Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
gilbile_nilesh
New Contributor

IPS engine is crashing

please find below network diagram to understand the  issue.

we have three different subnet which are directly connected trough unmanageable D-link switches.

rules are made on the firewall itself for connecting to different subnet.

My issue is

when i tried to send large data from one subnet to another subnet (i.e using windows protocol / folder sharing transfer) ips engine is crashing all time and giving me an error saying  

 

"IPS enter fail open mode: engines=1 socketsize=8388608 sessionact=pass

IPS exit fail open mode"

 

 

I had logged the case with fortinet technical team and they had suggested me to upgrade the firmware.(currently i m on firmware version 5.0 patch 9 ). 

does this issue will reslove after upgrading the firmware or is their any alternative solution to this?

 

(if i will upgrade the firmware to 5.0 patch 11 will it work

does the ips version will change or remains same. i m avoiding for upgrading firmware version to 5.2 because some of the feature are not present e.g top client by bandwidth  )

 

 

please let me know 

 

 

16 REPLIES 16
gilbile_nilesh
New Contributor

Hi 

 

please find the output for the from command line for the intra-traffic rule.

please let me know if we can disable the ips for the intra-lan traffic or not and how to do that.

does it will have any impact or firewall performance? 

rdumitrescu
New Contributor III

Hi,

 

If the traffic hit this policy it shouldn't be inspected by the ips, since the utm features are disabled.

   set utm-status disable  -> from the file that you attached

 

You could perform this command to disable the ips engine until next reboot or until you re-enable it.

 

diag test application ipsmonitor 2

 

gilbile_nilesh
New Contributor

if i want to disable the ips traffic for intra-lan traffic then i need to run these command under the CLI.

 

set utm-status disable

set ips disable.

 

is it right?

and doing so does it impact the any other policy (e.g. lan to wan policy)?

also if i have any web service running on the policy where i m disabling the ips then web ,sql services get any impact or it will run as always?

gilbile_nilesh

Thanks, a lot to all

 

as per the fortinet TAC I need to upgrade the firmware to the latest one.

but i have one fear in my mind as the latest firmware is (i.e 5.2.3 or 5.2.2) not having "top client by bandwidth" widgets in the setting as i wanted to know who is using the most bandwidth in the company so that i can warn that user & keep the internet uses smooth for day to day operation.

so i wanted to know if any how these feature  "top client by bandwidth" is tobe setup or fortinet will add these in the futures updates.

also if i upgrade the firmware to 5.0.11 then my issue will get resolved. does 5.0.11 will have the different ips version or not ?

currently i m on version 5.0.9 

gilbile_nilesh

Thanks, a lot to all   as per the fortinet TAC I need to upgrade the firmware to the latest one. but i have one fear in my mind as the latest firmware is (i.e 5.2.3 or 5.2.2) not having "top client by bandwidth" widgets in the setting as i wanted to know who is using the most bandwidth in the company so that i can warn that user & keep the internet uses smooth for day to day operation. so i wanted to know if any how these feature  "top client by bandwidth" is tobe setup or fortinet will add these in the futures updates. also if i upgrade the firmware to 5.0.11 then my issue will get resolved. does 5.0.11 will have the different ips version or not ? currently i m on version 5.0.9 

gilbile_nilesh

Thanks, a lot to all   as per the fortinet TAC I need to upgrade the firmware to the latest one. but i have one fear in my mind as the latest firmware is (i.e 5.2.3 or 5.2.2) not having "top client by bandwidth" widgets in the setting as i wanted to know who is using the most bandwidth in the company so that i can warn that user & keep the internet uses smooth for day to day operation. so i wanted to know if any how these feature  "top client by bandwidth" is tobe setup or fortinet will add these in the futures updates. also if i upgrade the firmware to 5.0.11 then my issue will get resolved. does 5.0.11 will have the different ips version or not ? currently i m on version 5.0.9 

emnoc
Esteemed Contributor III

In short "set utm-status disable" will disable the  applied IPS sensor on just THAT policy. To answer the other side of the question, not the setting above will effect just THAT policy by disabling the IPS sensor.

 

I would find the latest FortiOS ips guide and study that and then make and monitor corrections  for improvements.

 

Did you not heed the advice and read the ips/dos configuration guide that was mention earlier like a few days back? Then you will have a better ideal of what's going on and follow the TAC suggestion with your case..

 

You probably still have something else wrong if the firewall ips is failing.

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors