FortiGate IPS Engine Fail Open or Fail Closed: diagnose test application ipsmonitor

FortiGate · Techclick CLI troubleshooting lab

After an IPS engine crash, some sites die and some pass. Security asks if you are fail-open.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on FortiGate for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Know the fail-open setting and the engine state. ipsmonitor tells you if the engine is dead and what the policy will do next.

Why this ticket shows up

A dead IPS engine can drop inspected traffic (fail-closed) or skip inspection (fail-open). Teams argue policy while the engine is just crashed.

Symptoms operators actually see

• ipsengine crash in crashlog

• Inspected policies stall

• CPU spike then drop

• Recent IPS database update

CLI first — copy this block

Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

diagnose test application ipsmonitor 1
diagnose test application ipsmonitor 99
diagnose ips session status
diagnose debug crashlog read
get system performance status

How to read that output

If the engine is not running, fail-open will pass uninspected traffic and fail-closed will look like an outage. Read the setting before you restart.

Triage order

1. Read IPS engine state

2. Note fail-open vs closed

3. Restart ipsengine during an approved window if crashed

4. Roll back the last IPS DB if it started after an update

5. Watch crashlog for a repeat

Classic traps

What you see	Real cause	Fix
Disable IPS on every policy	Engine crashed once	Restart the engine
Assume fail-open	This tenant is fail-closed	Read the setting
Ignore because ping works	Inspected HTTPS is dead	Ping bypasses IPS

Proof the ticket is closed

• ipsmonitor shows engine running

• Inspected sites load

• No new crashlog lines

Say this in an interview

I check whether IPS is fail-open or fail-closed before I call an outage a policy problem.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/