In an HA Active-Passive, an issue may arise when multiple routes are added or removed rapidly and repeatedly. This can cause performance degradation in the zebos_launcher process on the secondary FortiGate. The primary FortiGate is not affected by this.
Run Time: 19 days, 19 hours and 12 minutes
6U, 0N, 4S, 90I, 0WA, 0HI, 0SI, 0ST; 24140T, 14424F
zebos_launcher 30406 R 95.5 1.8 0
bcm.user 2183 S < 8.0 0.5 14
iked 3898 S 3.5 1.0 5
flcfgd 3931 S 1.0 0.2 8
ipsengine 8930 S < 0.5 0.7 10
hasync 3905 S < 0.5 0.3 9
For example:
In an IPsec dial-up HUB and Spoke topology, multiple branches may try to negotiate the same subnet repeatedly, because it is erroneously defined in the phase-2 selectors of the spokes. This may generate multiple additions and removals of the same route. This can be tracked in the IKE debugs.
diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application ike -1
026-06-13 08:56:12.341680 ike V=root:0:VPNTest:61974337: responder creating new child
2026-06-13 08:56:12.341717 ike V=root:0:VPNTest:61974337:396774934: peer proposal:
2026-06-13 08:56:12.341729 ike V=root:0:VPNTest:61974337:396774934: TSi_0 0:192.168.10.0-192.168.10.255:0
<Output truncated in this example>
2026-06-13 08:56:12.344273 ike V=root:0:VPNTest:396774921: moving route 10.130.145.0/255.255.255.0 oif VPNTest(72) metric 210 priority 1 to 0:VPNTest:396774934
2026-06-13 08:56:12.472735 ike V=root:0:VPNTest:396774934: moving route 10.130.145.0/255.255.255.0 oif VPNTest(72) metric 210 priority 1 to 0:VPNTest:396774949
2026-06-13 08:56:12.479007 ike V=root:0:VPNTest:396774949: moving route 10.130.145.0/255.255.255.0 oif VPNTest(72) metric 210 priority 1 to 0:VPNTest:396774951
2026-06-13 08:56:12.614841 ike V=root:0:VPNTest:396774951: moving route 10.130.145.0/255.255.255.0 oif VPNTest(72) metric 210 priority 1 to 0:VPNTest:396774968
To fix the high CPU issue, identify why the same subnet is added and removed repeatedly.
The Fortinet Engineering team is aware of this issue, and it is currently tracked under the Issue ID #1279665. The fix for this issue is currently scheduled in FortiOS v8.0.1. The 'zebos_launcher' process is optimized to handle the empty routes on the secondary FortiGate more efficiently.
Related articles:
| 
