+372 53 888 229info@itabiks.ee

Slow internet behind FortiGate: fixing conserve mode

How to tell whether slow internet is caused by FortiGate conserve mode, how to check it from the GUI and CLI, and what to change so the firewall runs normally again.

4 min

When the office internet suddenly becomes slow, pages load half-way or the VPN keeps dropping, the firewall may be the cause. When a FortiGate runs short of memory it enters conserve mode, in which some security inspection is switched off or new connections are refused. This guide shows how to check for it and what to do.

What conserve mode is

A FortiGate constantly monitors memory usage. There are three thresholds, configurable in the CLI under config system global (memory-use-threshold-red, memory-use-threshold-extreme and memory-use-threshold-green):

  • Red – when memory use exceeds this, the unit enters conserve mode.
  • Extreme – a higher threshold at which the unit starts dropping new sessions.
  • Green – when memory use falls below this, the unit leaves conserve mode.

What happens to traffic in conserve mode depends on the av-failopen setting. The default value pass lets new sessions through without antivirus inspection (the internet works, but protection is weaker). With off, new sessions that would need inspection are blocked, so users feel that the internet is “down”. Which is better is a deliberate trade-off between security and availability.

Symptoms

  • Web pages open slowly or partially, downloads stall.
  • Calls (Teams, VoIP) break up, VPN connections drop.
  • The FortiGate admin interface is sluggish.
  • A conserve mode message appears at the top of the GUI or in the event log.
  • The problem appears at busy times of day, when most people are working.

How to check

  1. Open Dashboard → Status and look at the CPU, Memory and Sessions widgets. Constantly very high memory use is the first hint.
  2. Check Log & Report → System Events for entries about entering and leaving conserve mode.
  3. In the CLI (CLI Console, top right of the GUI) run get system performance status to see CPU, memory and session counts.
  4. diagnose hardware sysinfo conserve shows whether the unit is in conserve mode right now and what the thresholds are.
  5. diagnose sys top lists the processes using the most memory and CPU (press q to exit). If a proxy or logging process is always at the top, that is the likely cause.
  6. diagnose sys session stat shows session totals. A very high number can point to an infected computer or a misbehaving device.

Common causes and fixes

  • Too many sessions. One infected PC, a P2P program or a faulty device can open tens of thousands of connections. Find the source (Dashboard → FortiView Sources) and deal with that device.
  • Heavy proxy-based inspection. Proxy-based antivirus and SSL deep inspection use a lot of memory. Check whether your policies can use flow-based inspection and whether deep inspection is really needed for everyone.
  • Logging to memory. Smaller models without a disk keep logs in memory. Send logs to FortiAnalyzer or FortiCloud and reduce logging where detailed logs are not needed (Log & Report → Log Settings).
  • Undersized model. If users and devices have been added over the years and the internet line got faster, an old entry-level unit may simply not cope. Only a bigger unit fixes that.
  • Firmware bugs. Some FortiOS versions have had memory leaks that were fixed in later releases. Read the Release Notes for your version and upgrade following Fortinet’s official upgrade path tool (System → Firmware & Registration).

Rebooting the unit gives temporary relief but does not fix the cause – the problem will return.

Rule out other causes

The firewall is not always to blame. If FortiGate memory use is normal, check:

  • Your ISP – run a speed test from a computer connected by cable next to the router or FortiGate, and check whether the provider has an outage.
  • Wi-Fi – if wired speed is fine but Wi-Fi is not, the problem is in access points, channels or coverage.
  • A single computer – if only one user is slow, the cause is probably their computer or browser.

When to call a professional

If conserve mode keeps recurring, you cannot find the cause or you suspect an infected device, involve a specialist – wrong changes to security profiles can quietly switch protection off. ITABIKS can diagnose your FortiGate and, if needed, help choose a suitable FortiGate model; call +372 53 888 229.

Was this article helpful?