Statefull inspection and SSH sessions

Daniel, Are you certain the FortiGate is killing the session and not the remote servers? You could also try enabling null pings within putty(or whatever program youre using) to keep the session alive. The default session TTL should be an hour, at least on 5.2.

Other usefull commands; diag sys session ttl to monitor the ssh ports diag sys session filter dport 22 diag sys session list

Hello! I had the same problem after started using FG60D. I tried SSH keepalives, but that didn' t help. I found that there is another way, although I don' t know yet if it works, I just entered this configuration. Our FG60D has " v5.2.0,build0589 (GA)" .

  config system session-ttl          config port              edit 22                  set protocol 6                  set timeout never                  set start-port 22                  set end-port 22              next          end  end  

Putting it together:

 gate # diag sys session ttl  list session timeout:  Default timeout=3600  protocol=17 port=[53-53] timeout=90

emnoc is right in stating that the default session timeout is 3600 seconds. As you can see in my example I' ve shortened DNS session lifespan to 90 seconds on my FGT. So what echo did was to define a protcol/port specific idle session timeout. Assuming the OP has not changed the default it' s clear that the session is closed from the remote side (i.e. the server).

Also you might need to have a look at a holistic level sometimes to figure why the sessions are dropping. Just found recently during troubleshooting a similar session dropping issue that F5 LTMs on a network will kill the session if they think that either their local session TTL is reached or assuming that nothing is happening because they are not detecting any communication within the session. So if you followed all the other advices above and you still have the issue, you then need to investigate if any other device between your developers and the other end potentially is killing the sessions. The challenge is that sometimes you have no visibility about the full stack, just don' t be quick to jump the gun and blame the FGT.

Now my ssh outside is still up since yesterday so that " config system session-ttl" helped. There is danger, yes, that in time they fill up something, but we don' t have such massive outside ssh.