Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Firewall has reached its session limit for x seconds!

Can someone elaborate the effects of running out of sessions on firewall? Other than content filtering stopping for new sessions what other effects are there. Does using Traffic shaping greatly affect the session count? Will it eventually cause traffic issues with users that are not content filtered? I presume the answer is yes but need to confirm this. Thanks, Pat
New Contributor

I' d like to see a response from someone who really knows the technical issues with this (that' s not me), but I can confirm from recent personal experience that web content filtering stops and SSL VPN tunnels seem to drop (thats been a major problem for us). I believe AV and IDS are affected as well, but again we' ll let the experts chime in on that. Not sure what model you have, but we' ve got dozens of 60Bs and these have been riddled with these connection limit messages. In some cases it " may" be justified (we' re upgrading to higher-end models), but in many others it just seems like it' s a firmware issue (can' t be having such problems with so few users; 15-20!?!)... Keep an eye out for comments here about firmware issues causing this problem - I think I' ve seen some of that as well. Good luck...
Michael Bruck
Michael Bruck
Not applicable

We get this all of the time as well. Have about 15 60B' s with 15-20 users at each site. We were having issues with users not being able to access any websites once the connection limit was reached. Seems like a firmware update has fixed that most of the time. Now, we have various symptoms after hitting the connection limit ranging from not being able to access any websites again to users not being filtered at all to HTTP 500 errors. We have opened support cases a couple times to see if we can prevent this from happening. However, reaching support and talking to a live person is challenging sometimes. We opened a new case regarding memory use/connection limit just over a week ago with nothing concrete other than the technician didn' t see anything obvious and referred us to a basic troubleshooting document suggesting that our ISP is blocking DNS requests and other ports. However, rebooting the Fortigate seems to alleviate the problem until the connection limit is reached again. It is very frustrating.
New Contributor

Gene, What build are you running on the 60b' s? I have one that has about 40 users running FortiGate 3.00 MR7 Patch Release 9 (0753). We get some session limits but no critical failures like yours. We run WebFiltering, AV and IPS. Troy
New Contributor III

Hi, there were some issues on 50b and 60b' s as a result of a too file AV signature file. Here are some optimizations: 1) session timers config system global set tcp-halfclose-timer 30 set tcp-halfopen-timer 30 set udp-idle-timer 60 end config system session-ttl set default 300 end 2) Lower AV thresholds in protection profile set memory threshold naar 2 MB en pass for oversize. 3) change the fortiguard TTL: config system fortiguard set webfilter-cache-ttl 500 set antispam-cache-ttl 500 end 4) change DNS cache: config system dns set dns-cache-limit 300 end 5) disable DNS forwarding: config system dns unset fwdintf end

Rackmount your Fortinet -->


Rackmount your Fortinet -->
Valued Contributor

I had these issues with the 80c, it reached connection limit about twice every hour, with around 10 users, i did upgrade to 4.0 Mr1 Patch 4 yeasterday, and all problems were gone

FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C

I have a FWF80CM on a 4MB internet connection with about 65 users. I have been getting the same error message. I opened a ticket with fortinet support and they are still researching the issue. " SecureLayers-Eric" - I have done what you have outlined and have disabled all AV, no go. I just have IPS, WF and application control. Watchguard is looking really good right now! All, The one thing that I have noticed after upgrading to 4.0MR1 patch 4 is that everytime I change a application control policy (GUI or ssh) it will kick in session limit error message. Anyone else having this issue?
Not applicable

Hi. I' m considering upgrade to 4.0 mr1 patch 4. Does anyone else solved the problem of " connection limit" with this update? BTW: changing max ttl is not always best solution it depends on enviroment ( in my case users are filling forms and it takes awfully long time to do that, so in the end when they submit the form they get session timeout)

FYI, after seven days with tech support I was told that they have no idea why the device is doing this and to flash the firmware and reload my config. :( not a good solution if you ask me.

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors