Description
This article describes how to enable denied sessions to be added into the session table to reduce the CPU processing due to denied sessions fromthe same source/destination ip address, port, and protocol.
Scope
FortiGate.
Solution
Below are the commands to enable a denied session to be added to the session table:
config system settings
set ses-denied-traffic enable
end
For optimum performance, adjust the global block-session-timer (this is in seconds).
config system global
set block-session-timer <1-300> (default = <30 seconds>)
end
Blocking the packets of a denied session can take more CPU processing resources than passing the traffic through.
- When 'ses-denied-traffic' is 'enabled', FortiGate keeps the session for 'block-session-timer' time.
- When the block session is created, proceeding traffic matching the session will reset the expiry timer. By putting denied sessions in the session table, they can keep track the same way that allowed sessions are, so that the FortiGate unit does not have to reassess whether or not to deny each of the packets on an individual basis.
If the session is denied, all packets of that session are also rejected.
To view the blocked session, use the following commands to list all sessions. The sessions cannot be filtered by state or by implicit policy ID, as the implicit policy uses ID 0.
diagnose sys session filter clear
diagnose sys session list
It is recommended to run the session output in a terminal emulator such as PuTTY or SecureCRT, since the output can be extensive.
This is an example of a session showing denied traffic, blocked by the implicit deny policy (ID=0) with the state 'block'.
session info: proto=1 proto_state=00 duration=3 expire=296 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/0
state=block may_dirty f15
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=7->3/3->7 gwy=10.9.15.254/0.0.0.0
hook=pre dir=org act=noop 172.16.22.2:1->8.8.8.8:8(0.0.0.0:0)
hook=post dir=reply act=noop 8.8.8.8:1->172.16.22.2:0(0.0.0.0:0)
misc=0 policy_id=0 pol_uuid_idx=1 auth_info=0 chk_client_info=0 vd=0
serial=0000184d tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfwid=n/a
npu_state=0x000100
no_ofld_reason: block-by-policy
Note:
The ses-denied-traffic and block-session-timer are not effective at blocking denial-of-service attacks. In case of detecting non-legitimate traffic from sessions with policy id=0, use ACLs to block them.
Example:
config firewall acl
edit <id>
set interface <interface-name>
set srcaddr <IP_ADDRESS_SRC>
set dstaddr <IP_ADDRESS_DST>
set service <Service>
next
end
Related article:
Technical Tip: Blocking TCP Ports using ACL on FortiGate
