Description
This article describes how, in a hyperscale VDOM, disabling the session-helper on a per-service basis using 'config firewall service custom' can be configured, but the setting is not applied to actual traffic processing.
In a hyperscale VDOM, session-helper behavior is controlled only by global configuration.
Scope
FortiGate with a hyperscale license applied.
Solution
On a FortiGate where VDOMs are configured, if different session-helper behavior per VDOM is required for a specific protocol, the following configuration can be used.
FGT# config vdom
FGT (vdom) # edit vdom1
FGT (vdom1) # config firewall service custom
FGT(custom) # edit FTP-disable
FGT (FTP-disable) # set helper disable
FGT (FTP-disable) # end
However, this behavior does not function in a hyperscale VDOM where a hyperscale license is applied due to NPU limitations.
Although the configuration can be created, all session-helper behavior in a hyperscale VDOM follows the global configuration.
