Hey All,
Just got a 60f and putting it through the paces. I am noticing high mem around 60% and if np does anything basically goes to conserve mode and need to reboot. Scoured cookbook and other googles and cant seem to find a good NPU best practice.
Wondering if anyone else has played with this at all. Using at home, about 10 policies, 2 of which do actual filtering.
Just wondering thoughts.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
For FOS v6.4, just request IPS package v6.0.30 or later from TAC.
This is a new feature tracked by mantis 0613814: Reduce IPS memory consumption.
It is still being backported to FOS v6.2/6.0 later on as one of major features (not available yet currently, more testing likely pending).
Hopefully it would make it to the next IPS official public release for FOS v6.2/v6.0 (can't ascertain this).
What process(es) seems to be taking up the memory most? "diag sys top 5 20" then "Shift-M".
Since it's a brand-new product with a new SOC4 chip, I would open a ticket with TAC right away.
Running 6.2.2. This is my attempt at coming back to Fortinet from the 5 days.
I will be calling TAC to get some info, but just to try an answer some of the questions here...
Which part would be proxy vs flow, looking through my list i didn't see anything glaring sticking out.
Also looking through cookbook to see if i can just turn off the NPU, right now it seems to be the app control that really pushes it over.
WIth the setup the only filtering on is web/av/dns
Run Time: 1 days, 2 hours and 3 minutes 0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 1819T, 303F ipshelper 188 S < 0.0 16.9 ipsengine 255 S < 0.1 5.3 httpsd 4721 S 0.0 5.3 ipsengine 253 S < 0.0 5.3 ipsengine 256 S < 0.0 5.2 ipsengine 254 S < 0.1 5.2 cmdbsvr 128 S 0.0 2.3 scanunitd 6590 S < 0.0 1.9 pyfcgid 4455 S 0.0 1.9 pyfcgid 4454 S 0.0 1.9 pyfcgid 4451 S 0.0 1.8 scanunitd 175 S < 0.0 1.8 scanunitd 6592 S < 0.0 1.8 scanunitd 6587 S < 0.0 1.8 scanunitd 6588 S < 0.0 1.7 scanunitd 6589 S < 0.0 1.7 scanunitd 6591 S < 0.0 1.7 scanunitd 6593 S < 0.0 1.7 scanunitd 6594 S < 0.0 1.7 httpsd 4725 S 1.3 1.5 Run Time: 1 days, 2 hours and 3 minutes 0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 1819T, 303F ipshelper 188 S < 0.0 16.9 ipsengine 255 S < 0.1 5.3 httpsd 4721 S 0.0 5.3 ipsengine 253 S < 0.0 5.3 ipsengine 256 S < 0.0 5.2 ipsengine 254 S < 0.1 5.2 cmdbsvr 128 S 0.0 2.3 scanunitd 6590 S < 0.0 1.9 pyfcgid 4455 S 0.0 1.9 pyfcgid 4454 S 0.0 1.9 pyfcgid 4451 S 0.0 1.8 scanunitd 175 S < 0.0 1.8 scanunitd 6592 S < 0.0 1.8 scanunitd 6587 S < 0.0 1.8 scanunitd 6588 S < 0.0 1.7 scanunitd 6589 S < 0.0 1.7 scanunitd 6591 S < 0.0 1.7 scanunitd 6593 S < 0.0 1.7 scanunitd 6594 S < 0.0 1.7 httpsd 4725 S 0.9 1.5
restarting the engine took me from 75% down to 63%
I also have a 60F running 6.2.2 the last 6 weeks or so, with a couple of fortiswitches and and ap. got a mix of rules including a couple with AV, webfiltering etc. in proxy mode, no deep ssl inspection though. During that time i've had to reboot the box once due to a suspected problem with fortilink, it hadn't gone to conserve though.
6.2.3 isn't out yet for the SOC4 models.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1088 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.