Skip to main content
pajass
pajass
New Member
February 16, 2022
Question

Fortigate 90d 100% CPU on speedtest, only 250Mbps

  • February 16, 2022
  • 3 replies
  • 3127 views

Hi everyone, new here in the Forum :)

We have A Fortigate 90D.

When we measure the bandwith with speedtest.net from outside the firewall we get around 700Mbps.

Behind the firewall only 250Mbps and the cpu load goes to 100%. According to the datasheet it should theoretically support up to 3.5Gbps. No matter if Antivirus is activated or not.

I don't want to post the debug.log because of ip-adresses and so on, but I can provide further details if necessary.


Cheers Stephan

3 replies

fiesta
fiesta
New Member
February 16, 2022

Dear Stephen,

What cause high CPU in diagnose sys top-summary or diagnose sys top.
If it's IPSmonitor, i think you should disable the Application Control and IPS if enabled. 

 

Regards.

amouawad
Staff
amouawad
Staff
February 16, 2022

The FortiGate 90D supports 275Mbps for IPS/Application control traffic and 35Mbps for AntiVirus traffic (http://fortinet.globalgate.com.ar/pdfs/FortiGate/FortiGate-90D.pdf).

 

The 3.5Gbps is for firewall only traffic (no security profiles enabled), and only for UDP. TCP will be always be lower than this value but should definitely be higher than 250Mbps.

 

250Mbps is inline with this if your policy has Application Control/IPS turned on. Can you try disabling all security profiles on the policy and testing again?

ede_pfau
SuperUser
ede_pfau
SuperUser
February 19, 2022

Clearly, a throughput figure cannot be independent of applying AV or not.

 

Besides the 90D being an old model with a relatively weak embedded CPU, can it be the case that your WAN line is using PPPoE and the FGT is decoding it directly? In this case, CPU is the limiting factor. A simple modem in front will do PPPoE in hardware and will raise the throughput substantially.

Terms & ConditionsAccessibility statement