What happens when a FortiGate’s CPU enters conserve mode?

FortiGate enters conserve mode when system memory usage crosses the red (mem-low) threshold. To reduce further RAM consumption, FortiOS immediately turns off all proxy-based UTM engines and automatically reverts security profiles to flow-based inspection. Existing sessions continue and normal forwarding/routing functions remain; only features that rely on proxy workers are suspended. Traffic therefore still passes, but without proxy-based scanning.

A. All traffic is blocked – Conserve mode uses flow-based inspection so traffic continues; only proxy functions stop.

C. New sessions are dropped – Sessions are accepted until the mem-sup/oom level; dropping begins only in extreme (memory-dead) stage, not at entry to conserve mode.

D. Routing protocols are disabled – Routing daemons stay active; conserve mode targets memory-intensive proxy services, not routing.

1. Fortinet

“FortiOS 6.4 Administration Guide – System performance: Conserve mode

” pp. 110–111.

2. Fortinet KB Article FD36238 “Explanation of conserve mode and memory thresholds

” sections ‘mem-low actions’ & ‘proxy-to-flow switch’.

3. Fortinet NSE7-ADVANCED Threat Protection Courseware

Module 3 “Memory management

” slide 18.