BGP Dynamic Routing Table Overflow Killing 'routerd' on Desktop Appliances
Receiving full Internet BGP routing tables (>950,000 prefixes) on FortiGate desktop platforms (FG-40F, FG-60F, FG-70F, FG-80F) with limited 2GB–4GB RAM causes total memory exhaustion, triggering the Linux kernel Out-Of-Memory (OOM) killer to terminate routerd and dump all dynamic WAN routes.
Technical Root Cause Analysis
The FortiOS routing daemon (routerd) maintains the Routing Information Base (RIB) for all configured dynamic routing protocols. When establishing an eBGP session with an upstream Tier-1 or transit ISP without an explicit inbound route-map filter or prefix limit, the remote peer advertises the complete global IPv4 routing table (exceeding 950,000 routes in 2026).
Storing 950k+ prefixes along with BGP attributes (AS_PATH, Next_Hop, MED, Communities, and Multi-Exit Discriminators) requires approximately 1.5 GB to 1.9 GB of heap memory. On desktop appliances featuring 2 GB or 4 GB of total system RAM, the kernel, IPS engine, WAD proxy, and logging daemons already occupy over 60% of physical pages. When routerd rapidly allocates slabs to parse incoming NLRI updates, the system hits total memory exhaustion. The Linux kernel oom_killer activates, computes badness scores, and sends a SIGKILL (signal 9) to /bin/routerd.
Affected Firmware & Blast Radius Matrix
| Hardware Family | Installed RAM | Max Recommended BGP Prefixes | Vulnerability Status |
|---|---|---|---|
| FortiGate 40F / 60F | 2 GB | < 10,000 prefixes | Critical: Immediate OOM kill on full table |
| FortiGate 70F / 80F | 4 GB | < 50,000 prefixes | Critical: Conserve mode & OOM kill |
| FortiGate 100F – 600F | 8 GB – 16 GB | Up to 500,000 prefixes | Warning: Moderate memory pressure |
| FortiGate 1000F+ | 32 GB+ | 2,000,000+ prefixes | Clean: Hardware RIB/FIB capable |
Software Scope: FortiOS 7.0 (7.0.6–7.0.15), FortiOS 7.2 (7.2.0–7.2.7), and FortiOS 7.4 (7.4.0–7.4.3). While this is an architectural memory capacity limitation, FortiOS 7.4.4+ and 7.2.8+ introduced kernel guardrails that proactively warn and reject excessive NLRI streams.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands via the FortiGate administrative console to verify prefix counts, routerd memory consumption, and kernel OOM crash records:
Diagnostic Commands
# 1. Check current received BGP prefix counts per neighbor
get router info bgp summary
# 2. Inspect active memory consumption of the routing daemon
diagnose sys top-mem 10 | grep routerd
# 3. Verify total routes currently installed in kernel routing table
get router info routing-table all | grep -c "via"
# 4. Check system crashlog for Out-Of-Memory (OOM) killer invocations
diagnose debug crashlog read | grep -E "oom-killer|Out of memory|killed process.*routerd"Remediation & Workaround Steps (Teaser Preview)
Follow the non-disruptive mitigation guide in the Ferrite interactive platform to restore routing stability without service interruption:
Frequently Asked Questions
A full IPv4 Internet table exceeds 950,000 routes, requiring ~1.8GB of RAM for path attributes. On 2GB/4GB entry models, this overwhelms physical memory and triggers the Linux kernel OOM killer.
When routerd terminates, active BGP sessions flap. After hold timers elapse, all dynamic routes are removed from the forwarding table, causing complete loss of WAN connectivity.
Desktop models should only receive default route (0.0.0.0/0) or a strictly limited subset of carrier routes (<10,000 prefixes) enforced via prefix-lists and maximum-prefix limits.