Fortigate 200E HIGH CPU USAGE - IPS problem

[sanda]

Hi, Did anyone faced an issue were suddenly Windows devices were sending big amount of DNS traffic to Actve Directory - which eventually leads to conserve mode on FortiGate device, We reach like 300k sessnions.. I heard that Windows has weird behaviour where there is a DNS high latency - then Windows is starting "flood" dns requests for whatever reason.. Im no sure if its true, but I dont see any other reason. Of cousrse there is no DDoS or any other malicious thing :)

Im starting to thinking that 200E maight be not enough for such amount of traffic, but its not explainging why Windows is behaving like this - I met this scenerio a few time in different companies as well.

FortiOS: 7.0.14

[adambomb1219]

How do you know conserve mode is related to high amounts of DNS traffic?  Does that traffic from the endpoints to AD even cross the 200E?  

[AEK]

Hi Sanda

Yes I saw the same issue few months ago on a FG 1800F FOS 7.0.12.

We did the following to fix it:

• Disable traffic log for DNS sessions. If needed you can create a policy at top for matching only DNS traffic and disable logs for that policy (this will probably fix your issue)
• Give a short TTL to DNS (UDP 53), like 20s is more than enough
• Find the RCA and fix this DNS rush from client side. In our case there was a software on many clients repeating the same DNS queries because it was not replied for some reason
• Update FOS to the latest patch. You may update it to 7.0.15