Fortigate 60C freezes up

[#1]

Every 10-14 days or so, my Fortigate 60C has needed to be power cycled to become operational again. If I try to login to the 60C from the Lan to see what' s going on, I get the login screen but it has printed above the graphic: " Warning: this page requires Javascript. To correctly view, please enable it in your browser" , and when I enter my credentials nothing happens. If I power cycle the 60C at this point, I can login and everything seems normal and there is no message about Javascript. Obviously this Javascript message had nothing to do with the browser I was running. I also went to other machines in the office and none of them could connect to the 60C. They all can login to the Fortigate60C now that the Fortigate 60C has been rebooted. When the Fortigate60C is in this state (when I can' t login), some LAN initiated http traffic is allowed but other http traffic is either blocked or so slow as to appear blocked. Because of other things I have read on this forum, I thought this might have been a low memory issue and so I turned off memory logging a week ago, but now it has happened again just now. Anyone have any suggestions how I should proceed to debug this? My old Fortigate 60 never had such problems but its power supply died and I " upgraded" to the 60C.

[bmann]

Maybe you can login over CLI and look what is happening. or some workaround: config system global set daily-restart enable set restart-time hh:mm end Set it to night time and you will have fresh system each morning.

[#3]

Thank you bmann! I had enabled syslog to my server and looking at that it seems that the " system entered system conserve mode" at 22:51 last night and then each service hit " session fail" shortly thereafter. I had my " alert email" threshold at " alert" but now I have changed it to " Critical" so that I might get notified when this happens. I have extracted the following from that log:

 2011-08-20 22:51:50	Local7.Critical	192.168.1.253	date=2011-08-20 
      time=22:36:27 devname=FGT60C3G10022930 device_id=FGT60C3G10022930 
      log_id=0100022802 type=event subtype=system pri=critical vd=root 
      service=im sysconserve=on total=440 free=39 entermargin=40 
      exitmargin=60 msg=" The system has entered system conserve mode"  
 
 2011-08-20 22:51:50	Local7.Critical	192.168.1.253	date=2011-08-20 
      time=22:36:27 devname=FGT60C3G10022930 device_id=FGT60C3G10022930 
      log_id=0100022800 type=event subtype=system pri=critical vd=root 
      service=im mode=activated msg=" The system has activated session fail mode" 
 
 2011-08-20 22:51:51	service=http mode=activated session fail
 2011-08-20 22:51:51	service=smtp mode=activated session fail
 2011-08-20 22:51:52	service=pop3 mode=activated session fail
 2011-08-20 22:51:52	service=imap mode=activated session fail
 2011-08-20 22:51:52	service=ftp mode=activated session fail
 2011-08-20 22:51:53	service=nntp mode=activated session fail

What might I be doing that causes this?

[ede_pfau]

Hi, several things come to my mind: - if you' re running 4.3.x and you' re not absolutely depending on it' s features downgrade to 4.2.8 or 4.1.10 - see all the posts on the forum about the fact that the quality of the 4.3 code is still improving... - if you use UTM then focus on the ressources the IPS (or App Control) are using. If you use IPS don' t activate a whole category, filter on the type of traffic early on and restrict logging. - you may enable logging the CPU and memory status for a while to see how these evolve over time - get all posts about the 60C from the forum and compare. There have been a lot of posts about excessive memory consumption, sometimes caused by a buggy IPS engine. If you' re suspecting this, open a case with Fortinet support to obtain a patch. Generally, if more than 80% of the memory is used the FGT enters conserve mode and begins to shut down non-critical services (like GUI) in favor of critical ones (like firewalling). Good luck.

[#5]

Thank you for the reply! My system info panel tells me that I am running v4.0,build5404,110120 (MR2) Firmware version is FGT60C-4.00-FW-build303-110120 Current memory usage is 60% With 164 concurrent seesions. I only support 6 users including an exchange server that sees about 100-200 emails a day with a peak of 5-10 a minute during the day. I believe my IPS settings are unchanged from factory settings:

 Sensor                Count  
  all_default            4473
  all_default_pass       4473
  protect_client         2154
  protect_email_server    168
  protect_http_server    1303
 

Logging is enabled, but I have seen no log entries from IPS. I had perf-stats logged for a couple of days, but there was no pattern of increased growth of memory usage tha I detected. Should I think about TTL settings? Should I upgrade from 4.0 to 4.1.10 or 4.2.8 ?

[bmann]

What is your link? How many users are you protecting? Avoid 4 MR3 version for some time. If system falls to conserve mode, it can be bloking new connections. # this will allow new connections, but will not scan with av config system global set av-failopen pass set av-failopen-session enable end if you have " off" in " av-failopen" it will block all connections until end of conserve mode.

[bmann]

If I rember right, build 303 is patch3 of MR2 version = 4.2.3 This is not good version (I remember some ssl vpn memory problem etc.), upgrade to patch8. Number of users is OK, but tune little your box. - ips - make own specific profile, do not use default - antivirus - set max. scan size to 1 or 2 MB, there is no reason to scan more at gateway box. 99.9% of viruses spreads to this sizes. - do not log to memory if you don' t need it for debug etc. For other tips go to knowledge base and look for perfomance tips.

[#8]

Thanks bmann. I set up an IPS profile - there was no profile previously. I can' t see where to limit antivirus scan size, it seems this is not for flow but only for proxy scanx? I am not logging to memory, only to disk and syslog. I' ve asked my 3rd party provider to get patch8 for us. New I wait and see.

[bmann]

FlowAV: - hasn' t size limit - is faster then proxy based AV - limited detection of some malware type, so less secure For patch3 do not use ssl vpn, can be memory hug. Hope patch8 will help.

[#10]

This issue has finally been solved. Memory was being eaten by the fgfmd process. Although I do not have a FortiManager, my configuration had " Enable FortiManager" checked in the Central Management tab. Once that was unchecked, memory use stopped climbing. Hopefully this will help somebody else.