Telnet traffic disconnecting every 5 minutes?

[#1]

Hi people, I have 2 sites connected with 2 fortigate 60, 2.80 build 318, a permit any any policy for inbound and outbound in both sites, no profile applied yet. One site is the HQ and the other one is a brach office. From the branch, customers initiate sessions to an AS/400 using terminal emulation software using the telnet protocol as transport. Everytime they open a session, this one ends exactly at 5 min, thats means, the client software disconnect automatically. Customer complains about this issue because they have to reconnect manually over and over. We did a simple test, we replaced the 2 fortigates 60 with 2 Cisco SOHO routers and we confirmed the telnet traffic does not disconnect using those. I havent opened a ticket with fortinet yet becasue I want to read opinions from this forum, best regards and thank you for all ... Silvio

[isptools]

it sounds like session_ttl is to short. If we have telnet traffic on customer sites we use allways an ttl of 7200 (2 hours). Michael

[#3]

Howto configure the fortinet for longer telnet sessions config system session_ttl set default 300 config port edit 23 set timeout 3600 next end end

[Yngve0]

Thanks; I was also looking for something like this. 2 quick questions: 1) Are there any max-value for the timeout? 2) Are there problem related to set the default quit high, i.e. 8h = 1 working day Y

[#5]

1) One week: (1week)* (7 days/week) * (24 Hours/day) * (60 minutes/hour) * (60 seconds/minute) = 604800 seconds 2) Security risk. Questions to ask: Is telnet really required? Tunneling over a SSH channel maybe a much better option. Does it pose a real security risk to allow users to have open session for long periods? Why would one need to have an inactive session for such a long period other then convenience? SpyderGeer

[#6]

We have a significant number of users who open sessions to offsite applications such as SAP and Distance Learning.. These applications are used throught the day and closing the sessin woudl require a significant login process to curr multiple times throught the day. What I have found interesting is that the ForitGate is the first firewall we' ve had that has treated sessions in this manner. The CheckPoint that we had previously did not seems to have the same " hard values" on session timeout.

[#7]

Your justifications and reasons may make sense for your instance. Just keep in mind this is security risk management, not elimination. You are always going to have security risks. You have to way your trade offs and make your decision are based on that. SpyderGeer

[#8]

Absolutly, no one can know what the most secure policies are in the context of a given political situation. And I need to work on my spelling :)