Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rashley
New Contributor

Forticlient - IGMP storms

Hi All,

 

We recently started installing the Forticlient due to a virus outbreak that was not caught by Symantec.  On top of the virus, for a week I have been dealing with random IGMP storms on the LAN and I cannot seem to track it down.  I was worried a couple of our servers had something malicious on them that was causing them to send out all this traffic.  It would cripple our server vLAN and it is very random.  Sometimes I can do a day without any storms, but other times it happens an hr or two after rebooting the servers.

 

I did find one post about someone having a broadcast, or multicast storm and it was the Forticlient that seemed to be the culprit.  Has anyone else noticed this type of behavior, especially when installed on a VMware VM?

 

I started installing two new Server 2012 VM's on Friday.  The only thing I installed, aside from Windows updates, was the Forticlient and later on the network was flooded with IGMP traffic again.  It really seems like something with this client causing the storms.  I have ran 3 different antivirus scans on the original servers I was worried about and they came back clean in each scan, so it's got to be something else, like the Forticlient causing some IGMP storms for some reason.

 

Thanks in advance

Ryan

2 Solutions
jpplante
New Contributor II

Actually they confirmed one piece of known information.  The Application Firewall has been known to cause this.  I have seen this in other posts and tickets.  The first question they asked me was whether the App Firewall was enable or not.  In my case the App firewall was not enabled this time (I already learned that lesson) as it caused my first IGMP storm.

 

I narrowed things down this time to "Block known communcation channels used by attackers" in the AV section of the client.  I was fine until I enabled that feature.  

 

Also it is important to note that I have not had a single issue on any of my Mac OSX systems with those same features installed.  So I am sure it is a bug in the Windows Client.  

 

We do not use the Forticlient on servers as we have a virtualized infrastructure using vshield.  The systems I know for sure are affected are Windows 7.

 

JP

View solution in original post

jpplante
New Contributor II

"Block known communcation channels used by attackers" stops Botnet communications and the like.  Its definitely a feature worth having.  I mentioned before the other option I enabled this time was Auto Update.  I am going to test the auto update option without the block all comm option.  

 

I am hoping its as easy as "turn on feature, problem arises" and not some sort of perfect cocktail situation.  If a single option is causing the issue it will be easy to circumvent and will give Fortinet ammo to find the real issue.

 

 

View solution in original post

21 REPLIES 21
merlinus98

Hello.

Just to confirm, all Forticlient 5.4.1 reinstalled since, no problem.

Just a little glitch (already existing in 5.4.0), Windows 10 Security Center sometimes popup a "no active anti-virus" message a few seconds, then disappears (like FC doesn't answer for a few seconds?); out-of-scope for this post.

 

lokean13
New Contributor

I really wish this had been a thread that I would have seen last January when my network was getting constant floods and I couldn't figure it out.  It was FCT that whole time.  I "fixed" it by turning Multicasting off on the printers and setting up vlans, but wish I would have found this out. 

Top Kudoed Authors