Troubleshooting Tip: DNSproxy consuming high CPU on FortiGate

[imohdishak]

Description
This article describes how to reduce high CPU usage on FortiGate caused by DNSproxy.

Solution
DNSproxy consumes high CPU in FortiGate when the DNS server is configured as a local/private DNS server.

In order to verify the CPU usage in FortiGate, run the following commands:

diag sys top

Figure below shows that DNSproxy consumes high CPU in FortiGate:

Troubleshooting (example):

1) Verified the configuration and see if the primary DNS on the FortiGate is an internal IP address as follows:

config system dns
    show

config system dns
    set primary 10.0.1.254                       <--- This is not a global DNS server
    set secondary 208.91.112.52
end

2) If the primary DNS is not a global/public DNS server, set the primary to a global/public DNS as follows:

config system dns
    set primary 1.1.1.1
end

3) After the configuration is finished, verify the CPU usage as follows:

diag sys top

Figure below shows that CPU usage by DNSproxy has reduced in FortiGate: