Forticlient - IGMP storms

[rashley]

Hi All,

We recently started installing the Forticlient due to a virus outbreak that was not caught by Symantec.  On top of the virus, for a week I have been dealing with random IGMP storms on the LAN and I cannot seem to track it down.  I was worried a couple of our servers had something malicious on them that was causing them to send out all this traffic.  It would cripple our server vLAN and it is very random.  Sometimes I can do a day without any storms, but other times it happens an hr or two after rebooting the servers.

I did find one post about someone having a broadcast, or multicast storm and it was the Forticlient that seemed to be the culprit.  Has anyone else noticed this type of behavior, especially when installed on a VMware VM?

I started installing two new Server 2012 VM's on Friday.  The only thing I installed, aside from Windows updates, was the Forticlient and later on the network was flooded with IGMP traffic again.  It really seems like something with this client causing the storms.  I have ran 3 different antivirus scans on the original servers I was worried about and they came back clean in each scan, so it's got to be something else, like the Forticlient causing some IGMP storms for some reason.

Thanks in advance

Ryan

[jpplante · Accepted solution]

Actually they confirmed one piece of known information.  The Application Firewall has been known to cause this.  I have seen this in other posts and tickets.  The first question they asked me was whether the App Firewall was enable or not.  In my case the App firewall was not enabled this time (I already learned that lesson) as it caused my first IGMP storm.

I narrowed things down this time to "Block known communcation channels used by attackers" in the AV section of the client.  I was fine until I enabled that feature.  

Also it is important to note that I have not had a single issue on any of my Mac OSX systems with those same features installed.  So I am sure it is a bug in the Windows Client.  

We do not use the Forticlient on servers as we have a virtualized infrastructure using vshield.  The systems I know for sure are affected are Windows 7.

JP

[Hediin_Rico]

Its the forticlient, They wont openly admit to it being the client until you bring it up. PM me for my ticket number that you can reference it.

[jpplante]

I am also having this issue.  I have a ticket open.  It is not affecting my Mac OSX systems, only my Windows systems.  It has been known to take down entire segments of my network.  I had this problem when I:

A) turned on Application Control

B) turned on Auto Update

I have not tried to many other items yet because I have to wait for maintenance windows to test things due to the nature of my outages.

JP

[rashley]

Have they given you any other information as to why it does this?  Seems like a pretty serious bug.  It took down our server segment a number of times because I could not trace what the actually issue was.

I'm now in the process of removing Forticlient on the servers and going back to Symantec to test and see if these flooding issues go away

[rashley]

Interesting.  Thanks for the info.  What exactly does the Block known communication channels do?  I also have that enabled for the client workstations, so I'm a bit worried they might start a broadcast storm.

[jpplante · Accepted solution]

"Block known communcation channels used by attackers" stops Botnet communications and the like.  Its definitely a feature worth having.  I mentioned before the other option I enabled this time was Auto Update.  I am going to test the auto update option without the block all comm option.  

I am hoping its as easy as "turn on feature, problem arises" and not some sort of perfect cocktail situation.  If a single option is causing the issue it will be easy to circumvent and will give Fortinet ammo to find the real issue.

[rashley]

OK, that's what I thought.  Yes, it is definitely a feature I would like to have enabled as well.  We have a Fortigate and are about to deploy EMS, but I am worried about these bugs in the software.  I wrestled with these traffic storms on the network for a week before I thought it could be the Forticlient.

Let me know if you have any luck.  Hopefully they release a new version soon and these issues are resolved

[garyxd]

I also have seen the IGMP bug and have it referenced in two tickets.  As of now, very few of our clients are using Application Control due to it.  I got a copy of 5.4 interim build 0830, and I haven't seen it happen with that

[jpplante · Accepted solution]

Actually they confirmed one piece of known information.  The Application Firewall has been known to cause this.  I have seen this in other posts and tickets.  The first question they asked me was whether the App Firewall was enable or not.  In my case the App firewall was not enabled this time (I already learned that lesson) as it caused my first IGMP storm.

I narrowed things down this time to "Block known communcation channels used by attackers" in the AV section of the client.  I was fine until I enabled that feature.  

Also it is important to note that I have not had a single issue on any of my Mac OSX systems with those same features installed.  So I am sure it is a bug in the Windows Client.  

We do not use the Forticlient on servers as we have a virtualized infrastructure using vshield.  The systems I know for sure are affected are Windows 7.

JP

[pacone]

jpplante wrote:

I narrowed things down this time to "Block known communcation channels used by attackers" in the AV section of the client.  I was fine until I enabled that feature. 

JP

Yes Also confirmed as per above. Forticlient was the issue for me as well. The IGMP storm would occur after a new device connected to the network. i.e. an HP printer that was currently turned off, once the device was turned on, the IGMP storm would occur around 4-5 seconds later. The IGMP storm would however originate from my own desktop pc from that point forward. It took down the whole network! 

Two Important notes 

1) Once the flood started removing the HP printer would not correct the issue, I needed to remove my pc from the network to stop the flood. 2) Even though the flood was originating from my pc, the IP address being spammed in the flood was the IP address of the HP Printer (even when the HP Printer was not connected to the network anymore.)

Our FORTI-AP that was directly connected to the Fortigate and which is also on a different subnet went offline when this occurred. As per above I disabled "Block known communication channels used by attackers" on the FortiClients and the problem has now gone. 

I am using Windows 10 on the affected pc.  I spent 4 hours on this and wish that I had read this post first, could have saved me a lot of headache.