Troubleshooting Tip: CPU Spike on FortiGate when VPN user connects or disconnects

[yzayani]

Description	This article describes the cause and resolution of CPU spikes observed on FortiGate devices when a remote access VPN (RA VPN) user connects or disconnects. These spikes can affect traffic processing, cause traffic drops, and impact routing protocols such as BGP and OSPF.
Scope	FortiGate.
Solution	Remote VPN tunnel connect/disconnect events with high concurrent sessions (13–15M) and CPS (80k–125k). Throughput = 20 Gbps. Symptoms: CPU spike on all traffic processing cores. Temporary traffic drops. BGP or OSPF neighbor flaps. Debug/Log Commands: date=2025-11-19 time=15:11:17 id=7530279732491845829 itime="2025-07-23 15:11:17" euid=3 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0103020300 type="event" subtype="router" level="warning" msg="BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 172.30.1.21 NOT UP Hold Timer Expired" logdesc="BGP neighbor status changed" eventtime=1753279878044067216 tz="+0100" devid="FG3" vd="root" dtime="2025-07-23 15:11:17" itime_t=1753279877 devname="Test" date=2025-11-19time=15:11:17 id=7530279732491845832 itime="2025-07-23 15:11:17" euid=3 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0103020300 type="event" subtype="router" level="warning" msg="BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 172.30.1.22 NOT UP Hold Timer Expired" logdesc="BGP neighbor status changed" eventtime=1753279878044161467 tz="+0100" devid="FG3" vd="root" dtime="2025-07-23 15:11:17" itime_t=1753279877 devname="Test" CPU32 states: 0% user 0% system 0% nice 18% idle 0% iowait 0% irq 82% softirq CPU33 states: 0% user 0% system 0% nice 37% idle 0% iowait 0% irq 63% softirq CPU62 states: 0% user 0% system 0% nice 20% idle 0% iowait 0% irq 80% softirq CPU63 states: 0% user 0% system 0% nice 21% idle 0% iowait 0% irq 79% softirq misc info: session_count=13,382,741 setup_rate=139,977 exp_count=27 clash=277,619,980 npu_session_count=12,637,335 nturbo_session_count=0 system fib version=14077 System time: Wed Jul 23 15:11:13 2025 misc info: session_count=13,382,812 setup_rate=141,317 exp_count=27 clash=277,625,732 npu_session_count=12,639,224 nturbo_session_count=0 system fib version=14077 misc info: session_count=12,759,597 setup_rate=194,455 exp_count=28 clash=277,629,244 <<<<  600k sessions removed npu_session_count=12,206,872  <--  400k sessions removed nturbo_session_count=0 system fib version=14078 A large number of sessions were removed/added during VPN connect/disconnect. The NPU session count drops/increases indicate slow path processing impacting the CPU. System FIB version increments during this period. Event Logs Indicating VPN Activity: Phase 1 and Phase 2 SA installation or deletion. Tunnel up/not logs matching the CPU spike events. BGP neighbor flaps coinciding with VPN connect/disconnect. Workaround: Disable add-route in the IPsec phase1-interfaces: Add static routes for the remote IPs/devices that require VPN access. Optional: Relax the BGP keepalive timer to 5–10 seconds to reduce side effects. Long Term Solution: Update FortiOS to v7.4.10. Description: Fix prevents the last ACK packet from entering the slow path when a VPN tunnel is established/torn down, reducing CPU usage by 20–30%.