Forticlient - IGMP storms

[rashley]

Hi All,

We recently started installing the Forticlient due to a virus outbreak that was not caught by Symantec.  On top of the virus, for a week I have been dealing with random IGMP storms on the LAN and I cannot seem to track it down.  I was worried a couple of our servers had something malicious on them that was causing them to send out all this traffic.  It would cripple our server vLAN and it is very random.  Sometimes I can do a day without any storms, but other times it happens an hr or two after rebooting the servers.

I did find one post about someone having a broadcast, or multicast storm and it was the Forticlient that seemed to be the culprit.  Has anyone else noticed this type of behavior, especially when installed on a VMware VM?

I started installing two new Server 2012 VM's on Friday.  The only thing I installed, aside from Windows updates, was the Forticlient and later on the network was flooded with IGMP traffic again.  It really seems like something with this client causing the storms.  I have ran 3 different antivirus scans on the original servers I was worried about and they came back clean in each scan, so it's got to be something else, like the Forticlient causing some IGMP storms for some reason.

Thanks in advance

Ryan

[jpplante · Accepted solution]

Actually they confirmed one piece of known information.  The Application Firewall has been known to cause this.  I have seen this in other posts and tickets.  The first question they asked me was whether the App Firewall was enable or not.  In my case the App firewall was not enabled this time (I already learned that lesson) as it caused my first IGMP storm.

I narrowed things down this time to "Block known communcation channels used by attackers" in the AV section of the client.  I was fine until I enabled that feature.  

Also it is important to note that I have not had a single issue on any of my Mac OSX systems with those same features installed.  So I am sure it is a bug in the Windows Client.  

We do not use the Forticlient on servers as we have a virtualized infrastructure using vshield.  The systems I know for sure are affected are Windows 7.

JP

[merlinus98]

Hello.

Just to confirm, all Forticlient 5.4.1 reinstalled since, no problem.

Just a little glitch (already existing in 5.4.0), Windows 10 Security Center sometimes popup a "no active anti-virus" message a few seconds, then disappears (like FC doesn't answer for a few seconds?); out-of-scope for this post.

[lokean13]

I really wish this had been a thread that I would have seen last January when my network was getting constant floods and I couldn't figure it out.  It was FCT that whole time.  I "fixed" it by turning Multicasting off on the printers and setting up vlans, but wish I would have found this out.