IPS engine is crashing

[gilbile_nilesh]

please find below network diagram to understand the  issue.

we have three different subnet which are directly connected trough unmanageable D-link switches.

rules are made on the firewall itself for connecting to different subnet.

My issue is

when i tried to send large data from one subnet to another subnet (i.e using windows protocol / folder sharing transfer) ips engine is crashing all time and giving me an error saying  

"IPS enter fail open mode: engines=1 socketsize=8388608 sessionact=pass

IPS exit fail open mode"

I had logged the case with fortinet technical team and they had suggested me to upgrade the firmware.(currently i m on firmware version 5.0 patch 9 ). 

does this issue will reslove after upgrading the firmware or is their any alternative solution to this?

(if i will upgrade the firmware to 5.0 patch 11 will it work

does the ips version will change or remains same. i m avoiding for upgrading firmware version to 5.2 because some of the feature are not present e.g top client by bandwidth  )

please let me know 

[gilbile_nilesh]

Hi 

please find the output for the from command line for the intra-traffic rule.

please let me know if we can disable the ips for the intra-lan traffic or not and how to do that.

does it will have any impact or firewall performance? 

[rdumitrescu]

Hi,

If the traffic hit this policy it shouldn't be inspected by the ips, since the utm features are disabled.

   set utm-status disable  -> from the file that you attached

You could perform this command to disable the ips engine until next reboot or until you re-enable it.

diag test application ipsmonitor 2

[gilbile_nilesh]

if i want to disable the ips traffic for intra-lan traffic then i need to run these command under the CLI.

set utm-status disable

set ips disable.

is it right?

and doing so does it impact the any other policy (e.g. lan to wan policy)?

also if i have any web service running on the policy where i m disabling the ips then web ,sql services get any impact or it will run as always?

[gilbile_nilesh]

Thanks, a lot to all

as per the fortinet TAC I need to upgrade the firmware to the latest one.

but i have one fear in my mind as the latest firmware is (i.e 5.2.3 or 5.2.2) not having "top client by bandwidth" widgets in the setting as i wanted to know who is using the most bandwidth in the company so that i can warn that user & keep the internet uses smooth for day to day operation.

so i wanted to know if any how these feature  "top client by bandwidth" is tobe setup or fortinet will add these in the futures updates.

also if i upgrade the firmware to 5.0.11 then my issue will get resolved. does 5.0.11 will have the different ips version or not ?

currently i m on version 5.0.9 

[gilbile_nilesh]

Thanks, a lot to all   as per the fortinet TAC I need to upgrade the firmware to the latest one. but i have one fear in my mind as the latest firmware is (i.e 5.2.3 or 5.2.2) not having "top client by bandwidth" widgets in the setting as i wanted to know who is using the most bandwidth in the company so that i can warn that user & keep the internet uses smooth for day to day operation. so i wanted to know if any how these feature  "top client by bandwidth" is tobe setup or fortinet will add these in the futures updates. also if i upgrade the firmware to 5.0.11 then my issue will get resolved. does 5.0.11 will have the different ips version or not ? currently i m on version 5.0.9 

[gilbile_nilesh]

Thanks, a lot to all   as per the fortinet TAC I need to upgrade the firmware to the latest one. but i have one fear in my mind as the latest firmware is (i.e 5.2.3 or 5.2.2) not having "top client by bandwidth" widgets in the setting as i wanted to know who is using the most bandwidth in the company so that i can warn that user & keep the internet uses smooth for day to day operation. so i wanted to know if any how these feature  "top client by bandwidth" is tobe setup or fortinet will add these in the futures updates. also if i upgrade the firmware to 5.0.11 then my issue will get resolved. does 5.0.11 will have the different ips version or not ? currently i m on version 5.0.9 

[emnoc]

In short "set utm-status disable" will disable the  applied IPS sensor on just THAT policy. To answer the other side of the question, not the setting above will effect just THAT policy by disabling the IPS sensor.

I would find the latest FortiOS ips guide and study that and then make and monitor corrections  for improvements.

Did you not heed the advice and read the ips/dos configuration guide that was mention earlier like a few days back? Then you will have a better ideal of what's going on and follow the TAC suggestion with your case..

You probably still have something else wrong if the firewall ips is failing.