FortiGate 100E CPU Usage maxes out when downloading

[ITHRBruce]

Hi,

We have been using a FortiGate 100E for about 6 months or so without incident. We have a 1GB pipe out to the net and have around 60 users here. We are on firmware v5.4.5, build 6225 (GA).

Recently we have noticed that CPU Usage starts to max out if anyone does even a moderate download. My ISP manages the firewall as I am not a firewall expert. They have contacted Fortinet and at their request sent over usage logs a few times, but without a solution being offered. My ISP have made a lot of changes and done a great job to reduce the scanning footprint which seems to cause this, and this has made things run much, much better. However we can still get a bad peak, albeit smaller. I myself downloaded a 2GB file from a reputable website (Veritas), in about 8 mins, and the CPU Usage peaked at about 60%. While this was nowhere as bad, why should it go so high when the device is capable of handling thousands of connections? It seems the scanning is quite aggressive, or way too many resources are being allocated to it.

And of course I am concerned if just a few users started a large download. I have seen it go up when someone starts up their email and downloads a few hundred meg, all very legit stuff. Very perplexing. Anyone have any idea as what could be going on here?

Many thanks.

[ede_pfau]

Awkward. This is a problem with DNS. You haven't stated if you resolve via the FGT or some internal server. I cannot imagine (yet) how a firmware update could influence the DNS to not resolve if it worked before.

Is this protocol related? Can you ping both 'abc123' and 'abc123.domain.com', or will the short form fail here as well?

[ITHRBruce]

Hi, thank you for your reply.

The sub-domains aren't set up on DNS, although the domains are. DNS resolution is performed on the firewall, although sub-domain resolution is down to the users modifying the hosts file whenever they needed to hit those sub-domains. My colleagues had set up about 90 of these. They were all accessible prior to the update but not now. The only way to make them work so far is to set an 'allow' rule on the firewall.

Thanks.