Skip to main content
kjay
Staff
kjay
Staff
September 4, 2025

Technical Tip: Unexpected Behavior of UDP Session Duration in Forward Traffic Logs on FortiGate

  • September 4, 2025
  • 0 replies
  • 909 views
Description This article describes an observed anomaly in FortiGate systems where the 'UDP session duration' recorded in Forward Traffic logs may appear inconsistent with the configured session timeout values.
Scope

FortiGate before v7.4.2.
Solution

Although UDP session duration is designed to follow the configured udp-idle-timer parameter, instances have been identified where the duration reported in Forward Traffic logs exceeds the defined threshold.

 

config system global
    set udp-idle-timer 180
end

 

Forward Traffic logs have displayed session durations greater than 180 seconds. Further verification via the session table revealed that the expire value was negative, resulting in session durations surpassing the configured idle timer.

 

duration.jpg

 

diagnose sys session list | grep duration
session info: proto=17 ... duration=182 expire=-2 ...
session info: proto=17 ... duration=183 expire=-3 ...

 

Root cause and resolution:

  • This behavior is associated with an anomaly present in versions earlier than v7.4.2.

  • The issue does not occur in v7.4.5 and has been confirmed as resolved beginning with v7.4.2.

 

duration2.jpg

 

Recommended action:
Users observing this anomaly are advised to perform a firmware upgrade to  v7.4.2 or later to ensure consistency between configured UDP idle timers and the reported session durations in logs.
      Terms & ConditionsAccessibility statement