Skip to main content
A
Anonymous_User
Contributor
August 21, 2011
Question

Fortigate 60C freezes up

  • August 21, 2011
  • 7 replies
  • 7478 views
Every 10-14 days or so, my Fortigate 60C has needed to be power cycled to become operational again. If I try to login to the 60C from the Lan to see what' s going on, I get the login screen but it has printed above the graphic: " Warning: this page requires Javascript. To correctly view, please enable it in your browser" , and when I enter my credentials nothing happens. If I power cycle the 60C at this point, I can login and everything seems normal and there is no message about Javascript. Obviously this Javascript message had nothing to do with the browser I was running. I also went to other machines in the office and none of them could connect to the 60C. They all can login to the Fortigate60C now that the Fortigate 60C has been rebooted. When the Fortigate60C is in this state (when I can' t login), some LAN initiated http traffic is allowed but other http traffic is either blocked or so slow as to appear blocked. Because of other things I have read on this forum, I thought this might have been a low memory issue and so I turned off memory logging a week ago, but now it has happened again just now. Anyone have any suggestions how I should proceed to debug this? My old Fortigate 60 never had such problems but its power supply died and I " upgraded" to the 60C.

    7 replies

    bmann
    bmann
    New Member
    August 21, 2011
    Maybe you can login over CLI and look what is happening. or some workaround: config system global set daily-restart enable set restart-time hh:mm end Set it to night time and you will have fresh system each morning.
    A
    Anonymous_UserAuthor
    Contributor
    August 21, 2011
    Thank you bmann! I had enabled syslog to my server and looking at that it seems that the " system entered system conserve mode" at 22:51 last night and then each service hit " session fail" shortly thereafter. I had my " alert email" threshold at " alert" but now I have changed it to " Critical" so that I might get notified when this happens. I have extracted the following from that log: 
      2011-08-20 22:51:50	Local7.Critical	192.168.1.253	date=2011-08-20        time=22:36:27 devname=FGT60C3G10022930 device_id=FGT60C3G10022930        log_id=0100022802 type=event subtype=system pri=critical vd=root        service=im sysconserve=on total=440 free=39 entermargin=40        exitmargin=60 msg=" The system has entered system conserve mode"      2011-08-20 22:51:50	Local7.Critical	192.168.1.253	date=2011-08-20        time=22:36:27 devname=FGT60C3G10022930 device_id=FGT60C3G10022930        log_id=0100022800 type=event subtype=system pri=critical vd=root        service=im mode=activated msg=" The system has activated session fail mode"     2011-08-20 22:51:51	service=http mode=activated session fail  2011-08-20 22:51:51	service=smtp mode=activated session fail  2011-08-20 22:51:52	service=pop3 mode=activated session fail  2011-08-20 22:51:52	service=imap mode=activated session fail  2011-08-20 22:51:52	service=ftp mode=activated session fail  2011-08-20 22:51:53	service=nntp mode=activated session fail
    What might I be doing that causes this?
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 22, 2011
    Hi, several things come to my mind: - if you' re running 4.3.x and you' re not absolutely depending on it' s features downgrade to 4.2.8 or 4.1.10 - see all the posts on the forum about the fact that the quality of the 4.3 code is still improving... - if you use UTM then focus on the ressources the IPS (or App Control) are using. If you use IPS don' t activate a whole category, filter on the type of traffic early on and restrict logging. - you may enable logging the CPU and memory status for a while to see how these evolve over time - get all posts about the 60C from the forum and compare. There have been a lot of posts about excessive memory consumption, sometimes caused by a buggy IPS engine. If you' re suspecting this, open a case with Fortinet support to obtain a patch. Generally, if more than 80% of the memory is used the FGT enters conserve mode and begins to shut down non-critical services (like GUI) in favor of critical ones (like firewalling). Good luck.
    A
    Anonymous_UserAuthor
    Contributor
    August 23, 2011
    Thank you for the reply! My system info panel tells me that I am running v4.0,build5404,110120 (MR2) Firmware version is FGT60C-4.00-FW-build303-110120 Current memory usage is 60% With 164 concurrent seesions. I only support 6 users including an exchange server that sees about 100-200 emails a day with a peak of 5-10 a minute during the day. I believe my IPS settings are unchanged from factory settings: 
     Sensor                Count     all_default            4473   all_default_pass       4473   protect_client         2154   protect_email_server    168   protect_http_server    1303
    Logging is enabled, but I have seen no log entries from IPS. I had perf-stats logged for a couple of days, but there was no pattern of increased growth of memory usage tha I detected. Should I think about TTL settings? Should I upgrade from 4.0 to 4.1.10 or 4.2.8 ?
    bmann
    bmann
    New Member
    August 22, 2011
    What is your link? How many users are you protecting? Avoid 4 MR3 version for some time. If system falls to conserve mode, it can be bloking new connections. # this will allow new connections, but will not scan with av config system global set av-failopen pass set av-failopen-session enable end if you have " off" in " av-failopen" it will block all connections until end of conserve mode.
    bmann
    bmann
    New Member
    August 23, 2011
    If I rember right, build 303 is patch3 of MR2 version = 4.2.3 This is not good version (I remember some ssl vpn memory problem etc.), upgrade to patch8. Number of users is OK, but tune little your box. - ips - make own specific profile, do not use default - antivirus - set max. scan size to 1 or 2 MB, there is no reason to scan more at gateway box. 99.9% of viruses spreads to this sizes. - do not log to memory if you don' t need it for debug etc. For other tips go to knowledge base and look for perfomance tips.
    A
    Anonymous_UserAuthor
    Contributor
    August 24, 2011
    Thanks bmann. I set up an IPS profile - there was no profile previously. I can' t see where to limit antivirus scan size, it seems this is not for flow but only for proxy scanx? I am not logging to memory, only to disk and syslog. I' ve asked my 3rd party provider to get patch8 for us. New I wait and see.
    bmann
    bmann
    New Member
    August 24, 2011
    FlowAV: - hasn' t size limit - is faster then proxy based AV - limited detection of some malware type, so less secure For patch3 do not use ssl vpn, can be memory hug. Hope patch8 will help.
    A
    Anonymous_UserAuthor
    Contributor
    October 8, 2011
    This issue has finally been solved. Memory was being eaten by the fgfmd process. Although I do not have a FortiManager, my configuration had " Enable FortiManager" checked in the Central Management tab. Once that was unchecked, memory use stopped climbing. Hopefully this will help somebody else.
    Terms & ConditionsAccessibility statement