Skip to main content
scheehan_FTNT
Staff & Editor
scheehan_FTNT
Staff & Editor
January 13, 2017

Technical Tip: Information about firewall-session-dirty

  • January 13, 2017
  • 0 replies
  • 28257 views

Description

 
This article describes some information concerning firewall-session-dirty. It provides guidance to help choose the best approach for a given environment.
 
Scope
 
FortiGate.
 
Solution
 
Firewall-session-dirty is a mechanism to make sure that active sessions always stay relevant. Two distinct behaviors would cause an active session to be validated differently.

Available options:
Global Level:
  • Check-all: Re-validate all sessions affected by the firewall policy change. This is the default setting.
  • Check-new: Keep existing sessions and check new connections only.
  • Check-policy-option: Use the option selected in the firewall-session-dirty field of the firewall policy.

 

Screenshot 2026-03-26 164000.jpg

 

The firewall policy-level setting is available only if the VDOM-level setting is set to check-policy-option.

Note:

With the 'Check-all' setting, when the firewall policy is modified, the sessions will be marked as dirty and will revalidate all sessions.
 
A session revalidation refers to the process in which the FortiGate’s CPU verifies whether an established session’s attributes (i.e., src, dst, sport, dport, dintf, policy, etc.) conform to the latest firewall policy or route change. Refer to the Fortinet document for Policy configuration changes.
 
Configuration:
 
config system settings
    set firewall-session-dirty { check-all | check-new | check-policy-option }
end

Policy Level:
  • Check-all:  Re-validate all sessions affected by the firewall policy change. This is the default setting.
  • Check-new: Keep existing sessions and check new connections only.
 
Configuration:
 
config firewall policy
    edit <id>
        set firewall-session-dirty < check-all | check-new >
    next
end
 
Note: The session re-validation would not be triggered by changing the 'firewall-session-dirty' system setting. Only consequent firewall policy changes or route changes for new sessions would trigger the set behavior.
 
Scenario 1:
With firewall-session-dirty check-all, active sessions would be marked as dirty for further firewall policy validation or route changes.
Note that there may be a CPU penalty if there are more than 2,000 firewall policies. For more information, refer to the related KB article.

Validation:
 
diagnose sys session list
Session detail snippet:
state=may_dirty
Event: [changes applied to firewall policy]
state=dirty may_dirty  <----- Sessions marked 'dirty' for firewall policy validation or route changes.
[continuous traffic cause firewall policy and route re-validation>
state=may_dirty <----- Validation done. 'dirty' marker removed.
 
A firewall policy change event means to modify a parameter related to an active/established session.
For example, changing the address object, the service object, the schedule, etc.
 
A route change event could be a new route that has a better preference than the existing route for an active/established session.

Scenario 2:
With firewall-session-dirty check-new, active sessions would be marked as persistent, and no firewall policy validation or route change lookup for existing active sessions would occur.
 
config system settings
    set firewall-session-dirty check-new
end
 
Note that only sessions established after check-new is enabled will have the persistent flag; existing sessions remain unchanged and are not assigned the persistent flag.
 
Validation:
 
diagnose sys session list
Session detail snippet:
state=persistent
 

This setting can restore even a VDOM configuration file without affecting established sessions.

 

To change the firewall-session-dirty option from the FortiManager: Go to Device Manager -> Device & Groups -> Select the FortiGate (for FortiGates without VDOM) and the VDOM (for FortiGates with VDOMs configured) to change the firewall-session-dirty option -> Select the 'CLI Configuration' TAB -> Select the '+' on the left of 'System' -> Select 'Settings' –> Scroll down the System settings list on the right until the firewall-session-dirty row makes it possible to compare and choose available options on the menu to the right.

 

To push the configuration change to the FortiGate, select the Install Device Settings (only) button in the top horizontal bar and follow the Install Wizard.

 

When using NGFW Policy-based mode, the only option available is check-all.

 

Related documents:

    Terms & ConditionsAccessibility statement