Firewall devices, which are among the most critical components in securing corporate networks, continuously operate at high performance to analyze heavy data traffic and block cyber threats. Although FortiGate, one of the most widely used next-generation firewalls (NGFW) globally and in Turkey, features hardware acceleration (ASIC) chips, it can still face high CPU usage (High CPU) issues in certain situations.
A continuous CPU utilization exceeding 90% on FortiGate devices can lead to severe network slowdowns, packet losses, dropped VPN connections, and even cause the device to freeze (become unresponsive). This situation disrupts cybersecurity operations and directly threatens business continuity. In this guide, we will discuss the primary causes of high CPU usage on FortiGate devices, diagnostics methods via CLI (Command Line Interface), and step-by-step solutions to resolve this issue.
Primary Causes of FortiGate High CPU Issues
There is no single cause for high CPU usage on FortiGate; the issue usually stems from software processes, unusual network traffic patterns, or configuration errors. The most common causes are:
- Intense Security Profiles (UTM Engine): Uncontrolled activation of processor-intensive security profiles such as Deep SSL Inspection, Antivirus, IPS (Intrusion Prevention System), and Web Filtering on all traffic can overload the CPU.
- Software Bugs and Crashes (Daemon Crash): Unstable versions of the FortiOS operating system or locked/memory-leaking background services (e.g.,
ipsmonitor,wad,scanunitd) can push CPU usage to 100%. - SSL VPN and IPsec VPN Intensity: High-volume data transfers by many users simultaneously over encrypted VPN tunnels strain CPU limits, especially on entry-level models with limited hardware encryption support.
- Cyber Attacks and DDoS: Intense DDoS (Distributed Denial of Service) attacks or port scans targeting your network consume CPU resources as the firewall attempts to analyze these packets.
- Heavy Logging and Reporting: Intensive and unfiltered log writing to disk or memory creates additional overhead for logging services on the CPU.
How to Diagnose FortiGate CPU via CLI Commands
The FortiGate web interface (GUI) may become unresponsive or slow during high CPU states. Therefore, CLI (SSH) connection is always preferred for diagnostics and analysis. Once connected to the device via SSH, you can use the following commands to identify the source of the problem:
1. Viewing General System Status
To view the instantaneous CPU, memory, and active session status of the device:
get system status
This command also displays the device's uptime, operating system version, and license status.
2. Listing CPU Usage of Processes
To identify which service or background process is consuming the most CPU, run the following command, similar to the top command in Linux:
get system performance top
- Output Analysis: When this command is run, instantaneous CPU and memory percentages are displayed at the top of the screen, and a list of running services (PID, Process Name, CPU%, MEM%) is displayed at the bottom. For example, if you see a service like
ipsmonitororwad(Web Application Daemon) consuming very high CPU in the list, it means the issue stems from IPS or Web Filtering processes, respectively. - Exit: You can press
qon your keyboard to exit the screen.
3. Checking Hardware Acceleration (ASIC) Status
To check how much of the traffic is handled by hardware chips (NP/CP):
diagnose sys session list
If traffic cannot be hardware-accelerated and lands directly on the main CPU (CPU 0), this leads to high CPU usage.
Step-by-Step FortiGate High CPU Resolution Methods
Following the diagnostics steps, you can apply the following resolution steps based on the source of the issue:
1. Restarting Unresponsive Services (Daemons)
If you identified that a service like wad or ipsmonitor is locked and consuming high CPU in the get system performance top command, you can safely restart this service.
- Restarting WAD (Web Filtering) Service:
diagnose test application wad 99 - Restarting IPS (Intrusion Prevention) Service:
diagnose test application ipsmonitor 99
Note: These commands stop and automatically restart the respective services in the background. A very brief disruption in traffic may occur, but it is generally a much safer and faster solution than rebooting the device entirely.
2. Optimizing SSL Inspection Policies
Instead of applying "Deep SSL Inspection" to all internet traffic, exempt trusted categories (banking, healthcare, government sites, etc.) from this inspection. This process significantly reduces the decryption load on the CPU.
3. Adjusting Logging Level and Frequency
Instead of logging every packet transition, log only necessary events. Forward logs to an external log analyzer instead of writing them to the device's own disk or memory. For professional analysis and reporting on this matter, you can establish our Network Security, Firewall and IDS/IPS Solutions infrastructure and store your logs in compliance with legal standards.
Additionally, to protect the overall health of your cybersecurity infrastructure and manage your firewall and EDR solutions centrally, you can benefit from our Firewall, EDR and Antivirus Management Solutions services.
To professionally plan your business's network security policies, IT investments, and technology roadmap, you can work with our expert team within the scope of our Business and Management Consulting services.
You can also review our other guides that will strengthen your cybersecurity and network infrastructure:
- To establish a secure remote access infrastructure: FortiGate IPSec VPN Deployment
- For legal internet logging obligations: What is 5651 Logging, and for Whom is it Mandatory?
- For SIEM, Syslog, and 5651 architectures: SIEM, Syslog, and 5651 Correct Architecture Design
- For KVKK compliance of your server infrastructure: Dell Server KVKK Technical Measures Guide
- For ISO 27001 logging requirements in the virtualization layer: How to Configure VMware Logging for ISO 27001?
- For KVKK compliant logging in virtual environments: How to Configure VMware Logging for KVKK?
- For secure destruction of personal data: Obligations of Deletion, Destruction, and Anonymization in KVKK
- For compliance of physical security and camera recordings: Camera Systems Within the Scope of KVKK
- For compliance processes of small-scale businesses: Small Business Guide for KVKK
- For integration of KVKK and ISO 27001 standards: KVKK and ISO 27001 Integration
- For the foundation of information security standards: What is ISO 27001?
To resolve performance issues on your FortiGate firewall devices, troubleshoot high CPU/memory problems, and optimize your network security infrastructure, you can contact us at any time.
Frequently Asked Questions
Does internet access drop when CPU usage is 100% on FortiGate?
It may not always drop entirely, but severe packet losses and slowdowns occur. To protect the CPU, FortiGate enters "Conserve Mode" in some situations. In this mode, the device may reject new sessions, disable certain security scans, or block traffic directly. This causes users to be unable to access the internet or drops VPN connections.
Does upgrading the FortiOS firmware version resolve high CPU issues?
Yes, it can. In some versions of the FortiOS operating system, known software bugs (service crashes, memory leaks) can directly cause high CPU usage. Reviewing the Release Notes published by Fortinet and upgrading to a stable release where bugs in your current version are resolved can permanently solve the problem.
How does FortiGate hardware acceleration (ASIC) affect CPU load?
Special ASIC chips such as NP (Network Processor) and CP (Content Processor) in FortiGate devices process firewall rules, NAT, encryption (VPN), and some UTM scans at the hardware level without placing a load on the main CPU. If there are configurations in your rules that prevent hardware acceleration (e.g., incompatible encryption algorithms or certain proxy-based UTM features), traffic is processed directly by the main CPU, which rapidly increases CPU usage.
Conclusion
High CPU usage (High CPU) on FortiGate firewall devices is a performance problem that directly threatens network operations but can be resolved quickly with correct diagnostics steps. Identifying locked services via CLI analysis, optimizing UTM profiles, adjusting SSL inspection policies, and using a stable FortiOS version will maximize your device's performance. A secure, uninterrupted, and high-performance network infrastructure secures your corporate data while guaranteeing your business continuity.
