FortiGate Conserve Mode: diagnose hardware sysinfo conserve When New Sessions Die

FortiGate · Techclick CLI troubleshooting lab

Firewall is up. New sessions fail. Logs mention conserve mode. Nobody wants to reboot during business hours.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on FortiGate for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

conserve mode is memory pressure. Find what ate RAM, fail new proxy sessions if needed, then clear the abuser. Reboot is last.

Why this ticket shows up

FortiOS protects itself by refusing new resource-heavy sessions when memory is low. Existing sessions may still pass, which confuses helpdesk.

Symptoms operators actually see

• New proxy/AV sessions fail

• Existing pings work

• conserve mode log

• Memory above the red threshold

CLI first — copy this block

Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

diagnose hardware sysinfo conserve
diagnose hardware sysinfo memory
get system performance status
diagnose sys top 5 20
diagnose firewall iprope lookup

How to read that output

conserve tells you red/yellow and which daemons are large. A runaway scan or a memory leak in WAD/proxy is common.

Triage order

1. Confirm conserve red vs yellow

2. Identify the fat process with diagnose sys top

3. Restart that daemon if it is a known leak, not the whole box

4. Lower inspection on a noisy policy temporarily

5. Plan content-process restart after hours if needed

Classic traps

What you see	Real cause	Fix
Reboot immediately	You can recover RAM	Restart the fat daemon
Disable AV globally	One policy is scanning archives	Tune that policy
Ignore because ping works	New users cannot connect	Ping is not the dataplane

Proof the ticket is closed

• conserve is off

• New sessions form

• Memory back to normal

Say this in an interview

Conserve mode is a memory circuit breaker. I treat it as a process problem, not an ISP problem.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/