Expiring connections

[#1]

How can I set/adjust the length of time before a connection/session expires? This is on: Fortigate-60 2.80,build519,060809 This is really for ssh connections. I find it annoying that they will expire after 5 minutes (300s, default), since I often have several log-ins open to do different things. To be real clear: this relates to any IP connection, not VPN sessions or HTTP auth for the Fortigate' s web interface. Expiration time can be found under the " Session" tab in " System->Status" (web interface). I don' t seem to find it in the interface, I have looked in the manual and searched this forum with no success. Thanks, Laurent

[AKrause]

300 secs is default for UDP session, 3600 secs for TCP sessions. you can modify the session timeouts per port: config system session-ttl regards, Andreas

[#3]

Ah, thank you, only in the CLI. In case someone were to read this: it' s actually " session_ttl" (with underscore). Cheers, Laurent

[AKrause]

Okay.. in MR3 it' s indeed config system session-ttl regards, Andreas

[#5]

i got the same problem on 200A and tried 2 config 1. config system session-ttl set default 18000 end 2. config system session-ttl set default 36000 config port edit 22 set timeout never next end end ssh connections are still terminated after around an hour, and the sessions are still displayed in system->statistics->sessions, and on the server side, the login is still there, what config is still missing ?

[AKrause]

Hi Irene, you have got to distinguish between firewall-sessions and application-sessions. The application (in your case ssh-daemon) might keep its own session-timeout as well as the ssh-client. If the sessions are terminated after 60 mins idle and the firewall still has the session open, it is obviously not a firewall config issue! However, it is not a good idea to set an unlimited timeout at fortigate. I wonder if this is possible - it definitely should not be! regards, Andreas

[#7]

You' re rite, but it seems there' re no timeout in openssh daemon, and before we deploy FGT, i can make a far longer idle session. Tried SecureCRT and putty, but the connection is stll terminated even i have keepalive set in the client Once i apply the default " unfiltered" profile, it works fine. Any idea ?

[zentobbe]

Hi, I have the same problem but with http/https aswell as ssh. I use the unfiltered protection profile only, but still got those timeouts.. Any ideas ? brgdrs tobbe

[AKrause]

okay, I suggest to identify the part of the protection profile, which causes the problem. Build a clone of your profile and remove filters (AV, IPS, etc..) step by step unteil the timeout disappears. hth, Andreas

[romanr]

I got the same problem.... I already mentioned it in: http://support.fortinet.com/forum/tm.asp?m=27876&p=2&tmode=1&smode=1 In the meanwhile I did sniff the problem a bit and it seems that the FGT just loses the session somehow and stops passing packets! Changes on timeouts do not change anything!!! cheers.