40C high CPU

[amitkor]

Hi, Got a new 40C, still basic configuration only, not UTM in use. I got a 50mb dsl connection. when i download a file at 6 megabyte per sec, the CPU spikes to 90+. When i finish to download, the CPU goes back to around 1-3% Can anyone confirm this is normal and not a faulty unit? I was under the impression this unit can handle a much greater throughput. Regards, Amit K.

[Jupiter_FTNT]

Amit, 1.Which build you are using? 2.Is that a FWF40C or FGT40C? 3.Are you using a soft-switch? thanks, Jupiter

[amitkor]

Hi Jupiter, 1. The firmware version is v5.2.1,build618 2. Its a FWF40C 3. Yes, ports 1-3 are part of a soft switch, the computer i used to download the files is connected to the soft switch. Regards, Amit K.

[ede_pfau]

A soft switch is prone to consume a lot of CPU power. I' d split it up into individual ports and use a small external switch if needed. Also, I think to recall that in 5.2.1 the WiFi and LAN ports are soft-switched together by default (a thing users always wanted to have in the past). This will impact CPU load of course. The 40C can be fast on firewalling (using the NPlite ASIC core) but it' s CPU is a bit weak.

[amitkor]

Ill try it without soft-switch. I received the unit with version 5.0.6 and upgraded it to 5.2.1 so the wireless interface is not bridged with the physical interfaces. Thanks for the advice. Regards, Amit K.

[Mark_Oakton]

Amit, did removing the soft switch make much difference, we have the same problem on several units?

[amitkor]

Ive only recently got a switch so could do the testing.

First thing ive tried was to create VLAN subinterfaces to use the Fortigate unit as  a router on a stick, but that was much worst.

I got lucky by getting a L3 switch, so ive configured a L3 p2p between the Fortigate and the switch. theres still some spikes with high speed downloads from the internet, but nothing major and the spikes are very short. though thats with no UTM enabled.

Im planning to test it with full UTM today, ill keep you posted.

EDIT: Just tested with UTM (without IPS and DLP) the CPU was always on 100% (even without logs). when i disabled application control everything started working normal.

Could be related to the version:

https://forum.fortinet.com/tm.aspx?m=111192

Or 40C should be somewhere between FortiOS light and regular FortiOS.

Edit2: Eventually, it was the log on the implicit deny rule. after disabling the logs the unit is fine with full UTM.