Hot!High memory utilization on Fortigate 80E

Author
Tindrli
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/06/08 01:27:37
  • Status: offline
2019/05/13 01:27:25 (permalink)
0

High memory utilization on Fortigate 80E

Could someone share his/her data on memory utilization on Fortigate 80E with SSL inspection, AV, IPS enabled?
Is it possible to list which IPS signature is using the most resources?
I'm using FortiOS 6.0.4 with two 80E in cluster (A/P). My memory usage is 80-85% and quite often my boxes go in conserve mode. I did all the suggested memory performance tweaking and I also created script for restarting IPS engine. When i restart IPS engine memory drops to 60-ish %. I'm wondering if this is normal behavior for this box with all the profiles enabled and 50-60 users on the network.
#1

4 Replies Related Threads

    ede_pfau
    Expert Member
    • Total Posts : 5927
    • Scores: 466
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: High memory utilization on Fortigate 80E 2019/05/13 06:02:11 (permalink)
    0
    There is no way to list the most-used IPS signatures.
     
    But, it's not so much the signatures in use but the signatures the FGT has to check...if you enable all available signatures the FGT will really have to work a lot. And IPS is memory-intensive.
     
    My advice:
    create UTM profiles for different user / host groups (clients, servers, guest WiFi). Select IPS signatures according to the threats you expect for each group. For instance, you will not check Linux signatures if all of your hosts run Windows...

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #2
    Tindrli
    New Member
    • Total Posts : 11
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/08 01:27:37
    • Status: offline
    Re: High memory utilization on Fortigate 80E 2019/05/14 06:39:14 (permalink)
    0
    That's what I thought, I already selected Windows OS and changed severity to med, high, critical.
    i never experienced this myself, I only know what client tells me. What should i monitor in order for slave unit to take over when primary fails in this case? I have a cluster of two Fortigates here in A/P mode.
    #3
    Ashu
    Gold Member
    • Total Posts : 146
    • Scores: 12
    • Reward points: 0
    • Joined: 2015/04/17 04:33:45
    • Location: Doha,Qatar
    • Status: offline
    Re: High memory utilization on Fortigate 80E 2019/05/14 06:51:21 (permalink)
    0
    You can only do the automatic failover by setting the monitor inetrface not by service or memory .
    May b other experts can comment on this .

    Ashu 
     
    #4
    Tindrli
    New Member
    • Total Posts : 11
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/08 01:27:37
    • Status: offline
    Re: High memory utilization on Fortigate 80E 2019/05/14 07:02:25 (permalink)
    0
    I know that part, but since I never experienced this myself I was wondering if inside interface becomes unresponsive for example. If yes, maybe I could setup a SLA tracker to it. This is very difficult to test in the lab since I can't make that much traffic in order for firewall to go in conserve mode.
    #5
    Jump to:
    © 2019 APG vNext Commercial Version 5.5