Technical Tip: Change session TTL on firewall policy

Description

This article describes how to change session TTL for all traffic matching a firewall policy, as it is sometimes required.

Scope

FortiGate.

Solution

This change can be made by CLI:

config firewall policy
    edit [rule number]
        set session-ttl [seconds]
end

Example:

config firewall policy
    edit 1
        set session-ttl 1500
end

Note:

This configuration only affects traffic or connections that match the policy.  It will override the global timeout setting if defined by using 'config system session-ttl'.
Also session-ttl-> Enter an integer value from <300> to <2764800> or (special = <0>). Numbers defined are in seconds as mentioned above.

In a FortiGate firewall policy, the setting session-ttl to special = <0> means that the session will use the global TTL setting defined in config system session-ttl. This effectively overrides any specific TTL value set in the policy, defaulting to the global session timeout value.

When Central-SNAT is enabled, and FortiGate is operating in Policy-Based mode, the session-ttl must be configured within the Firewall Policy, not the Security Policy. In this mode, firewall policies can only be managed through the CLI. To apply a custom TTL, it is necessary to create a new firewall policy and position it before the default policy.

Example:

config firewall policy
     edit 1
         set name "Default"
         set srcintf "any"
         set dstintf "any"
         set srcaddr "all"
         set dstaddr "all"
         set srcaddr6 "all"
         set dstaddr6 "all"
         set service "ALL"
         set ssl-ssh-profile "certificate-inspection"
    next
end

config firewall policy

    edit 2
        set name "Custom_Policy"
        set srcintf "LAN"
        set dstintf "WAN"
        set srcaddr "HostX"
        set dstaddr "HostY"
        set service "TCP_1555_TTL_24hrs"
        set session-ttl 86400
        set ssl-ssh-profile "certificate-inspection"
    next
end

Note: Move the policy ID 2 before the policy ID 1.

If there is a requirement to disable the session timeout completely, configure the commands below.

For policy :

config firewall policy
    edit <policy-id>
        set session-ttl never 
    next
end

For service:

config firewall service custom
    edit "tcp_23"
        set tcp-portrange 23          
        set session-ttl never 
    next
end

Related articles:

Technical Tip: Customizing Session TTL in FortiOS

Technical Tip: How to remove session timeouts