FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Description This article describes how to optimize the system when high CPU and/or memory issue is happening with IPS process. Solution
Adjust the bellow settings.
# config ips global
set socket-size [integer, 0-512] <----- IPS socket buffer size. Max and default value depend on available memory. Lower value reduces memory usage.
set engine-count [integer, 0-255] <----- Number of IPS engines running. The default value of 0, FortiOS sets the number to optimize performance depending on the number of CPU cores. Reduce it to the number of cores the FortiGate box has.
set database [regular|extended] <----- Regular protects against the latest common and in-the-wild attacks. Extended includes protection from legacy attacks.
After changing the engine, database and socket size, restart the IPSEngine using the following command:
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.