Troubleshooting Tip: VPN passthrough sessions remain active after routing failover

Description

This article describes how existing VPN passthrough sessions may remain active and continue using their original session state following a routing failover between sites. Even though the routing table updates to reflect the new path, established sessions are not automatically re-evaluated against the new topology and remain active until they expire, are manually cleared, or undergo a VPN rekey.

Scope

• FortiGate 6501F - A high-throughput platform.

• FortiOS v7.2 and later.

Solution

This behavior is the expected result of the global system setting 'firewall-session-dirty' being configured to 'check-new'.

config system settings
    set firewall-session-dirty check-new
end

Under this configuration, routing and policy changes are applied exclusively to newly created sessions. To dictate how the FortiGate handles existing sessions during a failover, adjust the 'firewall-session-dirty' setting based on security and performance needs:

check-all: Default.

• Behavior: When a change occurs, affected existing sessions are marked as dirty and revalidated against the updated routing information. Sessions that no longer conform are blocked and removed.

• Considerations: Recommended for environments requiring immediate security enforcement. However, on high-throughput platforms, revalidating massive numbers of hardware-accelerated sessions can temporarily increase CPU utilization.

check-new:

• Behavior: Existing sessions are ignored during a routing change and continue operating on their previous state until they naturally expire or are manually cleared.

• Considerations: Reduces CPU processing overhead during large-scale network changes, but introduces a security trade-off by allowing potentially non-conforming sessions to temporarily persist.

To clear them now: filter on the affected sessions first, then clear only that filtered set — running the clear command with no filter drops every session on the box.

diagnose sys session filter src <affected-src-ip/subnet>
diagnose sys session filter dst <affected-dst-ip/subnet>
diagnose sys session clear

It is suggested to list the sessions before clearing them by using the command 'diagnose system session list'.

The list with the filters to clear only the affected sessions can be found in Troubleshooting Tip: FortiGate session table information.