I'd like to ask about Conserve Mode settings

[cybernet2025]

what happen if I have configured the memory settings like this on Fortigate firewall?

set memory-use-threshold-extreme 70
set memory-use-threshold-green 75
set memory-use-threshold-red 71

When memory usage reaches 70% or higher, the device will enter an "extreme" condition, is it fine?

[dbu]

Hello,

Fortigate enters in conserve mode when memory reaches the red threshold.

When it enters in conserve mode necessary actions are applied to the traffic.
When device  reaches the "extreme" threshold  new sessions are dropped.

In your case device when memory will reach 70% it must trigger the conserve mode "extreme" and it will start dropping new sessions.

What is your intention with configuring these values ?

Have a look at default values for these threshold :

set memory-use-threshold-extreme 95

set memory-use-threshold-red 88
set memory-use-threshold-green 82

Regards!

[cybernet2025]

Hi dbumci
Thanks for your answer.

In my case device when memory will reach 70% it must trigger the conserve mode "extreme" and it will start dropping new sessions.
but If I can reduce memory usage to below 70% will it go back to green mode or just it not in extreme mode? and I don't interest green threshold because extreme threshold has configured as the lowest value

[dbu]

Hi cybernet2025,

Normally as per the default values the logic is like below. 

Extreme >95%

82%< Red <88%

Green <82%

Your setup is a bit weird :

set memory-use-threshold-extreme 70
set memory-use-threshold-green 75

In my opinion when memory will go below 70% it exits the 'extreme' mode and it will go to the normal mode 'green' as per the logic 1%-69%

I have not tested/faced this before. 

[cybernet2025]

Hi dbumci
Thanks for your answer.
I'd like to know about  conserve mode threshold settings how it works? if I have weird settings.
I don't know which a threshold that FortiOS focus to?
In your opinion, If I configured an extreme  threshold to less than green threshold FotiOS will focus only extreme threshold only and it won't focus on green threshold, correct?

[dbu · Accepted solution]

Hi cybernet2025, 

Thank you for you reply.

As per your configuration it looks like this : 

Extreme<70

71< Red <74

Green>75

If we assume that the memory will keep increasing from 50% until 90% here is what is supposed to happen: 

extreme>red>green
-when it reaches 70% it goes in extreme mode >>>>starts dropping new connections

-when it reaches 71% goes from extreme to red >>>>>>> begins again not to drop connections

-and when it goes above 75% it turns to green which should be the normal value >>>>> acts as nothing is happening, everything flows normal.

Is a little hard to test these settings in the lab because the lowest values you can configure for these thresholds is 70. I cannot reproduce it and confirm it to you. 

Now looking at the decreasing of memory from high to low :

I simplified my logic by taking the only threshold you are interested and treated it as above or below the value.

[cybernet2025]

Hi dbumci
Thank you so much for your answer.

Your answer made me cleared. I got it.