ssl
I can't see any dh-groups for ssl connections.
And I also check with the command sh vpn-sessiondb detail l2l if any vpn tunnels is running dh 5 group but nope.
Does this mean ssl doesn't use dh ?.
And also how does anyconnect select the ciphers then ?.
Which version are you running?