SSH Session Time Out

[Asyraf]

Hi,

We having an issues where the SSH keep timeout when idle. This happen only for 1 IP Segment / VLAN.

Not sure if this related to the FW since we have multiple switch in between.

User -> Floor Switch -> CS Switch -> FW -> Servers

When login and idle for 5s, the session close. In the Fortigate i try config session-ttl based on the FG forum, but still same :

onfig system session-ttl
         config port
             edit 22
                 set protocol 6
                 set timeout never
                 set start-port 22
                 set end-port 22
             next
         end
 end

 Anyone experience on this ?

TQ

[AEK]

Hi @Asyraf 

This 5s timeout is probably configured ad ssh client level or ssh server level.

The session default ttl in FG is 1h if I'm not wrong.

[AlexC-FTNT]

You can run a packet capture to prove it. Filter for ssh port and the test IP - 5s is not a lot to wait. You will see who sends the FIN packet. Also, you can check immediately after if the session is still kept in FG (it should be kept for a max 2s after FIN - so you should be fast)

[Asyraf]

Hi thanks for the suggestion, based on the packet capture (wireshark), i cant find which device (server / client) sending the FIN packet. For this scenario i run the packet capture on client laptop. After 5 - 10s the session close. We have other server that configured using other network segments, the other segment working fine. Only this segment facing the session time out issues. Also @AEK i did configure new linux server (VM) with default setting also same.

[AEK]

Hi Asyraf

Can you try packet capture from FortiGate and try see who (client or server) sends FIN or RST.

Also can you tell more about this segment? Does it have dual path with LB? does it have the same behavior with other encrypted and unencrypted protocols or only SSH? Are you using deep inspection? ... etc

[AlexC-FTNT]

As @AEK  said, the packet capture on client alone doesn't help.
You need the capture on FortiGate CLI, on "any" interface: 
diag sniffer packet any "host x.x.x.x and host y.y.y.y" 6 0 l
https://docs.fortinet.com/document/fortigate/7.0.8/administration-guide/680228

Then you convert the text capture to pcap with one of the tools available, for example:
https://github.com/ondrejholecek/sniftran (which also adds the interface label for easy reading)