Bug Report: FortiGate 40F v7.2.11 Crash leading to loss of configuration

[tpinkham]

Product: FortiGate 40F
Firmware Version: v7.2.11 build 1740
Severity: Critical
Category: System Stability / Configuration Persistence

---

Summary

Under low-memory conditions, the FortiGate 40F experiences a critical failure where the active firewall policy configuration is completely erased, resulting in total loss of internet-bound traffic and administrative lockout.

---

Steps to Reproduce

1. Deploy a FortiGate 40F running firmware version 7.2.11 (build 1740).

2. Configure approximately 10 or more IP and domain threat feeds (external threat feeds).

3. Add an additional external IP threat feed, referencing it in a policy.

4. Observe system behavior as the new feed is added and activated.

---

Observed Behavior

• The FortiGate becomes unresponsive for approximately 10 minutes.

• All outbound internet traffic halts.

• Management interface (e.g., GUI, SSH) becomes temporarily inaccessible.

• Upon restoration of access, all firewall policies are missing.

• CLI command show firewall policy returns no output, indicating full policy loss.

---

Expected Behavior

• The FortiGate should enter conserve mode if memory usage exceeds thresholds.

• Firewall policies and configurations should remain intact.

• System should not discard critical configuration (e.g., firewall policy) under memory pressure.

---

Impact

• Complete network outage due to loss of all firewall rules.

• Manual reconfiguration required or restore from backup.

• Critical disruption in production environments.

I have only observed this once and was able to restore from a cloud backup but I figured I would share in case others observe similar behavior.

[AEK]

Thanks for sharing.

I don't find it in the known issues of 7.2.11's release notes.

I recommend to open a ticket.

[BillH_FTNT]

Hi tpinkham

Could you please share some information about the issue you're experiencing?

• System logs, including those from before and during the issue (logs from FortiAnalyzer or Syslogs are ideal)
• Output of dia debug crashlog read
• Firewall configuration

If possible, kindly send the information to my official email: bhoang@fortinet.com.

I’m Bill from Fortinet. Looking forward to your response.

Thanks

Bill

[BillH_FTNT]

Hi @tpinkham 

I would also like to know which items are using the most memory on your device. This information would be very helpful for me to reproduce the issue in my lab.

Please run the following commands at different times to gather memory usage data, and share the output with me as well.

Memory related output ((please run the commands five times at different moments )

get system status

fnsysctl date

get hardware status

get sys perf status

diag sys session stat

diagnose sys session6 stat

diag hardware sysinfo memory

diag hardware sysinfo slab

diagnose hardware sysinfo shm

diagnose sys top-mem 250

fnsysctl ps

diag sys vd list | grep fib

diag sys cmdb info

diag sys top-fd 30

fnsysctl date

diagnose sys top-mem 250

get sys perf firewall statistics

diag debug enable

diagnose wad stats worker show

diagnose wad memory overused

diagnose wad memory sum

diagnose wad memory workers

diagnose wad memory report

diag test application wad 10000

diag debug disable

diagnose test application ipsmonitor 24

diagnose ips session list by-flowav-mem 50

diagnose ips session list by-idle 50

diagnose ips session list by-created-queries 50

diagnose ips dissector dump

diagnose ips raw status

diagnose ips session performance

diagnose ips session list by-mem

diagnose ips memory track enable

diagnose ips memory track-size 17 480

diagnose ips memory track-print0

diagnose ips session status

diagnose ips memory status

diagnose ips packet status0

diagnose ips memory track disable

fnsysctl df -k

fnsysctl df -m

fnsysctl ls -l /tmp

fnsysctl du -i /tmp

fnsysctl du -ax /tmp

fnsysctl du -a / -d 1

fnsysctl du -i /dev/shm

fnsysctl du -ax /dev/shm

fnsysctl du -a /dev/shm

fnsysctl ls -l /dev/shm

fnsysctl du -i /node-scripts

fnsysctl du -ax /node-scripts

fnsysctl ls -l /node-scripts

Regards

Bill

[tpinkham]

Thanks, will do!

[BillH_FTNT]

Thank you, tpinkham. I just wanted to let you know that the engineering team has resolved an issue that seems to be the same as yours. However, I still need the logs to verify this accurately.

Regards

Bill

[BillH_FTNT]

Hi @tpinkham 

One important step is to optimize your device’s memory. You can follow the links below to do so.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-optimize-memory-consumption-for-sma...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-is-entering-into-Conserve-Mode-d...

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-optimize-memory-usage-specifi...

Regards

Bill