Technical Tip: Default session timeout value (session-ttl)

Description

This article describes the default timeout value (session-ttl) on FortiGate.

Scope

FortiGate.

Solution

FortiGate will keep the session in its session table for a specific time when the session is IDLE. The default value of session-ttl is 3600 seconds, which can be modified.

Global timeout: Adjust the global session-ttl via the CLI, where the range is 300-2764800 seconds:

config system session-ttl
    set default 3600
end

However, the default value of specific protocols can be modified as follows, where protocol 1 is TCMP. More protocol numbers can be found in the related articles at the bottom of this one.

Under 'set protocol', enter an integer value from 0 to 255.

FGT #config system session-ttl
FGT (session-ttl) #config port
FGT (port) #edit 1
FGT (1) #set protocol 1
FGT (1) #end
FGT (session-ttl) #end

The default timeout is 300 seconds:

FGT #show full-configuration system session-ttl
config system session-ttl
    set default 3600
        config port
            edit 1
                set protocol 1
                set timeout 300
            next
        end

Firewall policy and firewall service object TTL timeout: Specifying the session-ttl timeout on the firewall policy and or service object level can override the global TTL. In this example, it is set to 7200 seconds (2 hours):

config firewall policy
    edit <policy-id>
        set session-ttl 7200
    next
end

config firewall service custom
    edit <name>
        set session-ttl 7200
    next
end

In the following order:  

1. Service object.

2. Policy.

3. Config system session-ttl.

The session-ttl can be set to 'never' at the policy or service object level so that idle sessions are never removed from the session table:

config firewall policy
    edit <policy-id>
        set session-ttl never
    next
End

Use this option with caution: sessions that never expire remain in the session table indefinitely and can lead to session table growth and increased memory usage, especially on units handling a high number of connections.

Verification:

To verify the effective TTL applied to a specific session, filter and list the sessions:

diagnose sys session filter dst <destination-ip>
diagnose sys session filter dport <destination-port>
diagnose sys session list

Example output:

session info: proto=6 proto_state=01 duration=50 expire=3550 timeout=3600 flags=00000000

• 'timeout' shows the TTL value applied to the session (from the service object, policy, per-port entry, or global default).

• 'expire' shows the remaining time before the idle session is removed. This counter resets each time the session sees traffic

To clear the filter:

diagnose sys session filter clear

Related document:

• Protocol number

• Technical Tip: Changing the TCP session TTL