Technical Tip: High CPU observed when using session resumption for Dialup IPSec users using IKEv2

Description

This article describes a technical solution to the issue of high CPU usage by the IKED process on FortiGate devices, specifically when IPsec VPN connections are in heavy use. The user may experience high CPU usage on one core of their FortiGate cluster, causing concerns about the stability and performance of their VPN connections.

Scope

FortiGate.

Solution

High CPU is observed on one core by the IKED process.

This issue is triggered when client-resume is enabled, and IPsec over TCP is used, and the FortiGate receives an RST packet.

Execute the command below to verify:

FGT-LDAPS # diagnose sys top 3 5
Run Time:  24 days, 22 hours and 48 minutes
0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 1993T, 320F
          iked      25144      S       99.9    1.7    0
            node     2776      S       0.5     4.8    0
       ipshelper     2779      S <     0.5     3.6    0
             wad     3041      S       0.0     3.5    0
       forticron     2763      S       0.0     3.5    0

To resolve the issue, below are 2 workarounds:

1. Use IPsec over UDP:

config vpn ipsec phase1-interface
     edit <name>
         set ike-version 2
         set transport udp
     next
end

2. Disable client-resume in phase1-interface for dialup IPSec tunnel.

config vpn ipsec phase1-interface
     edit <tunnel-name>
         set client-resume disable
     next
end

Note:
This issue has already been reported under the ID: 1257646 and has been fixed in v7.4.12, v7.6.7 and v8.0.0