Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor III

FortiGate - sessions with destination

Hi there!


We have some "session issues" at one of our locations. Our ISP informs us that we are generating a high amount of sessions from our FortiGate, so high that their modem is not able to keep up and effectively more or less kills off the internet access at the site. Quote: "and caused the TCP spoofer to stop working correctly due to a session count of over 4100"


According to our FortiGate at the location the session count is not extreme at all - around 800 - 1600 with a rate between 5 - 30 sessions pr. second. 


The only high-sessioner I can find is a unit producing around 40000 sessions per 24 hrs, but not much traffic. 


The destination on these sessions are (see attached img.)




Could this be the cause of our problems? I'm not 100% sure what it means by destination so if someone could enlighten me on that, very much thanks to you.



Community Manager
Community Manager

Hello PM,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Anthony-Fortinet Community Team.

Hi @pmh,

Thanks for using the Community Forum. '' as a destination means the it is sending broadcast via UDP port 12345. 

Can you please tell us more about the source Is it an end system/intermediate system/etc?

New Contributor III


The device is a multimedia server broadcasting internally on the net. As far I understand how a firewall works, none of the sessions from my screen shot are passing the firewall - and on to the ISP's equipment, but as they insist that the problem is coming somewhere from this subnet, and this is the only unit producing any amount of sessions worth mentioning I thought I had to check with some who actually know what they are talking about. 


Thanks for your reply



Contributor II

You can check the configuration of the interface. If you are sure that this broadcast traffic does not require forwarding, then you can disable forward-broadcast under the interface configuration. 



Sample configuration below. Default configuration is set broadcast-forward disable , but check if you have enabled, then please disable it. 



FW01-ROSA-DC01 (port2) # show full | grep forward
set arpforward enable
set broadcast-forward disable
set l2forward disable
set vlanforward disable
set stpforward disable
set netbios-forward disable

FW01-ROSA-DC01 (port2) #


Rosa Technocrat -- Also on YouTube---Please do Subscribe
Rosa Technocrat -- Also on YouTube---Please do Subscribe

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors