Identify the CPU that is handling a session

[avenditti]

Hi community,

I have a FGT VM with one CPU (of 4) that reaches 100% peaks, while the others are idle. Due to the characteristics of the traffic I believe this is "normal" (there is a fixed session between 2 IPSec hosts that always use the same source IP/port and the same destination IP/port with over 800Mbps throughput, which is handled by a single CPU, while the other ones share the rest of the load). I believe this CPU is dropping packets because it can't handle the total amount of traffic, and I would like to demonstrate this to the customer, but how?

I can easily:

• identify the single session (knowing its characteristics of src and dst) with 'diag sys session list'
• show that one CPU is overloaded with 'diagnose sys performance status',

but how do I relate the session from the first command to the CPU status from the second command? How do I show that there is packet loss?

Could you suggest some commands that highlight these aspects?

thanks guys,
Angelo

[AEK]

Hi Angelo

I think you should be able see packet loss if you use "fnsysctl ifconfig" and look into the tunnel interface and the WAN interface's output (errors, dropped).

You may also check if there is packet loss on SD-WAN (if applicable), with "diagnose sys sdwan health-check".

Following tech tip may also help to distribute IPsec across multiple cores.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-distribute-IPsec-traffic-to-all-CPU...

Hope it helps.

[avenditti]

Hi AEK,

from your debug command I didn't find a direct session - CPU relationship but the information on the KB is very useful can help me with my problem... so good to know.

Thank you for your answer

[spoojary]

You can also check the doc to troubleshoot the high cpu issue : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Debugs-for-troubleshooting-high-CPU-Issues...