Dos attack cause high cpu usage even with dos protection enable on NGAF 5800
  

visiniaga Lv1Posted Mar-11-2026 22:47

We have experiencing problem with NGAF 5800
These issues are severely impacting our production environment.

1. Low Load (180 kpps / ~80 Mbps): Firewall went down for ±2 minutes after less than 30 seconds of attack.

2. Medium Load (350 kpps / ~150 Mbps): Total firewall service paralysis.

3. High Load (600–800 kpps / ~250 Mbps): Unit lasted only ±5 seconds before Request Timeout (RTO).

How to resolve this one, we got suggested to upgrade the hardware?

Why dos protection enable still causing high cpu resource?

In the device we have full protection with IPS, Firewall, SSL Decryption WAF.
Muhammad Abid Lv2Posted Mar-12-2026 15:28
  
Your NGAF 5800 is overloaded because running full protection (IPS, Firewall, SSL Decryption, WAF, DOS protection) consumes a lot of CPU, especially under even moderate attack traffic.

DOS protection causing high CPU is expected—it inspects every packet, which is CPU-intensive.

Firewall downtime / RTO happens because the device hits its packet-per-second and session limits.

Resolution (short):

Hardware upgrade to a higher-capacity NGAF or HA cluster is the proper long-term solution.

Temporary mitigation:

Tune DOS thresholds and IPS policies.
Limit SSL decryption/WAF on non-critical traffic.
Apply connection rate limits to reduce attack impact.

Without reducing load or upgrading, the 5800 cannot sustain full protection under high PPS attacks.


Damai_Group Lv2Posted Mar-21-2026 20:06
  
Before upgrading, follow these steps to identify the specific bottleneck:

1. Temporarily disable SSL Decryption
Go to Policies > Decryption and disable the policy for a short test. If the device suddenly survives the attack, SSL Decryption is the culprit. The NGAF 5800 may lack the hardware acceleration (AES-NI) needed to handle decryption at line rate.

2. Review DoS Protection thresholds
In Policies > Network Security > Anti-Dos/DDos, ensure your thresholds aren't set too high. If the "flood" threshold is set to 200 kpps, and you are only hitting 180 kpps, the protection won't activate until the device is already struggling. Lower the SYN flood and UDP flood thresholds aggressively.

3. Check CPU resources
Navigate to System > Performance. Confirm if CPU % is hitting 100% during the attack. If Memory is full, it's a different issue, but CPU exhaustion is most likely.

4. Update Firmware
Ensure you are on the latest firmware version. Sangfor often releases patches to optimize how the IPS/DoS engines handle high packet rates.

If you complete the steps above and the device still crashes, a hardware upgrade is the correct solution, but only if you choose a model with AES-NI hardware acceleration specifically designed for SSL inspection.

Based on your load tests, the current unit is failing far below its rated capacity because the feature set is too heavy for its processor. Moving to a higher-tier model (like the 6300 series) that handles SSL Decryption in dedicated hardware will resolve the crashes.

Summary: You are asking the device to do "brain surgery" (SSL Decryption + IPS) on every packet of a "stampede" (DoS attack). To fix this, either stop the surgery (disable Decryption) or build a bigger hospital (upgrade hardware).