What's Happening?
A technical issue has been identified where FortiGate-VM instances running on Proxmox experience high CPU utilization, reaching approximately 99%, when security profiles are enabled on firewall policies. This occurs even with minimal or no traffic passing
through the firewall. Conversely, disabling these security profiles causes the CPU utilization to return to normal levels. The root cause has been traced to the FortiGate-VM being configured with the KVM64 virtual CPU model. This specific CPU model does not expose the SSE4.2 instruction set, which is a requirement for Hyperscan, a technology used by FortiGate for security inspection features. The absence of this instruction set forces the system to use less efficient processing methods, leading to the observed high CPU consumption.
Why It's Important?
This issue is significant for organizations utilizing FortiGate-VM on Proxmox, particularly those in the U.S. that rely on these virtual firewalls for critical network security. High CPU consumption directly impacts the performance and efficiency of the virtual firewall, potentially leading to network slowdowns, dropped connections, and an inability to effectively process security inspections. This can compromise the overall security posture of an organization, leaving networks vulnerable to threats that the security profiles are designed to mitigate. For businesses, this translates to potential operational disruptions, increased IT costs due to troubleshooting and resource allocation, and a heightened risk of cyberattacks. Ensuring optimal performance of security infrastructure is paramount for maintaining business continuity and data integrity.
What's Next?
To resolve the high CPU consumption issue, the recommended solution is to change the virtual CPU type in Proxmox to a model that supports SSE4.2. Fortinet suggests using CPU models such as x86-64-v2-AES, x86-64-v3, x86-64-v4, or 'host'. System administrators and IT professionals managing FortiGate-VM deployments on Proxmox will need to implement this configuration change to restore optimal performance and ensure effective security inspection. Failure to address this could lead to continued performance degradation and security vulnerabilities. Fortinet's community forums and support channels will likely provide further guidance and best practices for implementing this solution, ensuring that customers can maintain robust cybersecurity defenses.
Beyond the Headlines
This technical issue highlights the intricate dependencies between virtualized environments and specialized software features, particularly in critical areas like cybersecurity. It underscores the importance of careful system configuration and compatibility checks when deploying virtual appliances. Beyond the immediate fix, this incident points to the broader challenge of optimizing performance in virtualized security solutions, where resource allocation and hardware-software interactions can significantly impact effectiveness. It also emphasizes the need for vendors to provide clear guidance on recommended configurations for their products in various virtualized settings. For the cybersecurity industry, such issues drive continuous improvement in product design and deployment strategies, aiming for seamless integration and maximum efficiency in protecting digital assets.
