Technical Tip: 'fnbamd' daemon consumes high CPU and crashes

Description

This article describes an issue where the fnbamd daemon intermittently crashes and subsequently consumes excessive CPU resources, resulting in unresponsive authentication services and failed certificate verification processes. The problem is reported after upgrading to FortiOS v7.4.9, v7.4.10, v7.4.11, and v7.6.4.

Scope

FortiOS v7.4.9, v7.4.10, v7.4.11, and v7.6.4.

Solution

The symptom is that the 'fnbamd' process crashes intermittently in the crash log with Signal 11 (Segmentation fault).
The command to see the FortiGate crash log is 'diagnose debug crashlog read':

"...
2066: 2026-02-05 09:34:05 <07757> firmware FortiGate-200F v7.4.9,build2829b2829,250924 (GA.M) (Release)
2067: 2026-02-05 09:34:05 <07757> application fnbamd
2068: 2026-02-05 09:34:05 <07757> *** signal 11 (Segmentation fault) received ***
..."

Following the crash, fnbamd exhibits abnormally high CPU utilization:

"... 
Run Time: 3 days, 4 hours and 32 minutes
13U, 0N, 0S, 87I, 0WA, 0HI, 0SI, 0ST; 7587T, 4210F
fnbamd 7973 R 99.2 0.2 6 
bcm.user 130 S < 3.5 0.2 7
ipsengine 455 S < 0.9 1.8 7
ipsengine 458 S < 0.7 1.8 5
ipsengine 460 S < 0.7 1.8 2
ipsengine 461 S < 0.7 1.8 6
miglogd 340 S 0.5 0.4 0
urlfilter 398 S < 0.5 0.3 5
ipsengine 459 S < 0.3 1.8 0 
..."

As a consequence, remote user authentication (LDAP, RADIUS, FortiToken, etc.) as well as x.509 certificate verification is impacted.

The workaround is as follows:

• Installing the correct CA certificates onto the local system helps prevent this issue from occurring. 

• Restart the fnbamd process using the following command:

fnsysctl killall fnbamd

Note: The 'fnsysctl' command requires Super Admin privileges. Otherwise, the FortiGate will have an error as explained in Troubleshooting Tip: fnsysctl command returns Unknown action 0.

If the CLI command above does not work, identify the fnbamd process ID by running 'diagnose sys process pidof fnbamd', then restart the process by executing 'diagnose sys kill 11 <pid>'.

Alternatively:

Restart the process using a script based on the increasing pattern. For example, this script will restart the process every 6 hours to prevent the daemon from remaining in a high-CPU state for extended periods.

However, if the process consumes high CPU for more than 6 hours, the process needs to be restarted manually.

config system auto-script
    edit restart_fnbamd
        set interval 21600
        set repeat 0 
        set start auto
        set script 'fnsysctl killall fnbamd'
    next
end

Note: 
(multi-VDOM) if VDOMs are enabled, run the following commands in a global context:

config global     
    config system auto-script 
        edit restart_fnbamd
            set interval 21600
            set repeat 0 
            set start auto
            set script 'fnsysctl killall fnbamd'
        next
    end

The solution is to upgrade FortiOS firmware to v7.4.12, v7.6.7, and v8.0.0.

Note: A consequence of this issue could be experienced as failing to connect to the VPN. Debugs from IPsec VPN show the authentication attempt:

IKEv1:

ike V=root:0:Dialup_0:0: received XAUTH_USER_NAME 'guest' length 5
ike V=root:0:Dialup_0:0: received XAUTH_USER_PASSWORD length 6
ike V=root:0:Dialup_0: XAUTH user "guest"
ike V=root:0:Dialup: auth group Guest-group
ike V=root:0:Dialup_0: XAUTH 8882150748161 pending

IKEv2:

ike V=root:0:VPN-Clientes:3240028: responder received EAP msg
ike V=root:0:VPN-Clientes:3240028: send EAP message to FNBAM
ike V=root:0:VPN-Clientes:3240028: initiating EAP authentication
ike V=root:0:VPN-Clientes: EAP user "guest"
ike V=root:0:VPN-Clientes: EAP failed for user "guest"
ike V=root:0:VPN-Clientes: EAP response is empty
ike V=root:0:VPN-Clientes: connection expiring due to EAP failure
ike V=root:0:VPN-Clientes: going to be deleted

However, there is never an authentication reply of FNBAM_SUCCESS or FNBAM_DENIED.