We recently started installing the Forticlient due to a virus outbreak that was not caught by Symantec. On top of the virus, for a week I have been dealing with random IGMP storms on the LAN and I cannot seem to track it down. I was worried a couple of our servers had something malicious on them that was causing them to send out all this traffic. It would cripple our server vLAN and it is very random. Sometimes I can do a day without any storms, but other times it happens an hr or two after rebooting the servers.
I did find one post about someone having a broadcast, or multicast storm and it was the Forticlient that seemed to be the culprit. Has anyone else noticed this type of behavior, especially when installed on a VMware VM?
I started installing two new Server 2012 VM's on Friday. The only thing I installed, aside from Windows updates, was the Forticlient and later on the network was flooded with IGMP traffic again. It really seems like something with this client causing the storms. I have ran 3 different antivirus scans on the original servers I was worried about and they came back clean in each scan, so it's got to be something else, like the Forticlient causing some IGMP storms for some reason.
Actually they confirmed one piece of known information. The Application Firewall has been known to cause this. I have seen this in other posts and tickets. The first question they asked me was whether the App Firewall was enable or not. In my case the App firewall was not enabled this time (I already learned that lesson) as it caused my first IGMP storm.
I narrowed things down this time to "Block known communcation channels used by attackers" in the AV section of the client. I was fine until I enabled that feature.
Also it is important to note that I have not had a single issue on any of my Mac OSX systems with those same features installed. So I am sure it is a bug in the Windows Client.
We do not use the Forticlient on servers as we have a virtualized infrastructure using vshield. The systems I know for sure are affected are Windows 7.
"Block known communcation channels used by attackers" stops Botnet communications and the like. Its definitely a feature worth having. I mentioned before the other option I enabled this time was Auto Update. I am going to test the auto update option without the block all comm option.
I am hoping its as easy as "turn on feature, problem arises" and not some sort of perfect cocktail situation. If a single option is causing the issue it will be easy to circumvent and will give Fortinet ammo to find the real issue.
I spoke with support today. They had called me on another issue I had. Long story short he confirmed 5.4.1 was supposed to be released last week but due to some last minute findings was delayed. It is slated to release again sometime next week. This update is suppose to fix the application firewall and such.
Since more than a month, I have experienced some strange behavior on my network.
It was stable for more than 3 years.
Only noticeable change, installation of FortiClient and MalwareBytes on all PC's, little by little, and also FortiClient on some VM (like 2 of my 3 AD W2012R2 servers ).
What a wonderful idea
The collapsing network has happened 6 times since, more and more quickly at each time.
The latest was last Thursday, Saturday and Monday!
I had tried many things, shutting down 10Gbps core switches, SAN network, ESX servers, no way.
A specialist in networking helped me finding that it was a multicast storm... but very strange, as it was turning between PC's (mostly W7 and W10), sometime claiming to come from another IP that doesn't matches its own MAC!
He never saw that in its more than 15 years of networking.
I had only the auto-update setting, no application firewall.
Even tried to update my FG90D cluster to newly 5.4.1 to try solving... and discover in the release notes that I should also install a FortiClient 5.4.1 that... simply didn't exist at this time.
Shame on Fortinet for the lack of communication of this kind of problem (and I'm reseller), it costs me two days of non production for my company, and around 5 days/night/week-end for me.
Difficult to open a case when you don't understand which is the cause.
All FortiClient uninstalled this afternoon, looking with great fear for a 5.4.1 FortiClient
Yes it has been a very frustrating bug. It took me a week to even guess it was the Forticlient. I'm going to a Fortinet event tomorrow and will be bringing it up to their techs. I am curious what, if anything, they know about it.
Fortigate version 5.4.1 is out, but not Forticlient. To make matters worse, some poor individuals upgraded the Fortigate thinking its just around the corner. However, the Forticlient 5.4.0 stopped working with the Fortigate altogether. You need Forticlient 5.4.1 in order to work with that version of Fortigate. Of course it does not exist yet, so they are out of luck altogether unless they downgrade.
I am not sure what Fortinet is thinking here but obviously the two groups are NOT in touch. Discouraging really.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.