Fortinet insights

By centralizing FortiGate device metrics through FortiManager proxy, teams can detect sustained packet loss, jitter spikes, or latency increases across SD-WAN links before these conditions trigger user complaints. Historical trends reveal gradual degradation patterns.

FortiGate devices with CPU near 100% or low memory produce symptoms identical to WAN link degradation - slow application response, timeouts, and connection failures. Without device health visibility, teams waste time investigating upstream providers or application code.

Even 2%+ packet loss drastically reduces TCP throughput, causing users to report slow application performance that appears unrelated to network issues. Continuous ping tests reveal packet loss that debug flow and throughput tests may miss.

IPS engines consuming 40-60% CPU per core in user space indicates traffic inspection overload. Multiple ipsengine processes showing sustained high CPU usage point to insufficient capacity for inspection volume.

When memory usage exceeds 90%, FortiGate enters conserve mode, causing services like antivirus to enter failopen mode (bypassing inspection) and reducing overall throughput. This appears as degraded performance across all services.

SD-WAN rules using 'Best Quality' strategy with latency-only criteria can select links with high packet loss (24-51%) because they have lower latency. This causes critical applications like Teams to perform poorly despite 'healthy' link selection.

Sudden drops in session setup rate from baseline (e.g., 80 sessions/min to 0-3 sessions/sec) indicate proxy overload or VDOM session limits being reached. This manifests as application timeouts and connection refusals before CPU or memory appear critical.

SNMP queries fail silently when the community string in the monitoring tool doesn't match the FortiGate configuration, or when the polling server IP isn't in trusted hosts. Traffic reaches the device but no response is returned.

Non-unique interface indexes cause the SNMP daemon (snmpd) to crash with signal 6 (abort), breaking all SNMP monitoring. This occurs when multiple interfaces share the same index value.