Auto expiring Session on fortigate

[ggntt]

Hi On a Fortigate 60, we have a remote app type on environment with vpns connecting a remote site to the server in HQ. Users in the remote off print to their local printer via the HQ server over the vpn. Every second day or so, the server can no longer communicate with the printer until you end/deleted the session, then a new one is created and the jobs print. What I am looking for is a way to enable a time out / expiry on sessions, so if the session between IP addy to IP addy is open for longer than 2 mins say then deleted the session. Is this or something like this possible? Thanks, GNS

[ede_pfau]

Why not make the tunnel stay open all the time? keyword is " auto-negotiate" . Regular firewall sessions do have a timeout (or else the session table would overflow soon). I think the default is like 300 or 600 seconds. If your VPN uses UDP encapsulation (port 500) then it' s a regular UDP session, timing out after 10 minutes idleing. Though I doubt this happens because of the NAT keepalives...

[ggntt]

Hi Ede Thanks for your help. To be honest it does not look like the Tunnel is dropping. We are having a problem with a server on one side and a printer on the other side keeping sessions open after the user logs out of their thin client. When they log back in they cant print until we kill the session on the FW. Not sure if we can get the FW to drop those sessions after a particular amount of time, as its currently not doing that consistently. Thanks g

[ede_pfau]

OK I got it now. Looks more like an application problem but the FGT might help. If you can identify the service used by port number, you could specify the session timeout for that port only to be quite short. Look at this as an example where I shortened DNS session lifetime to get rid of those hundreds of dangling sessions on my FGT:

 config system session-ttl
         config port
             edit 1
                 set protocol 17
                 set timeout 90
                 set end-port 53
                 set start-port 53
             next
         end
 end
 

[ggntt]

Thanks ede_pfau. I have the service that the port uses ( it is a vpn tunnel). Where do I use the service in your example. When you use " edit 1" I gather 1 is the name of your port! Thanks, GNS

[ede_pfau]

No, 1 is just the first session-ttl defined. Type ' edit 0' to open the next available. Even if the service is used across a VPN tunnel you' d specify it' s designated port number - look at the session table to see it if you' re unsure.

[ggntt]

Okay, thanks ede_pfau, I typed in those commands but when I get to ' set protocol 17' it gives me ' command parse error before ' protocol' ' The version of firmware is 3.00-b0730(MR7 Patch 1) Do you have any relevant commands for this version of firmware? -Thanks GNS

[ede_pfau]

In 3.00 the syntax is

 config system session-ttl
 set default <seconds>
 config port
 edit <port_number>
 set timeout {<seconds> | never}
 end
 end

and this is effective for TCP only! TCP = protocol 6, UDP = protocol 17, see RFC5237. In v4.00, you can specify TCP, UDP or SCTP. If you want to set a TTL for UDP, you can only upgrade. The ' default' pertains to TCP only.

[ggntt]

Hi Ede, That was accepted in CLI. Lets hope that did the job. Thank you. GNS.

[ggntt]

I still had issues, from a webchat with fortinet support I put in the following config system session-ttl set default 300 (300 secs is the min) config port edit <the destination port> set timeout 300 end end That did the job. Thanks ede_pfau