Dos attack cause high cpu usage even with dos protection enable on NGAF 5800
  

visiniaga Lv1Posted Mar-11-2026 22:47

We have experiencing problem with NGAF 5800
These issues are severely impacting our production environment.

1. Low Load (180 kpps / ~80 Mbps): Firewall went down for ±2 minutes after less than 30 seconds of attack.

2. Medium Load (350 kpps / ~150 Mbps): Total firewall service paralysis.

3. High Load (600–800 kpps / ~250 Mbps): Unit lasted only ±5 seconds before Request Timeout (RTO).

How to resolve this one, we got suggested to upgrade the hardware?

Why dos protection enable still causing high cpu resource?

In the device we have full protection with IPS, Firewall, SSL Decryption WAF.
Muhammad Abid Lv2Posted Mar-12-2026 15:28
  
Your NGAF 5800 is overloaded because running full protection (IPS, Firewall, SSL Decryption, WAF, DOS protection) consumes a lot of CPU, especially under even moderate attack traffic.

DOS protection causing high CPU is expected—it inspects every packet, which is CPU-intensive.

Firewall downtime / RTO happens because the device hits its packet-per-second and session limits.

Resolution (short):

Hardware upgrade to a higher-capacity NGAF or HA cluster is the proper long-term solution.

Temporary mitigation:

Tune DOS thresholds and IPS policies.
Limit SSL decryption/WAF on non-critical traffic.
Apply connection rate limits to reduce attack impact.

Without reducing load or upgrading, the 5800 cannot sustain full protection under high PPS attacks.