Valuable insights and practical suggestions on how to mitigate and prevent high CPU utilization during intensive network scans. This comprehensive guide offers expert recommendations to optimize your network performance, ensuring a smooth and efficient scanning process. Implementing these proactive suggestions will help you enhance system stability and minimize disruptions while conducting thorough network scans.

• Log Messages:
  • Users have reported encountering log messages similar to [ Oct 19 01:18:58 srx-1 PERF_MON: %USER-2-RTPERF_CPU_THRESHOLD_EXCEEDED: FPC 0 PIC 0 CPU utilization exceeds threshold, current value = 99 ] during the network scan activity.
• Service Disruption:
  • Network scans are associated with a disruption in certain services, particularly affecting Internet connectivity and potentially causing intermittent outages. Users may experience a degradation in service performance during the scan activity.
• Slow CLI (Command Line Interface):
  • The network's Command Line Interface responsiveness is notably slow or delayed, making it challenging for administrators to execute commands efficiently.

• Optimize Security Policies Logging:
  • To reduce processing overhead, avoid excessive logging, especially with "log at session close" and "log at session initiation" actions in security policies. Logging too much traffic, especially from scanners, can strain system resources. Limit logging to essential events and selectively enable logging for critical policies.
  • >show security policies
• Implement Firewall Filters:
  • Leverage firewall filters to prevent undesired traffic, especially from scanners, from reaching security policies. Firewall filters enable you to define rules for early packet filtering, reducing the load on subsequent security policies.
• Evaluate Hairpin Routes Impact:
  • Assess the impact of hairpin routes on traffic processing. Hairpin routes, especially for scanner-generated traffic, can result in additional processing and affect performance. Review your network topology and routing configurations to minimize the use of hairpin routes where possible.

Firewall Filters Overview

SRX Getting Started - Configure Traffic Logging (Security Policy Logs) for SRX Branch Devices