Memory Usage Increase and Device Crash After Manual Update Following USOM Integration 60E and 60F

[thaootix]

Abstract:
This study examines the impact of manual threat intelligence updates on system memory consumption in Fortigate 60E and 60F firewall models following USOM integration. Test results indicate that after performing a manual update, there is a significant increase in RAM usage, which eventually leads to the device crashing.

Introduction:
Fortigate firewalls work in conjunction with threat intelligence centers such as USOM to continuously update threat intelligence databases and prevent malicious network traffic. However, the effects of this integration on system resources are not always thoroughly analyzed. This study investigates the impact of USOM integration on memory usage during manual update processes on Fortigate 60E and 60F models.

Test Methodology and Findings:

USOM threat intelligence lists were integrated into Fortigate 60E and 60F devices.
A manual threat intelligence database update was initiated.
A significant increase in RAM consumption was observed during the update process.
After exceeding critical memory thresholds, the device stopped responding and eventually crashed.
Repeating the same tests on multiple devices confirmed the consistency of the issue.

[atakannatak]

Hi @thaootix ,

Since the models in question have 2 GB RAM, issues like this may occur in older firmware versions (6.4.X, 7.0.X, or 7.2.X). As a solution, you can consider upgrading to version 7.4.X. However, before proceeding with the upgrade, I strongly recommend reviewing the following article to ensure there are no potential issues that could negatively impact your system:

FortiGate 7.4.0 - Proxy-Related Features No Longer Supported on 2 GB RAM Models

Additionally, if possible, I recommend formatting and reinstalling the unit when performing the upgrade.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

Atakan ATAK
CCIE #68781

[thaootix]

Hi @atakannatak ,

Thanks for answwer.

Even after formatting and upgrading, I am still experiencing the same issue.