FG-61F with OS version 6.4.7 has anyone seen an increase in memory utilization where it eventually p

[JohnBC]

We have multiple FG-61F that are deployed and apparently there is a memory leak of some type that will cause your FG to constantly increase in memory until it either dies and has to be rebooted, or you reset something.

These are not really using IPS, but do use ADVPN IKE tunnels between the devices over point to point and metro-E circuits. The ones over the internet use ADVPN and all traffic is sent back through the core.

We noticed this with using FortiSIEM after was had some devices reboot themselves. We have a TAC case open, and have reached out the account manager. But after much back and forth I was basically told by TAC that the 61F is a low end junk and that it is not powerful enough to do what they are advertising.

One box as 2 people on the network and is at 65% today. Another has less than 50 people onsite and has gone up 1% a day until now it is at 79%. Probably half of the 30 or so installed have above 50% Memory usage. The data connections are mostly in the realm of 10Mb up to 100Mb for the PTP/MetroE and 100Mb to 700Mb for the Direct Internet.

I have a TAC case open and have complained to our current account manager. TAC says yep this is happening, but these are low end 

But to be honest I would really like it if there was a way to go above our account managers head, as they do not seem engaged. We have 30 something FG and about half are seeing this memory going up.

[darwin_FTNT]

Can  try latest firmware FOS v6.4.8 and IPS engine v6.4.116 (request from TAC).  Both versions fixes multiple memory leak issues. There could still be others remaining but we're working to make v6.4.x as stable as possible.  Software bugs proportional to the number of features added or code changes refactored / optimized.  Once upgraded to latest versions, if issues still exist, open a new tech support ticket (include ticket no. here for follow up). Thanks.

[JohnBC]

When I was looking through the release notes on 6.4.8 it did not look like it did much of anything on memory fixes. I did see several Known Issues listed that Proxy memory leaks, but we are using Flow and not Proxy.

They are supposed to have a fix for the ADVPN link failures in 6.4.9. I would hope they would have some memory leak fixes there too. And as I was going through it again today I found.

"721487 FortiGate often enters conserve mode due to high memory usage by httpsd process."

This is one of the processes that we are seeing.

HTTPSD, Cache, IPSENGINE, and IKEd

Problem is I cannot find how to see the Bug ID. When you click on the link it goes to https://support.fortinet.com/welcome/#/, but then has no place to enter the BUG ID. if you click log in for that page it goes to https://support.fortinet.com/asset/#/dashboard and again no area for BUG ID.

How do you get the IPS engine installed separately?

[darwin_FTNT]

Hi John,

I re-check difference between FOS v6.4.7 and v6.4.8 and the changes are minor. For v6.4.9, the list of fixes are much longer and included many memory issues.

The FortiOS interim version is already available (can request from TAC):

FGT_61F-v6-build1952-FORTINET.out, 2022-02-12  86.52 MB

Interim version are not official release because they are not fully QA tested,

which will take weeks or months to finish testing.

To manually update IPS engine (also an interim version):

In GUI, click System -> FortiGuard -> Intrusion Prevention -> Actions.

Then upload the file flen-fos6.4-6.116.pkg

Mantis bug ID are our internal bug tracking system and isn't available to external access. Forticare Ticket ID should be more accessible instead.

Cheers,

[JohnBC]

Thank you for the information, this was very helpful.

Does Fortinet realize that Cisco and Dell both have ways to allow customers to look at their Bug ID's that they reference?

Initially I was very impressed with Fortinet selling the Fortigate, however, recently I have been more and more disillusioned.

[darwin_FTNT]

Hi John,

Currently, FortiCare is the website to assist customer tickets (first external layer). If tech support found there is a bug instead of configuration issue then they open a mantis bug (secondary internal layer).  I think currently in the release note, only the mantis bug ID and title is included. This is due to the description field and other fields contains many detailed information like:

- QA replication methods and temporary network lab access

- Other customers affected

- Developers discussion

- Partial source code patch/references

- etc.

For now, If need further info on a mantis bug, the recommended step is to contact tech support.  Also a post in this forum about the status, fix schedule or further info on the mantis bug would also help.

Cheers,