More management connections than expected for one device
The FortiGate 7000E may show more management-related network activity than most FortiGate devices. This occurs because many management functions are handled independently by each FIM and FPM.
For example, when a FortiGate 7000E first starts up, the FIMs and FPMs perform their DNS lookups. Resulting in more DNS-related traffic during startup than expected for a single device. Once the system is processing data traffic, the amount of management traffic would be proportional to the amount of traffic the system is processing.