Skip to main content
aakashrajwani
aakashrajwani
Visitor III
April 17, 2024
Question

Fortinet Firewall shows 100Mbps (100%) bandwidth usage but unable to check in Sources!

  • April 17, 2024
  • 3 replies
  • 7316 views

I am working with a Fortinet FG-60F firewall. It has 2 WAN sources and both have a maximum link speed of 100Mbps. Throughout the day, I am repeatedly getting downstream bandwidth spikes of 100Mbps+ on both WAN links:

 

Our usage is not much at all. When I check my Fortiview sources, the bandwidth consumed by individual IPs is not more than 10Mbps:

 

We are repeatedly getting connectivity issues and packet losses. Users are repeatedly losing their connections and pings are getting timed out.

 

Please guide how do I find out what is causing this or consuming the bandwidth

 

Untitled.pngUntitled2.png

 

 

 

 

 

 

3 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
April 17, 2024

since no one is responding so far I'll put some comments here.
First thing I would do is to see the usage on the internal interfaces instead of each users, if they have a mirror image of WAN1/2 usage pattern.
My assumption is nothing similar to those. Then you're likely getting attacks on both interfaces.

Then I would look for the sources of those attacks by just sniffing on the interface to see if there are some common sources. From there, there are some different options to mitigate.

Toshi

    aakashrajwani
    aakashrajwaniAuthor
    Visitor III
    April 18, 2024

    Hello,

    I am not seeing much utilization on the LAN interface. As suggested in another answer, I enabled the ipv4 DoS policy first and I could still see spikes. Then, I am seeing UDP and ICMP flooding events in the Security events log:

    Untitled3.png

     

    I am not sure if this is causing it and if so, how to resolve it.

    DPadula
    Staff & Editor
    DPadula
    Staff & Editor
    April 18, 2024

    You can try to add the LAN interface bandwidth to the dashboard to confirm if the traffic seen on WAN1 and 2 is indeed going to the internal LAN. 
    Another option would be install SNMP monitoring tool to a computer or server and monitor both interfaces (LAN and WAN) on FGT. 

      aakashrajwani
      aakashrajwaniAuthor
      Visitor III
      April 18, 2024

      Hi,

       

      I added the internal VLAN in the dashboard and it is showing a utilization of less than 10Mbps. WAN1 and WAN2 are still going higher than 75Mbps, both being identical. Have I done it correctly? How do I check further?

       
       

      Untitled.png

      hbac
      Staff
      hbac
      Staff
      April 18, 2024

      Hi @aakashrajwani,

       

      I noticed that the spikes only show as inbound. I would suggest configuring DoS policy. Please refer to https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/771644/dos-policy

       

      Regards, 

      aakashrajwani
      aakashrajwaniAuthor
      Visitor III
      April 18, 2024

      Hello,

      I configured the DoS policy for both WAN sources - all sources, all destinations, all services, and enabled all suggested policies to block it with default packet values, but the bandwidth utilization is still higher than 80Mbps:

      Untitled2.png

      AEK
      SuperUser
      AEK
      SuperUser
      April 18, 2024

      Hi @aakashrajwani 

      Just be careful when enabling DoS policy, you may deny legitimate traffic if you squeeze too much.

      AEK
      Terms & ConditionsAccessibility statement