FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
rmetzger
Staff
Staff

Description

This article explains how to use filters to clear sessions on a FortiGate unit, based on the CLI command:
 
diagnose sys session <arguments>
 

Scope
FortiGate units, running a FortiOS firmware version 4.00 MR3 or 5.0.x


Solution
Clearing sessions matching some common filtering criteria can be done from the CLI in 2 steps:

  • 1 - Setup a session filter

The base command is "diagnose sys session filter <options>"

 

To see the options, type options are :

 

FGT # diagnose sys session filter ?

clear      clear session filter
dport      dest port
dst         dest ip address
negate    inverse filter
policy     policy id
proto      protocol number
sport      source port
src         source ip address
vd          index of virtual domain. -1 matches all

 


To see the current filter settings, type :

 

FGT # diagnose sys session filter

 

session filter:
vd: any
proto: any
source ip: any
dest ip: any
source port: any
dest port: any
policy id: any
expire: any
duration: any

       

  

Example of filter matching a source IP and a destination port :

 

FGT# diagnose sys session filter src 10.160.0.1
FGT# diagnose sys session filter dport 80
FGT# diagnose sys session filter

session filter:
        vd: any
        proto: any
        source ip: 10.160.0.1-10.160.0.1
        dest ip: any
        source port: any
        dest port: 80-80
        policy id: any
        expire: any
        duration: any

 

 

Example of filter matching a range of source IP and a range of destination port :

 

FGT# diagnose sys session filter src 10.160.0.1  10.160.0.10
FGT# diagnose sys session filter dport 80  888
FGT# diagnose sys session filter

  session filter:
        vd: any
        proto: any
        source ip: 10.160.0.1-10.160.0.10
        dest ip: any
        source port: any
        dest port: 80-888
        policy id: any
        expire: any
        duration: any

 

 

  • 2  - Clear the session(s) matching the filter defined previously with the command :

   FGT # diagnose sys session clear

 

Warning: Using the "diagnose sys session clear" command without any filter will clear all sessions currently opened on the FortiGate unit.


Note: To see the session list, use the following command ;the output will also be based on the filter defined previously :

   FGT # diagnose sys session list
 

Related Articles

Troubleshooting Tip: FortiGate session table information

Contributors