Maxim Kazachek When a FortiGate enters conserve mode, it is protecting itself: memory usage has crossed a preset threshold, so FortiOS starts changing how it handles new traffic to avoid a crash. It is a symptom of memory pressure, not a hardware fault. To fix it you need to confirm memory is the real bottleneck, find what is consuming it, and either tune the load or move to a firewall sized for your traffic. This guide walks through diagnosing and clearing conserve mode on FortiOS 7.4 and 7.6 using the CLI.
Conserve mode
Conserve mode is a self-protection state in FortiOS. When memory usage crosses the “red” threshold (88% of RAM by default), the FortiGate stops accepting new sessions into proxy-based inspection and takes other steps to relieve memory pressure. If usage keeps climbing to the “extreme” threshold (95% by default), it starts dropping new sessions outright. The firewall exits conserve mode automatically once memory falls back below the “green” threshold (82% by default).
Conserve mode is FortiOS telling you it is out of memory headroom. Diagnose it with get system performance status and diagnose hardware sysinfo conserve memory, relieve the pressure by trimming memory-heavy features, and if the box hits conserve mode under normal load it is undersized for your traffic.
What is FortiGate conserve mode and why does it matter?
Conserve mode is a built-in safety net, not a failure. Think of your FortiGate as a security guard that keeps working even when overloaded: when memory runs low, FortiOS deliberately sheds work to stay stable rather than crashing. The trade-off is that some new traffic is no longer inspected or admitted the way it normally would be, so users can feel it as slow or refused connections.
It matters because conserve mode sits directly in the path of your security posture. While the firewall is conserving memory, it may bypass or block the very inspection you deployed it for. Left unaddressed, a FortiGate that dips into conserve mode during busy periods is a warning that your inspection load has outgrown the hardware.
What triggers conserve mode on a FortiGate?
Conserve mode is triggered by memory usage crossing defined thresholds, measured as a percentage of total RAM. FortiOS 7.4 and 7.6 ship with three defaults that you can tune:
- Red threshold (88%): the firewall enters conserve mode and stops sending new sessions to proxy-based inspection.
- Extreme threshold (95%): the panic line. The FortiGate drops new sessions outright, regardless of inspection. This is where users will definitely notice.
- Green threshold (82%): the recovery point. Memory must fall below this before the firewall exits conserve mode and returns to normal.
You can adjust these thresholds to suit your environment under config system global:
config system global
set memory-use-threshold-extreme 95
set memory-use-threshold-red 88
set memory-use-threshold-green 82
endRaising the thresholds does not add memory, it just delays the alarm. If your FortiGate reaches 88% memory under normal daily load, widening the thresholds hides the symptom while the box runs closer to the edge. Treat threshold tuning as a temporary measure, not a fix, and investigate the underlying memory consumption.
What happens to my traffic during conserve mode?
In conserve mode, new sessions that require memory-heavy inspection are affected first, and at the extreme threshold new sessions are dropped entirely. There is also a quieter mechanism that acts even before conserve mode: memory tension drops. If FortiOS needs memory it cannot allocate, it silently drops the oldest sessions to free resources, with no “conserve mode” banner to warn you.
To check whether tension drops are happening, look at the session statistics:
BALANCED+ (global) # diagnose sys session stat
misc info: session_count=75 setup_rate=3 exp_count=0 clash=0
memory_tension_drop=0 ephemeral=0/126976 removeable=0 extreme_low_mem=0
npu_session_count=21
nturbo_session_count=21
delete=10, flush=13, dev_down=274/41 ses_walkers=0
TCP sessions:
26 in ESTABLISHED state
1 in TIME_WAIT stateThe memory_tension_drop counter is the one to watch. A non-zero value means sessions have already been dropped under memory pressure, often the earliest hard evidence that the firewall is running short on RAM.
How do I diagnose a FortiGate memory or performance problem?
Diagnose conserve mode from the CLI in a fixed order: confirm memory is the bottleneck, then drill into what is consuming it. These commands are read-only and safe to run on a production FortiGate.
Step 1 – Get a system snapshot: run get system performance status to see CPU per core, memory used and freeable, session counts, and network load in one view.
Step 2 – Confirm conserve state and thresholds: run diagnose hardware sysinfo conserve memory to see current memory use against the red, extreme, and green thresholds and whether conserve mode is active.
Step 3 – Watch processes in real time: run diagnose sys top to find which processes are burning CPU or memory (press m to sort by memory, q to quit).
Step 4 – Break down memory by type: run diagnose hardware sysinfo memory for a detailed breakdown, and diagnose hardware sysinfo slab for slab (session and NAT) allocation.
A typical get system performance status snapshot looks like this:
BALANCED+ (global) # get system performance status
CPU0 states: 20% user 1% system 0% nice 79% idle 0% iowait 0% irq 0% softirq
CPU1 states: 8% user 2% system 0% nice 90% idle 0% iowait 0% irq 0% softirq
CPU6 states: 67% user 1% system 0% nice 32% idle 0% iowait 0% irq 0% softirq
Memory: 1964036k total, 1346896k used (68.6%), 369604k free (18.8%), 247536k freeable (12.6%)
Average sessions: 45 sessions in 1 minute, 45 sessions in 10 minutes, 44 sessions in 30 minutes
Uptime: 41 days, 5 hours, 18 minutesRead it top to bottom. High “user” or “system” percentages with low “idle” point to CPU load; a high memory “used” percentage with little “freeable” points to memory pressure and possible conserve mode. FortiGate memory falls into distinct categories, and knowing which is growing tells you where to look:
- Kernel memory: used by the operating system and drivers.
- Shared memory: shared across processes, often for databases like IPS.
- User space: memory consumed by individual processes (for example,
httpsd). - Cached memory: disk caching to speed up operations.
- Slab memory: pre-allocated for structures like sessions and NAT entries.
To inspect shared memory specifically, use diagnose hardware sysinfo shm:
BALANCED+ (global) # diagnose hardware sysinfo shm
SHM FS total: 1379164168 (1315 MB)
SHM FS free: 1376931840 (1313 MB)
SHM FS avail: 1376931848 (1313 MB)
SHM FS alloc: 2232320 (2 MB)Is it a memory problem or a CPU problem?
Conserve mode is always a memory problem, but a slow FortiGate is not always in conserve mode, so separate the two before you act. Use get system performance status: if memory “used” is high and climbing toward the red threshold, treat it as a memory issue and follow the conserve-mode path. If memory is comfortable but one or more CPU cores sit near 0% idle, the bottleneck is CPU, usually a single core pinned by proxy inspection or a busy process you can spot in diagnose sys top.
On multi-core FortiGates, look at each core individually, not the average. Proxy-based inspection and some daemons are single-threaded, so one core can be pinned at 100% while the average still looks healthy. A single saturated core is a common cause of “the firewall feels slow” reports that a whole-box average would hide.
How do I fix and prevent conserve mode?
To clear conserve mode you need to reduce memory usage below the green threshold, then keep it there. Work from the least disruptive change to the most:
Step 1 – Identify the consumer: use diagnose sys top and the memory breakdown commands to pin down which process or feature is driving usage before changing anything.
Step 2 – Trim memory-heavy features: review the biggest offenders, WAN optimization, proxy-based inspection, verbose logging and report generation, and threat feed updates. Switch policies to flow-based inspection where proxy features are not required.
Step 3 – Add resources where you can: on FortiGate VMs, allocate more RAM. On physical appliances, confirm hardware acceleration (NP and CP offload) is enabled so inspection is offloaded from the CPU.
Step 4 – Engage Fortinet TAC for tuning: worker process counts and per-daemon tuning should be adjusted with TAC guidance, not guessed at. If conserve mode recurs after tuning, it is a sizing problem, not a configuration one.
You may read advice to kill a runaway process (diagnose sys process pidof <name> then diagnose sys kill <signal> <PID>, using signal 15 for a graceful stop). Reserve this for controlled test environments or explicit Fortinet TAC direction. Killing a process on a production firewall can drop services and rarely addresses the root cause.
When does conserve mode mean my FortiGate is undersized?
If your FortiGate hits conserve mode during normal business hours, with features configured sensibly, the hardware is undersized for your inspection load. Enabling full SSL inspection, IPS, and application control multiplies memory and CPU demand, and the throughput on a spec sheet assumes lighter processing than a fully inspecting mid-market network runs. Tuning buys headroom; it does not add capacity.
For SMB and mid-market deployments, the current generation is the FortiGate G-series (30G, 50G, 70G, 90G) built on the FortiSP5 security processor, succeeding the F-series (40F, 60F, 80F). The F-series is still sold and supported with no end-of-life announced, but any new multi-year purchase should be priced on the G-series, which delivers meaningfully higher threat-protection throughput for the inspection features that push a FortiGate into conserve mode in the first place.
2-3x
Higher threat-protection throughput on the FortiSP5-based G-series versus the F-series it replaces (Fortinet)
| F-series (previous) | G-series successor | Security processor |
|---|---|---|
| FortiGate 40F | 30G / 50G | FortiSP5 |
| FortiGate 60F | 70G | FortiSP5 |
| FortiGate 80F | 90G | FortiSP5 |
If you are refreshing FortiGate hardware, size the replacement on your real inspection throughput (SSL inspection plus IPS enabled), not on firewall throughput alone. Our managed firewall services cover FortiGate sizing, deployment, and ongoing performance tuning so the box you buy carries your traffic with headroom to spare.
Get expert help with FortiGate performance
BALANCED+ is a Fortinet Advanced Partner with deep experience tuning and right-sizing FortiGate firewalls for mid-market networks across Toronto and the GTA. If your firewall keeps dipping into conserve mode, or you want a sizing check before your next hardware refresh, we can analyze your environment and give you a clear answer. Reach out to discuss keeping your FortiGate fast, inspecting, and stable.
Paul Thresher 
