
Not applicable
Created on ‎02-15-2005 04:02 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Vpn connection timeout
Hello,
i have a problem. The users that work with Baan and SAP through a vpn connection are disconnected if they don`t work for five minutes. I woulk like to know how to increase the time before a connection expires.
Im using Firmware Version Fortigate-400 2.80,build292,041116
Thanks in advance.
7 REPLIES 7
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you mean a vpn tunnel between your 400 box and the vpn client?
I think you may enlarge the Keylife from VPN Phase 2 setting, or you can check the option of " Autokey Keep Alive" (usually set for site-to-site tunnel) to enable an always-on demanding tunnel once there is any traffic passing thru.
Protect yourself~ http://www.secunia.com
MBCS CEH FCNSA
Protect yourself~ http://www.secunia.com MBCS CEH FCNSA

Not applicable
Created on ‎02-16-2005 12:10 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, the problem happens when a user is connected to the ERPs through a vpn connection. It occurs with PPTP and IPSEC vpns. It is important to say that the link with the ERPs is broken if there are five minutes of inactivity but the vpn connection keeps alive.

Not applicable
Created on ‎02-17-2005 06:25 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
the solution for my problem was to modify the parameter session_ttl. The default value is 300 (seconds) and i have increased it to 7200 and all is ok now.
Regards,
Toni
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
oh... I heard this solution, but never tried.
If enlarged the tcp session ttl, then it means that EVERY session would take longer time to live even they are not used? I guess that it would increase the no. of concurrent session...
Anyone knows does there any way to just extend the ttl of the VPN connectivity? Is it correct as I said before for increasing the keylife from the vpn phase 2 setting? Please advise.
Protect yourself~ http://www.secunia.com
MBCS CEH FCNSA
Protect yourself~ http://www.secunia.com MBCS CEH FCNSA

Not applicable
Created on ‎02-20-2005 11:37 PM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Changing the keylife only extends the life of the key, not the connection. This weakens security.
The connection will still last " session_ttl" seconds.
If you want a persistent tunnel which never goes down, tick the ' autokey keep alive' in Phase2->Advanced. This will guarantee an open VPN connection.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That means I have to set the session_ttl to extend the lifetime of the vpn session idle time? But I still in question about the " session" _ttl... does it means EVERY session would take longer time to live including vpn session? Would it increase the no. of concurrent session?
Protect yourself~ http://www.secunia.com
MBCS CEH FCNSA
Protect yourself~ http://www.secunia.com MBCS CEH FCNSA
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ad. Information:
1.
The Timeout is also from Fortigate to Fortigate different!
f.Ex. - Fortigate 60, default Timeout 300
- Fortigate 200A, default Timeout 3600
2.
You also don' t need to set the " session_ttl" for every port!
(in this case probably port 23)
open CLI
get system session_ttl
300 (or something different)
config system session_ttl
set default 3200 (the time you want)
end
(now the time si set for all ports)
config system session_ttl
config port
edit 23
set timeout 3200
next
end
end
(now the time si set only for port 23)
Note:
- why set the session_ttl only for one port? It' s better for the performance.
- Do also set timeout just as high as you need it, it also better for your performance.
But this things also depense on the power of your Fortigate!
kr
Private Use:
Fortigate-50B, 4.00-MR3, NAT/IPsec-VPN/SSL-VPN
Private Use: Fortigate-50B, 4.00-MR3, NAT/IPsec-VPN/SSL-VPN
