Hello Dev,

Thank you for reaching out to Sophos Community!

You might wants to take a look at the below KBA for the IPS configuration settings:

support.sophos.com/.../KB-000036046

Hi DevK ,

Thank you for reaching out to the community, with the high CPU what is the impact on the production or users browsing the internet ?

Some time firewall getting hang, not accessible internet disconnection 

We haven't apply IPS policy for any rule, still the CPU consumption is going up to 92 % if we will stop IPS and AV service it comes under control.

Hello DevK 

Are you using the firewall with DPI or web proxy mode?

If you are using DPI, I still suggest referring and tunning the parameters suggested in KBA.

We also request you to review the CPU utilization by referring to below KBA and having IPS/AV started.

support.sophos.com/.../KB-000043639

and current active firmware ?

SFOS 20.0.0 GA

Please note: They have more than 1200 user on XG230 firewall model but current session is only 8K

Hi DevK,

Could you share the case ID? If not, I recommend creating one to have this further checked remotely since it is causing freezing and internet disconnection.