|
On systems where a high CPU load is suspected to be caused by IPS-based scanning, the IPS engines can be set to 'bypass' mode.
The following command can be used for testing to confirm if the CPU load is caused by IPS.
Note that this will bypass all IPS scanning.
The commands are intended for testing or in urgent cases of high CPU load as a temporary workaround.
Use the command below to bypass the IPS engine.
diagnose test application ipsmonitor 5
bypass: enable
In this mode, the IPS is running but it is not inspecting traffic.
- If the CPU usage decreases the test indicates that the volume of traffic inspected is too high for that particular FortiGate model.
- If the CPU usage is still high the test indicates that the problem is not with the IPS engine.
After proceeding to disable the bypass with the same command:
diagnose test application ipsmonitor 5
bypass: disable
|
