Fortios 7.0.x memory leak?

[notrixx]

After upgrading our Fortigate 600E (two firewalls in HA) first to FortiOS 7.0.4 then later 7.0.5 we are experiencing what I suspect is memory leak issues.

Over time the memory usage goes up gradually to the point where the firewall goes into "conserve mode" and traffic forwarding stops. After reboot (HA failover) the memory usage is back down and then after about three weeks it goes into conserve mode again.

Anyone else experiencing the same problems?

Do you think I should just roll back to 6.4.x or wait for the next patch?

[Anonymous]

Hello @notrixx,

                Thank you for using the Community Forum.

We see you are facing issues with memory leak on your firewall. If the memory leak started post the  upgrade of the firewall, then it could be due to the known issues on the firmware 7.0.5v. To confirm if the firewall is matching any of that known issue, we would recommend you  to  create a support ticket with our TAC team.

Below is the link for the  known issues on 7.0.5v

https://docs.fortinet.com/document/fortigate/7.0.5/fortios-release-notes/236526/known-issues.

Hope this helps.

Thanks,

Aashiq-Fortinet Community Team.

[CrackinRyder]

I too am facing this issue with a FortiGate VM64 device in Azure.  Its running 7.0.5.

Over a period of 3-8 days, the device will use up memory until services fail on the device which require a failover to the secondary VM.

Snapshot over 24 hours...

What tool are you using to capture a longer time?  I can only get 24hours on the device itself?

[notrixx]

We have FortiAnalyzer which provides more history.

[CrackinRyder]

Fortinet Support helped me get around this solution until a fix is put in place. They said 7.0.6 will fix the issue… we’ll see.

So, the issue is down to the WAD process which is responsible for traffic forwarding/proxying based on policy.

it doesn’t release memory and eventually goes into conserved mode.

Support gave me this config to apply to the Fortigate.  Its an AutoScript which runs every 24hours and kills the WAD process.  The WAD process starts again immediately.

This is safe to run in business hours and not service affecting. 

This auto script runs at the point of you entering it into the CLI, I inputted it in at 16:30, so it runs everyday and will do so for 200 times (or days in my case) then stop:

config system auto-script
edit restart_wad
set interval 86400
set repeat 200
set start auto
set script 'diag test app wad 99'
next
end

Settings are:
interval Repeat interval in seconds.
repeat Number of times to repeat this script (0 = infinite).
start Script starting mode.
script List of FortiOS CLI commands to repeat.

After applying this, the memory usage dropped immediately.  It does so every day at 16:30.  So far 3 weeks and not an issue!

To remove the Auto Script:

config system auto-script
delete restart_wad
end

[WiCS]

We have the same problem, I image they didn´t said you the date from realease the 7.0.6... 

[CrackinRyder]

No they didn't give a date.  However the workaround method I posted works well for us.

[DOIT]

Same problem with 7.0.9, this script seems to have solve the problem.

Thanks!

[CrackinRyder]

Great to hear :)

[fnaf]

It's the same for me. TAC has raised many tickets for me. Some say there is, some say there isn't, and still others say it's an active bug that will be fixed in 7.0.3.  five nights at freddy's