|
When observation on the FortiGate with IPS entering fails open mode frequently:
...
msg="IPS session scan resumed, exit fail open mode."
msg="IPS session scan, enter fail open mode"
msg="IPS session scan resumed, exit fail open mode."
msg="IPS session scan, enter fail open mode"
...
This might lead to a few suspects:
- High usage of Memory/ CPU:
Check if there is any high Memory/CPU on the FortiGate:
diagnose sys top
get sys performance status
- IPS having a crash:
Use the below command to check if there is a constantly crashed:
diag debug crashlog read
- If none of the above, that might be caused by out-of-buffer on the IPS:
Check the IPS buffer setting on the FortiGate by:
diag test app ipsmonitor 1
Try to increase the IPS buffer by:
config ips global
set socket-size <x>
end
If the issue still persists, kindly collect the info above and contact Fortinet support.
Related Document:
Technical Tip: IPS - 'socket size' and 'fail-open' mode
|
