Technical Tip: FortiGate RADVD Daemon Utilizing High CPU
| Description | This article describes the possible reasons for high CPU usage due to the RADVD process and also provides mitigation steps |
| Scope | FortiGate. |
| Solution | The RADVD process is used in IPv6 communication by the FortiGate to handle ICMPv6 router advertisements and auto-configuration.
One possible reason this process can stress CPU utilization is the firewall receiving an excessive number of ICMPv6 router advertisement messages, which can happen due to a loop in the network or a device(s) is flooding the firewall with these messages. Even if IPv6 is disabled on the firewall, network devices can still send advertisement messages to the FortiGate.
Run the following commands to verify the CPU utilization and check the RADVD process.
diagnose sys top 2 50 3
get system performance status
CPU states: 20% user 9% system 0% nice 44% idle 0% iowait 0% irq 27% softirq
Run the following commands to verify if any ICMPv6 packets are received by the firewall.
diagnose sniffer packet any 'none' 4 0 l
2025-04-22 15:26:41.775107 dmz in fe80::96ff:3cff:fe8f:821c -> ff02::1: icmp6: router advertisement
The above messages are received from the internal network and are overwhelming the firewall, causing RADVD to consume CPU cycles processing these advertisements, even though IPv6 is disabled on the firewall.
To further check the MAC address of the device(s) sending router advertisement, a sniffer can be started from the GUI under Network -> Diagnostics.
In this case, FortiGate is not the root cause of the issue; the problem rather lies within the Layer 2 network.
If no loop is identified in the network and no excessive IPv6 advertisements are seen on the firewall, but RADVD still consumes high CPU, collect the following information.
diagnose sys top 2 50 3 get system performance status diagnose sys process pidof <radvd> diagnose sys process pstack <pidof radvd> diagnose sys process trace <pidof radvd> diagnose sys process dump <pidof radvd> diagnose debug crashlog read execute tac report
Collect the debugs mentioned in this article: Technical Tip: Debugs for troubleshooting high CPU issues.
Related article: |
