Technical Tip: Intermittent reboot when FortiGate handles IPv6 traffic with IPS profile

Note: The issue requires specific configuration and traffic conditions to reproduce, and there are several other possible causes for a firewall reboot. If unexpected reboots have not occurred before, it is likely another issue.

Diagnosis:

A console log taken at the time of the crash, or comlog if available, may show the following output if encountering this issue:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
...

Call Trace:
<IRQ>
ipv6_rcv+0xb/0x50
netif_proto_receive_skb+0x19f/0x2f0
if_ops_default_input+0xc/0x10
diagnose sys session6 l
br_pass_frame_up_finish+0x1b/0x20
nf_hook_slow+0xf6/0x150
NF_HOOK+0x13/0x20

See the following articles for information on collecting a console or comlog:

• Troubleshooting Tip: How to deal with a Kernel panic
• Technical Tip: How to use the COMLog feature

If an unexpected reboot occurs on FortiGate 70G/71G, refer to the article Technical Tip: FortiGate-70G/71G experiencing unexpected reboots after upgrading to FortiOS v7.6.5 or later (known issue).

Workaround:

Remove the IPS profile from firewall policies handling IPv6 traffic.

config firewall policy

    edit <index>

        unset ips-sensor

    next

end

Resolution:

The issue is tracked internally by ID 1214384. A fix for this issue is scheduled for inclusion in FortiOS v7.4.12 and v7.6.7.