FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
tana
Staff
Staff
Article Id 354972
Description This article describes a situation when FortiGate is unreachable after a FortiGuard update where on boot logs it is showing the error message of IPS engine hang. 
Scope

FortiGate version 7.0.14.

Solution

Check on the FortiGate boot logs, it will show the problem :

 

Initializing firewall...

System is starting...
Starting system maintenance...
Scanning /dev/sda2... (100%)
Scanning /dev/sda3... (100%)
Suspicious lib /data/lib/libips.so is loading
load ips engine hang... kill it
Restarting system.

 

Firstly, power cycle the FortiGate and lower the security level on the BIOS menu. 

 

FortiGate-60F
Ver:05000009
Serial number: FGT60XXXXXXXXXXXXXX
CPU: 1200MHz
Total RAM: 2 GB
Initializing boot device...
Initializing MAC... NP6XLITE#0
Please wait for OS to boot, or press any key to display configuration menu. <-- Press any key.

During the reboot process, FortiGate will print a message on the console 'press any key to display configuration menu', then press a key to access the BIOS.

[C]: Configure TFTP parameters.
[R]: Review TFTP parameters.
[T]: Initiate TFTP firmware transfer.
[F]: Format boot device.
[I]: System information. <-- Select this by pressing 'I'.
[B]: Boot with backup firmware and set as default.
[Q]: Quit menu and continue to boot.
[H]: Display this list of options.

 

Enter C,R,T,F,I,B,Q,or H:


[S]: Set serial port baudrate.
[R]: Set restricted mode.
[T]: Set menu timeout.
[U]: Set security level. <-- Select this by pressing 'U'.
[I]: Display system information.
[E]: Reset system configuration.
[P]: Normal POST test.
[Q]: Quit this menu.
[H]: Display this list of options.

 

Enter S,R,T,U,I,E,P,Q,or H:
[0]: Level 0 - Check image silently
[1]: Level 1 - Check image with result only
[2]: Level 2 - Check image and reinforce validity
Enter security level setting [2]: 0 <--- Enter 0 for now.

 

After this, the FortiGate should be able to boot up successfully. 

At the time of writing of this article, the FortiOS version 7.0 has reached the end of engineering support. 

Therefore, the permanent solution should be to proceed to update the firmware to the latest patch version to update the IPS engine, refer to Technical Tip: Recommended Release for FortiOS.

Contributors