Auto expiring Session on fortigate

[ggntt]

Hi On a Fortigate 60, we have a remote app type on environment with vpns connecting a remote site to the server in HQ. Users in the remote off print to their local printer via the HQ server over the vpn. Every second day or so, the server can no longer communicate with the printer until you end/deleted the session, then a new one is created and the jobs print. What I am looking for is a way to enable a time out / expiry on sessions, so if the session between IP addy to IP addy is open for longer than 2 mins say then deleted the session. Is this or something like this possible? Thanks, GNS

[ede_pfau]

*puzzled* what exactly did the job then? you' re quoting the exact same syntax that I' ve posted above. Which port did you use? And it doesn' t matter that it' s TCP only? So I gather it wasn' t a UDP session in the first place -? Please clarify.

[ggntt]

Hi, The command you had stated did not state that the port I needed to edit was the port number of the destination port of the session. The port number of the dest port in my case is not important as it would be different to other ones. I just wrote what the command was that worked for me for others. Thanks, GNS.

[ede_pfau]

Ah, OK. It' s never the source port actually, with all assigned / Well Known port numbers when you' re dealing with services. In the meantime I stumbled upon a nice feature: you can set the session lifetime in the policy itself that allows these sessions to be created. This would mean the change is ' local' and not global for all sessions on the FGT. A lower session TTL costs ressources (mainly CPU) as the session table has to be updated more frequently. Might not be important if the average load is low, though.

[ede_pfau]

And, as it happens, there is a idle timeout setting for UDP as well (for FortiOS 3.00)

 conf sys global
 set udp-idle-timer <seconds>

The default is 180 s, range is 1-86400 s.