What happens to Fortigate cluster in Active/Standby setting when the IPS engine crashes

[HolgerZ]

Version is 6.4.12
In which state is the Fortigate cluster after the IPS crashes on the active member?
Or does the IPS crash affect the whole cluster and not only the active member?
What is the state of the IPS engine after the crash?
What is the default fail-open behaviour of the IPS in this version?

[Shilpa1]

Hello HolgerZ,

In a FortiGate cluster operating in Active/Standby mode, where one unit serves as the active member and the other as the standby member, the behavior depends on the specific configuration and the impact of the IPS engine crash.

Here are the possible scenarios:

1. IPS Engine Crash on the Active Member:

   • If the IPS engine crashes on the active member, the active member's IPS functionality will be affected. The IPS engine will stop inspecting traffic, and the active member may log the crash event.
   • The standby member, however, should remain unaffected by the IPS engine crash on the active member. It will continue to operate normally and perform traffic inspection using its own IPS engine, if enabled.

2. Impact on the Cluster:

   • The IPS engine crash typically does not affect the overall functionality of the FortiGate cluster. The cluster will continue to operate, and the standby member should take over as the new active member, assuming all other services are functioning correctly.
   • It's important to note that if the cluster synchronization is configured correctly, the configuration and session information from the active member should be replicated to the standby member, ensuring a smooth transition.

3. State of the IPS Engine:

   • After the IPS engine crashes on the active member, its state will depend on the specific situation. It may attempt to restart automatically or require manual intervention to restore functionality.
   • It's recommended to review the FortiGate logs and monitor the system to ensure the IPS engine resumes normal operation.

4. Default Fail-Open Behavior:

   • The default behavior of the IPS engine in FortiGate version 6.4.12 is typically fail-open. In the event of an IPS engine crash or failure, the IPS will fail-open, meaning that it will stop inspecting traffic but allow it to pass through without further inspection.
   • This behavior is intended to prevent any disruption to network traffic in case of IPS failures, ensuring continuity while the issue is resolved.

However, it's important to note that fail-open behavior can be modified through specific configuration settings and policies.  More information in the below link.

Technical Tip: IPS - 'socket size' and 'fail-open'... - Fortinet Community

Regards,
Shilpa C.P