Troubleshooting Tip: How to optimize memory usage specifically for FortiGate Rugged 60F or other low-end models

Description

This article describes how to optimize memory to reduce the memory consumption for FGR-60F FortiGates in the second, third, and fourth generations. This configuration only applies to specific FortiGate models.

Scope

This issue can occur on any FortiGate model with 2 GB of RAM or less, such as the 30D, 30E, 30G, 40C, 40F, 50E, 50G, 60D, 60E, 60F, 70D, 80C, 80D, 80E, 90D, and 90E series of devices, including variants such as FortiWiFi, Rugged, 3G/4G, DSL, SFP, and POE, as long as the RAM is 2 GB or less.

Solution

The following are some configuration adjustments to reduce and optimize memory usage when low-end models with UTM have high memory usage.

Increase memory-use-threshold:

config system global
    set memory-use-threshold-extreme 97
    set memory-use-threshold-green 90
    set memory-use-threshold-red 94
end

Schedule an update at off-peak time. For example:

config system autoupdate schedule
    set frequency daily
    set time 03:00
end

Or reduce worker count. 
The following configuration should be implemented during a maintenance window and carefully monitored during production hours for any performance impact.

Each daemon is bound to a single CPU core. Since the number of daemons/processes is reduced, depending on the volume of traffic or number of requests handled by a single daemon, this can lead to high CPU usage on that core, potentially resulting in dropped connections.
It is recommended to monitor network usage, CPU load, and memory consumption and adjust the configuration accordingly.

For example, if the device is handling around 100-200 Mbps of traffic (as shown in the output of 'get system performance status' under average network usage), allocating more than one WAD worker or IPS engine may be necessary. This should be done while ensuring efficient memory utilization so that the device does not enter conserve mode.

config system global
    set miglogd-children 1
    set sslvpn-max-worker-count 1
    set wad-worker-count 1
    set scanunit-count 2
end

 Note :  'set sslvpn-max-worker-count, set wad-worker-count, set scanunit-count 2'

Commands do not work on FortiOS 7.6 and above, as the features are deprecated on low-end devices.

Refer to these release notes:

• 2 GB RAM FortiGate models no longer support FortiOS proxy-related features

• SSL VPN removed from 2GB RAM models for tunnel and web mode

The IPS process count and signature database size can be configured:

config ips global
    set engine-count 1
    set cp-accel-mode none
set database regular  
set exclude-signatures ot <-- Default setting. 'none' is not recommended unless the OT signatures are required.
end

Note: Changing IPS global settings causes a brief traffic disruption while processes reload, and the settings above can increase CPU usage of the IPS engine process. Depending on network traffic patterns, the engine-count may need to be increased or the cp-accel-mode modified.

Disable log in memory:

config log memory setting
    set status disable
end

Disable log forwarding to disk:

config log disk filter <----- This command only applies to models with onboard logging disks.
    set forward-traffic disable
end

Reduce session-TTL to improve session recycling efficiency:

config system session-ttl
    set default 600
        config port
            edit 1
                set protocol 17
                set timeout 120
            next
        end
end

Reduce dns-cache:

config system dns
    set dns-cache-limit 300
end

Reduce webfilter and antispam cache:

config system fortiguard
    set webfilter-cache-ttl 500
    set antispam-cache-ttl 500
end

Disabled the security rating submission:

config system global   
 set security-rating-result-submission disable <----- Starting from FortiOS versions 7.4.4 and 7.6.0, this command is deprecated and no longer available.
    set security-rating-run-on-schedule disable
end

Reduce internet-service-database:

config sys global
    set internet-service-database on-demand
end

execute update-ffdb-on-demand

In case ISDB is not used at all, disable the automatic update of this Database:

config system fortiguard
    set update-ffdb disable
end

Note 1:

Consider that these low-end models have only 2GB of RAM.
It is therefore very likely that this device will enter conserve mode quickly if there are many sessions in progress for FortiGate.

Note 2:

On v7.6.3, further optimizations were done, which remove or rework certain features on devices with 2GB or less of memory.

For further details, consult Optimizations for physical FortiGate devices with 2 GB RAM 7.6.3.

Note 3:

On v7.6.4, the default setting of cp-accel-mode is changed to none on 2GB memory models. This change disables CP acceleration to lower system memory usage, which can prevent some unexpected behavior due to a lack of memory.

For further details, check this document: Default setting of cp-accel-mode is changed to none on 2GB memory models.

Related articles:

• Technical Tip: Low-end FortiGate models with RAM ≤ 2GB entering conserve mode due to increased ISDB database

• Technical Tip: Free up memory to avoid conserve mode 

• Technical Tip: How to optimize memory consumption for smaller FortiGates

• Technical Tip: Memory Optimization Script for FortiGate Desktop Devices