Large config - ssh behaviour

[taimen]

Using an NCCM tool to collect the config from our fortinet. A weird behaviour was seen from the fortinet device , wherein it sends keepalive ssh packets to the client ,after outputting 25% of the ssh command . Then terminates the session as it doesn't recieve response for the keepalive from the client .

Weird part is other devices in the network doesnt do this and outputs the whole config . While this perticular device after sending a perticular number of lines waits for keepalive response(send 60 seconds apart) and waits for the client to respond with an ssh packet and then sent the rest of the config .

Any thoughts?

[gfleming]

How is the configuration being collected? Using scp? SEems it should go much faster than that to prevent a failed keepalive from terminating it.

[Markus_M]

Hi taimen,

you can run debug as to:

diag debug console timestamp enable

diag debug app sshd -1

diag debug app cli 8

diag debug enable

and see if there is something useful that relates to the behavior you see.

[lol]

Hello,

Please also share the FortiGate model and firmware version you are using.

Which NCCM tool is being used to retrieve the config via SCP ?

Have you tried downloading the file with i.e. OpenSSH on Linux or WinSCP on Windows to confirm this works with another tool ?

Regards