Firewall has reached its session limit for x seconds!

[beaven67]

Can someone elaborate the effects of running out of sessions on firewall? Other than content filtering stopping for new sessions what other effects are there. Does using Traffic shaping greatly affect the session count? Will it eventually cause traffic issues with users that are not content filtered? I presume the answer is yes but need to confirm this. Thanks, Pat

[MBruck]

I' d like to see a response from someone who really knows the technical issues with this (that' s not me), but I can confirm from recent personal experience that web content filtering stops and SSL VPN tunnels seem to drop (thats been a major problem for us). I believe AV and IDS are affected as well, but again we' ll let the experts chime in on that. Not sure what model you have, but we' ve got dozens of 60Bs and these have been riddled with these connection limit messages. In some cases it " may" be justified (we' re upgrading to higher-end models), but in many others it just seems like it' s a firmware issue (can' t be having such problems with so few users; 15-20!?!)... Keep an eye out for comments here about firmware issues causing this problem - I think I' ve seen some of that as well. Good luck...

[#3]

We get this all of the time as well. Have about 15 60B' s with 15-20 users at each site. We were having issues with users not being able to access any websites once the connection limit was reached. Seems like a firmware update has fixed that most of the time. Now, we have various symptoms after hitting the connection limit ranging from not being able to access any websites again to users not being filtered at all to HTTP 500 errors. We have opened support cases a couple times to see if we can prevent this from happening. However, reaching support and talking to a live person is challenging sometimes. We opened a new case regarding memory use/connection limit just over a week ago with nothing concrete other than the technician didn' t see anything obvious and referred us to a basic troubleshooting document suggesting that our ISP is blocking DNS requests and other ports. However, rebooting the Fortigate seems to alleviate the problem until the connection limit is reached again. It is very frustrating.

[Troy_Sorzano]

Gene, What build are you running on the 60b' s? I have one that has about 40 users running FortiGate 3.00 MR7 Patch Release 9 (0753). We get some session limits but no critical failures like yours. We run WebFiltering, AV and IPS. Troy

[FortiRack_Eric]

Hi, there were some issues on 50b and 60b' s as a result of a too file AV signature file. Here are some optimizations: 1) session timers config system global set tcp-halfclose-timer 30 set tcp-halfopen-timer 30 set udp-idle-timer 60 end config system session-ttl set default 300 end 2) Lower AV thresholds in protection profile set memory threshold naar 2 MB en pass for oversize. 3) change the fortiguard TTL: config system fortiguard set webfilter-cache-ttl 500 set antispam-cache-ttl 500 end 4) change DNS cache: config system dns set dns-cache-limit 300 end 5) disable DNS forwarding: config system dns unset fwdintf end

[Carl_Wallmark]

I had these issues with the 80c, it reached connection limit about twice every hour, with around 10 users, i did upgrade to 4.0 Mr1 Patch 4 yeasterday, and all problems were gone

[ejhardin]

I have a FWF80CM on a 4MB internet connection with about 65 users. I have been getting the same error message. I opened a ticket with fortinet support and they are still researching the issue. " SecureLayers-Eric" - I have done what you have outlined and have disabled all AV, no go. I just have IPS, WF and application control. Watchguard is looking really good right now! All, The one thing that I have noticed after upgrading to 4.0MR1 patch 4 is that everytime I change a application control policy (GUI or ssh) it will kick in session limit error message. Anyone else having this issue?

[#8]

Hi. I' m considering upgrade to 4.0 mr1 patch 4. Does anyone else solved the problem of " connection limit" with this update? BTW: changing max ttl is not always best solution it depends on enviroment ( in my case users are filling forms and it takes awfully long time to do that, so in the end when they submit the form they get session timeout)

[ejhardin]

FYI, after seven days with tech support I was told that they have no idea why the device is doing this and to flash the firmware and reload my config. :( not a good solution if you ask me.