Forticlient - IGMP storms

[rashley]

Hi All,

We recently started installing the Forticlient due to a virus outbreak that was not caught by Symantec.  On top of the virus, for a week I have been dealing with random IGMP storms on the LAN and I cannot seem to track it down.  I was worried a couple of our servers had something malicious on them that was causing them to send out all this traffic.  It would cripple our server vLAN and it is very random.  Sometimes I can do a day without any storms, but other times it happens an hr or two after rebooting the servers.

I did find one post about someone having a broadcast, or multicast storm and it was the Forticlient that seemed to be the culprit.  Has anyone else noticed this type of behavior, especially when installed on a VMware VM?

I started installing two new Server 2012 VM's on Friday.  The only thing I installed, aside from Windows updates, was the Forticlient and later on the network was flooded with IGMP traffic again.  It really seems like something with this client causing the storms.  I have ran 3 different antivirus scans on the original servers I was worried about and they came back clean in each scan, so it's got to be something else, like the Forticlient causing some IGMP storms for some reason.

Thanks in advance

Ryan

[jpplante · Accepted solution]

Actually they confirmed one piece of known information.  The Application Firewall has been known to cause this.  I have seen this in other posts and tickets.  The first question they asked me was whether the App Firewall was enable or not.  In my case the App firewall was not enabled this time (I already learned that lesson) as it caused my first IGMP storm.

I narrowed things down this time to "Block known communcation channels used by attackers" in the AV section of the client.  I was fine until I enabled that feature.  

Also it is important to note that I have not had a single issue on any of my Mac OSX systems with those same features installed.  So I am sure it is a bug in the Windows Client.  

We do not use the Forticlient on servers as we have a virtualized infrastructure using vshield.  The systems I know for sure are affected are Windows 7.

JP

[jpplante]

I spoke with support today.  They had called me on another issue I had.  Long story short he confirmed 5.4.1 was supposed to be released last week but due to some last minute findings was delayed.  It is slated to release again sometime next week.  This update is suppose to fix the application firewall and such.  

[merlinus98]

Hello all 

Glad to find this post today.

Since more than a month, I have experienced some strange behavior on my network.

It was stable for more than 3 years.

Only noticeable change, installation of FortiClient and MalwareBytes on all PC's, little by little, and also FortiClient on some VM (like 2 of my 3 AD W2012R2 servers  ).

What a wonderful idea 

The collapsing network has happened 6 times since, more and more quickly at each time.

The latest was last Thursday, Saturday and Monday!

I had tried many things, shutting down 10Gbps core switches, SAN network, ESX servers, no way.

A specialist in networking helped me finding that it was a multicast storm... but very strange, as it was turning between PC's (mostly W7 and W10), sometime claiming to come from another IP that doesn't matches its own MAC!

He never saw that in its more than 15 years of networking.

I had only the auto-update setting, no application firewall.

Even tried to update my FG90D cluster to newly 5.4.1 to try solving... and discover in the release notes that I should also install a FortiClient 5.4.1 that... simply didn't exist at this time.

Shame on Fortinet for the lack of communication of this kind of problem (and I'm reseller), it costs me two days of non production for my company, and around 5 days/night/week-end for me.

Difficult to open a case when you don't understand which is the cause.

All FortiClient uninstalled this afternoon, looking with great fear for a 5.4.1 FortiClient 

[rashley]

Hi,

Yes it has been a very frustrating bug.  It took me a week to even guess it was the Forticlient.  I'm going to a Fortinet event tomorrow and will be bringing it up to their techs.  I am curious what, if anything, they know about it.

[merlinus98]

Hi Rashley

At the time I write this, no news for FortiClient 5.4.1: perhaps can you ask them tomorrow?

Thanks :)

[rashley]

I will definitely be bringing this up.  I'll post what I find out

[jpplante]

Fortigate version 5.4.1 is out, but not Forticlient.  To make matters worse, some poor individuals upgraded the Fortigate thinking its just around the corner.  However, the Forticlient 5.4.0 stopped working with the Fortigate altogether.  You need Forticlient 5.4.1 in order to work with that version of Fortigate.  Of course it does not exist yet, so they are out of luck altogether unless they downgrade.  

I am not sure what Fortinet is thinking here but obviously the two groups are NOT in touch.  Discouraging really.

[merlinus98]

FortiClient 5.4.1 available!

Extract of bug solved:

301241 FortiClient may generate multicast traffic

Let's try 

[merlinus98]

Two PC's installed since 2 days... no problem: go for my 50+ workstation/servers!

[merlinus98]

22 FortiClient installed so far, no multicast storm at this moment...

Begin to breathe again :)

[MikePruett]

Glad they fixed that. REALLY glad you guys caught it before I pushed that version of the client to one of my clients! That would have been a nightmare.