Technical Tip: Changing the TCP session TTL

[naveenk]

Description

This article describes how to change the session TTL Value using the CLI for the idle TCP sessions.

Scope

FortiGate.

Solution

When the TTL limit is reached, the session is dropped.
 
On FortiGate this is configurable under each firewall policy.
By default each session uses the default TTL value in system wide session-ttl setting.

config firewall policy
    edit <policyID>
        set session-ttl <value>                        <----- Enter an integer value from <300> to <2764800> or (special = <0>).
end

The default TTL value can be configured as shown below.

config system session-ttl
    set default <value>        
    <integer>                                 <----- Value range (300 - 2764800).
end

Note: TTL value is not possible to change via GUI due to it is designed for easier configuration, but advanced tuning (like TTL or kernel-level settings) is CLI-only.