Skip to main content
ggntt
ggntt
New Member
August 12, 2011
Question

Auto expiring Session on fortigate

  • August 12, 2011
  • 13 replies
  • 18353 views
Hi On a Fortigate 60, we have a remote app type on environment with vpns connecting a remote site to the server in HQ. Users in the remote off print to their local printer via the HQ server over the vpn. Every second day or so, the server can no longer communicate with the printer until you end/deleted the session, then a new one is created and the jobs print. What I am looking for is a way to enable a time out / expiry on sessions, so if the session between IP addy to IP addy is open for longer than 2 mins say then deleted the session. Is this or something like this possible? Thanks, GNS

    13 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 12, 2011
    Why not make the tunnel stay open all the time? keyword is " auto-negotiate" . Regular firewall sessions do have a timeout (or else the session table would overflow soon). I think the default is like 300 or 600 seconds. If your VPN uses UDP encapsulation (port 500) then it' s a regular UDP session, timing out after 10 minutes idleing. Though I doubt this happens because of the NAT keepalives...
    ggntt
    ggnttAuthor
    New Member
    August 12, 2011
    Hi Ede Thanks for your help. To be honest it does not look like the Tunnel is dropping. We are having a problem with a server on one side and a printer on the other side keeping sessions open after the user logs out of their thin client. When they log back in they cant print until we kill the session on the FW. Not sure if we can get the FW to drop those sessions after a particular amount of time, as its currently not doing that consistently. Thanks g
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 12, 2011
    OK I got it now. Looks more like an application problem but the FGT might help. If you can identify the service used by port number, you could specify the session timeout for that port only to be quite short. Look at this as an example where I shortened DNS session lifetime to get rid of those hundreds of dangling sessions on my FGT:
     config system session-ttl          config port              edit 1                  set protocol 17                  set timeout 90                  set end-port 53                  set start-port 53              next          end  end
    ggntt
    ggnttAuthor
    New Member
    August 12, 2011
    Thanks ede_pfau. I have the service that the port uses ( it is a vpn tunnel). Where do I use the service in your example. When you use " edit 1" I gather 1 is the name of your port! Thanks, GNS
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 12, 2011
    No, 1 is just the first session-ttl defined. Type ' edit 0' to open the next available. Even if the service is used across a VPN tunnel you' d specify it' s designated port number - look at the session table to see it if you' re unsure.
    ggntt
    ggnttAuthor
    New Member
    August 15, 2011
    Okay, thanks ede_pfau, I typed in those commands but when I get to ' set protocol 17' it gives me ' command parse error before ' protocol' ' The version of firmware is 3.00-b0730(MR7 Patch 1) Do you have any relevant commands for this version of firmware? -Thanks GNS
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 15, 2011
    In 3.00 the syntax is
     config system session-ttl  set default <seconds>  config port  edit <port_number>  set timeout {<seconds> | never}  end  end
    and this is effective for TCP only! TCP = protocol 6, UDP = protocol 17, see RFC5237. In v4.00, you can specify TCP, UDP or SCTP. If you want to set a TTL for UDP, you can only upgrade. The ' default' pertains to TCP only.
    ggntt
    ggnttAuthor
    New Member
    August 16, 2011
    Hi Ede, That was accepted in CLI. Lets hope that did the job. Thank you. GNS.
    ggntt
    ggnttAuthor
    New Member
    August 25, 2011
    I still had issues, from a webchat with fortinet support I put in the following config system session-ttl set default 300 (300 secs is the min) config port edit <the destination port> set timeout 300 end end That did the job. Thanks ede_pfau
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 25, 2011
    *puzzled* what exactly did the job then? you' re quoting the exact same syntax that I' ve posted above. Which port did you use? And it doesn' t matter that it' s TCP only? So I gather it wasn' t a UDP session in the first place -? Please clarify.
    Show more replies
    Terms & ConditionsAccessibility statement