Troubleshooting Tip: The av-mem-limit feature does not work properly when setting 'set av-failopen pass' in FortiGate

1. On the FortiGate unit, configure the av-mem-limit feature:

config ips global

    set av-mem-limit xx

end

xx is an integer value from <10> to <50>.

2. Configure av-failopen with the pass as follows:

config system global

    set av-failopen pass

end

Option 'pass': New sessions are bypassed. AV scanning resumes when FortiGate exits conserve mode.

3. The av-mem-limit feature does not work with the setting 'set av-failopen pass'.

To fix:

1. For a workaround with a temporary fix:

config system global

    set av-failopen <off or one-shot>

end

The 'off' option: New sessions are dropped, but process current active sessions.
The 'one-shot' option: Bypass the antivirus system when memory is low.

2. For a permanent fix:

It is necessary to upgrade FortiGate firmware version to be v7.4.6, v7.6.1, or above.