Expiring connections

Forum|Forum|19 years ago
January 15, 2007
9 replies
8015 views

How can I set/adjust the length of time before a connection/session expires? This is on: Fortigate-60 2.80,build519,060809 This is really for ssh connections. I find it annoying that they will expire after 5 minutes (300s, default), since I often have several log-ins open to do different things. To be real clear: this relates to any IP connection, not VPN sessions or HTTP auth for the Fortigate' s web interface. Expiration time can be found under the " Session" tab in " System->Status" (web interface). I don' t seem to find it in the interface, I have looked in the manual and searched this forum with no success. Thanks, Laurent

AKrause

New Member

300 secs is default for UDP session, 3600 secs for TCP sessions. you can modify the session timeouts per port: config system session-ttl regards, Andreas

A

Anonymous_UserAuthor

Contributor III

Ah, thank you, only in the CLI. In case someone were to read this: it' s actually " session_ttl" (with underscore). Cheers, Laurent

AKrause

New Member

Okay.. in MR3 it' s indeed config system session-ttl regards, Andreas

A

Anonymous_UserAuthor

Contributor III

i got the same problem on 200A and tried 2 config 1. config system session-ttl set default 18000 end 2. config system session-ttl set default 36000 config port edit 22 set timeout never next end end ssh connections are still terminated after around an hour, and the sessions are still displayed in system->statistics->sessions, and on the server side, the login is still there, what config is still missing ?

AKrause

New Member

Hi Irene, you have got to distinguish between firewall-sessions and application-sessions. The application (in your case ssh-daemon) might keep its own session-timeout as well as the ssh-client. If the sessions are terminated after 60 mins idle and the firewall still has the session open, it is obviously not a firewall config issue! However, it is not a good idea to set an unlimited timeout at fortigate. I wonder if this is possible - it definitely should not be! regards, Andreas

A

Anonymous_UserAuthor

Contributor III

You' re rite, but it seems there' re no timeout in openssh daemon, and before we deploy FGT, i can make a far longer idle session. Tried SecureCRT and putty, but the connection is stll terminated even i have keepalive set in the client Once i apply the default " unfiltered" profile, it works fine. Any idea ?

zentobbe

New Member

Hi, I have the same problem but with http/https aswell as ssh. I use the unfiltered protection profile only, but still got those timeouts.. Any ideas ? brgdrs tobbe

AKrause

New Member

okay, I suggest to identify the part of the protection profile, which causes the problem. Build a clone of your profile and remove filters (AV, IPS, etc..) step by step unteil the timeout disappears. hth, Andreas

romanr

New Member

I got the same problem.... I already mentioned it in: http://support.fortinet.com/forum/tm.asp?m=27876&p=2&tmode=1&smode=1 In the meanwhile I did sniff the problem a bit and it seems that the FGT just loses the session somehow and stops passing packets! Changes on timeouts do not change anything!!! cheers.

Sign up

Login with SSO

Login to the community

Login with SSO