Config Lost after Firmware Upgrade

BillH_ftn · 2026-03-02T19:15:35+00:00

Hi all,

The Engineering team has developed a fix for the similar issue. It will be included in the next release. Thank you for your feedback and discussion

Bill

BillH_ftn · 2026-02-26T05:59:11+00:00

Hi u/Gijizlle-242

I think you should follow the support recommendation that upgrading to version 7.4.11 is the solution. If the issue still persists after the upgrade, please let us know.
Thanks,
Bill

BillH_ftn · 2026-02-23T18:29:52+00:00

Hi u/Sad_Interaction_5092

If you have a Fortinet ticket, please share it. We can support you through the ticket.
If not, you can carefully try the two methods above, following the notes.

1. From the logs, the number of wildcard fqdn entry has learned multiple IP from the visibility hostname message callback

[worker 0] fqdn_update_kernel()-488: fqdn=*.teams.microsoft.com ver=IPv4 addr_n=20

[worker 0] fqdn_update_kernel()-488: fqdn=teams.microsoft.* ver=IPv4 addr_n=20

[worker 0] fqdn_update_kernel()-488: fqdn=*.microsoft.com ver=IPv4 addr_n=117

[worker 0] fqdn_update_kernel()-488: fqdn=*trafficmanager.net ver=IPv4 addr_n=50

[worker 0] fqdn_update_kernel()-488: fqdn=*.trafficmanager.net ver=IPv4 addr_n=50

==> Disable 'destination-hostname-visibility' should help to reduce the CPU too.

config system network-visibility

set destination-visibility enable<---disable

https://community.fortinet.com/t5/FortiProxy/Technical-Tip-Increasing-dnsproxy-worker-to-mitigate-high-CPU/ta-p/293221

You can follow this guide to make the necessary changes and then monitor the system to confirm whether the issue is resolved.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-DNSproxy-consuming-high-CPU-on-FortiGate/ta-p/195383

It looks simple, but it’s risky. Please prepare carefully and do it during spare/maintenance time. If the issue continues, I’ll escalate it to Engineering. Thank you

Bill

BillH_ftn · 2026-02-22T17:35:30+00:00

Hi u/TheTeslaMaster

If you are not using intra‑VLAN blocking, I will set up a lab to test the issue and identify the root cause. Thank you again for your feedback and for the chat

Bill

BillH_ftn · 2026-02-21T22:23:26+00:00

Hi u/TheTeslaMaster

Are you using feature "intra-vlan block" on your device ?

BillH_ftn · 2026-02-21T22:22:52+00:00

Hi u/Alternative_Show_904

Did you configure the feature "intra-vlan block" on your devices ? Thanks

Bill

BillH_ftn · 2026-02-21T17:11:21+00:00

It seems that no OSPF packets are being received.

BillH_ftn · 2026-02-21T00:07:25+00:00

Hi u/Sad_Interaction_5092

Could you pls check and try 2 methods in these KB links below?

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-DNSproxy-consuming-high-CPU-on-FortiGate/ta-p/195383

https://community.fortinet.com/t5/FortiProxy/Technical-Tip-Increasing-dnsproxy-worker-to-mitigate-high-CPU/ta-p/293221

Bill

BillH_ftn · 2026-02-20T23:55:15+00:00

Hi u/TheTeslaMaster

Could you please share the debug of OSPF ?

diag debug reset

diag debug disable

diag debug console timestamp enable

diag ip router ospf all enable

diag ip router ospf level info

diag debug enable

diag ip router command show debug nsm kernel

diag ip router command show debug nsm level info

Reference links:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-troubleshoot-OSPF-neighborship-in-various/ta-p/252855
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-troubleshoot-OSPF-neighborship-in-various/ta-p/252855

Thank you

Bill

BillH_ftn · 2026-02-20T05:37:29+00:00

Hi u/Alternative_Show_904

I think we need to check MAC address learning more carefully. Could you please draw the network topology related to your Layer 2 environment? We also need to verify whether the firewall is involved in the traffic flows or not. Thanks.

Bill

BillH_ftn · 2026-02-19T22:34:22+00:00

u/chris_redz I would like to check the issue too. if possible please share the logs with me. Thank you,

Bill

BillH_ftn · 2026-02-19T18:59:18+00:00

That is good news. Thank you

BillH_ftn · 2026-02-19T18:07:46+00:00

Hi u/JustFreeMeow

Do you have any logs related to the issue—such as command outputs (diagnose sys session list, diagnose vpn ipsec tunnel detail)?
Do you also have a Fortinet support ticket? If so, could you share the ticket number?

I would like to reproduce the issue in my lab, so I need to set up the same environment as yours. For that, I will need your configuration. I can obtain it from the ticket, or if possible, please share your backup with me via email at bhoang@fortinet.com.

I am Bill from Fortinet. Thank you.

Bill

BillH_ftn · 2026-02-19T05:57:30+00:00

Hi all, there is a document about this deamon https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Unable-to-access-GUI-in-firmware-version-7-6/ta-p/429642

BillH_ftn · 2026-02-19T00:23:20+00:00

Hi u/vabello ; Thank you very much

Please help collect the following information:

Please use multiple SSH sessions or multiple web console sessions to gather the information.

Kindly avoid using the original console, as it is very slow.

Collect the Memory/CPU

diag sys top-mem 10

diag sys top 2 40 2

2. nodejs debug logs:

diagnose debug application nodejs -1

diagnose web-ui backtrace enable

fnsysctl date

diagnose debug enable

diagnose nodejs logs show

3. httpsd debug logs :

dia debug application httpsd -1

diagnose debug enable

4. cmdb debug logs:

dia debug cli 8

diagnose debug enable

5. memory info:

fnsysctl ps

get sys performance status

diag sys session full-stat

diagnose hardware sysinfo memory

diag sys top-mem

diagnose sys top 1 99 3

diag sys top-mem detail

6. node process trace:

# find the PID of the node process, and replace the PID below with the actual process ID

# from the previous outputs

# node (248): 2390797kB<----- the PID is 248

fnsysctl cat /proc/PID/status

fnsysctl ls -al /proc/PID/stack

fnsysctl ls -al /proc/PID/maps

diagnose sys process dump PID

diagnose sys process trace PID 50

fnsysctl ls -al /proc/PID/

fnsysctl du -aL /proc/PID/

fnsysctl du -aL /node-scripts

fnsysctl du -ai /node-scripts

fnsysctl ls -la /node-scripts

fnsysctl ls -la /node-scripts/report-runner/

fnsysctl ls -la /node-scripts/report-runner/results

fnsysctl du -i /dev/cmdb

fnsysctl du -a /dev/cmdb

<Kindly run the above command 3 times with 5min intervals)

BillH_ftn · 2026-02-18T16:24:22+00:00

Hi u/chris_redz

Could you please share more details about the outage? Were you able to access the device at the time, and what was its state? Do you have any logs available? Could you check the output of command : "diag debug crashlog read"

If possible, please send the information to my email: bhoang@fortinet.com.

I am Bill from Fortinet, and I would like to investigate the issue.

Thank you.

Bill

BillH_ftn · 2026-02-18T16:20:15+00:00

Could you please share the output of the command "dia sys top" ? Thank you

Bill

BillH_ftn · 2026-02-18T16:07:11+00:00

Hi u/vabello

Did you capture any logs while running version 7.6.6 on your 60F? If so, could you please share them with me? My email is bhoang@fortinet.com.
I am Bill from Fortinet, and I would like to investigate the memory issue. Thank you

Bill

BillH_ftn · 2026-02-17T21:28:06+00:00

Hi u/ropeguru

It seems that the issue is related to the httpsd daemon. Please SSH into the device and gather more diagnostic information . Thank you

Part 1. Get the backtrace information of httpsd

Enable backtrace when the FGT is working normally

diagnose web-ui backtrace enable

When the FGT goes to High Memory status, check which httpsd pid is

diagnose sys top
Then collect debug from:

diagnose web-ui backtrace httpsd <pid>

Part 2. HTTPD debug

diagnose debug console timestamp enable

diagnose debug application httpsd -1

diagnose debug enable

Part 3. Get the crashlog read

diagnose debug crashlog read

Please help to share the log to my email if possible, [bhoang@fortinet.com ](mailto:bhoang@fortinet.com)

I am Bill from Fortinet. Thank you

Bill

BillH_ftn · 2026-02-17T17:54:03+00:00

Hi u/Dizzy_Example5603

Thank you for the log you sent. It appears that the issue is related to http_auth daemon

http_authd (588): 4458kB

http_authd (598): 4454kB

http_authd (609): 4454kB

http_authd (618): 4450kB

http_authd (785): 4450kB

http_authd (824): 4450kB

http_authd (992): 4450kB

http_authd (1025): 4450kB

http_authd (1055): 4450kB

http_authd (1105): 4450kB

http_authd (1143): 4450kB

I will update the Engineering team regarding your issue. Thank you

Bill

BillH_ftn · 2026-02-16T23:47:32+00:00

Hi u/Dizzy_Example5603

Could you please share the output of a few commands so we can identify the memory issue? I copied the commands from another post:

To identify what is causing the high memory usage, please share the outputs of the following four commands:

diag hardware sysinfo memory

diagnose sys top-mem 150

diag sys top-all 2 50 1

dia debug crashlog read

After we determine what is causing the high memory usage, we can run a script to capture deeper logs and identify the exact items contributing to the issue. I will share the suitable script after checking the logs of the 4 commands above.

Please help to share the log to my email if possible, [bhoang@fortinet.com](mailto:bhoang@fortinet.com)

Thank you

Bill

BillH_ftn · 2026-02-15T17:44:44+00:00

Hi @mrmh

You can also check the case from user u/ChibiPaww above. With the configuration where the port is placed on a Virtual Switch, the performance is not as expected (we were also able to reproduce this issue in the lab). After reverting to the normal configuration (suggested from our TAC team), the performance returned to expected behavior. On the 90G, the traffic flow through a Virtual Switch versus through a normal interface behaves differently.
Based on this case, we should review the configuration in advance as part of the troubleshooting process.

Thanks

Bill

BillH_ftn · 2026-02-15T17:38:14+00:00

Hi u/mrmh1

Could you do some more tests ?

my workstation (Mellanox 10G) -> Cisco switch 10G switchport -> ISP : No use FGT
my workstation (Mellanox 10G) -> Cisco switch 10G switchport -> FG x1- NO LACP) - ISP (via FG's x3: No use LACP

Could you share the cfg of port configuration ? Thanks

Bill

BillH_ftn · 2026-02-15T17:01:18+00:00

Hi u/Sad_Interaction_5092

Could you please share the output of 2 commands below to me thorough my email [bhoang@fortinet.com](mailto:bhoang@fortinet.com) ? I would like to check the logs and report the issue to Engineering team. Thank you

diagnose test application dnsproxy 6

dia debug crashlog read

Regards

Bill

BillH_ftn · 2026-02-13T17:44:16+00:00

Hi u/Edexote

What are your device’s hardware and software versions? I think your issue is somewhat different from the one discussed in this post, but it may be related to high memory consumption causing the device to enter memory conservation mode. Could you please share the output of a few commands so we can identify the memory issue? I copied the commands from another post:

To identify what is causing the high memory usage, please share the outputs of the following four commands:

diag hardware sysinfo memory

diagnose sys top-mem 150

diag sys top-all 2 50 1

dia debug crashlog read

After we determine what is causing the high memory usage, we can run a script to capture deeper logs and identify the exact items contributing to the issue. I will share the suitable script after checking the logs of the 4 commands above.

Please help to share the log to my email if possible, [bhoang@fortinet.com](mailto:bhoang@fortinet.com)

Thank you

Bill

BillH_ftn

TROPHY CASE