Timeouts

[#1]

Hey guys, Ive been running 2 fortigate 300' s at the gateways of 2 offices now, both on 2.8 code build 318, and i have services (specifically a java management console) on a box on the DMZ i need accessable from the outside. I opened all the requisite ports, but when connected through the fortigate after 5 min, wether the session is in use or not the connection dies. If you are connected on the same network segment as the server though the connection remains active indefinetly. Any help or suggestions are much appreciated, this has me stumped.

[UkWizard]

There is a 5 minute idle timeout for sessions, but if you say you are getting it when its being used as well, maybe the program is using multiple connections, and one is remaining idle which is causing the timeouts. Try changing the timeout for the particular service that you are using, to see if this is whats causing it.

[#3]

The sessions stay alive if on the same network segment so i know it isnt the service configuration. If there is a way to alter service timeout in the fortigate i would like to know.

[UkWizard]

The sessions stay alive if on the same network segment so i know it isnt the service configuration.

eh?

If there is a way to alter service timeout in the fortigate i would like to know.

Yes, it can be done on the command line (CLI) of the unit, like so; Changing for all ports; config system session_ttl set default 62000 end Heres how to display the settings for the session_ttl command. get system session_ttl Heres how to display the configuration for the session show system session_ttl Heres how to change it for just one port (eg 22 - ssh) config system session_ttl config port edit 22 set 3600 end end All of this can be found in the 2.8 CLI guide.

[#5]

Thanks that is exactly what i was looking for, and had searched the admin guide but not the CLI guide.

[#6]

Ok after some additional tresting, with all the ports the management app uses set to a timeout of 3600, the timeout still occurs at the 5 minute mark Any other suggestions would be welcome.

[UkWizard]

try changing the default, then see if it still occurs, is suspecy it wont, as it may be a service that you didnt know was used. Also you could monitor the sessions and see what timeout (if any) counts down at the time of disconnection. Also try turning off any IPS, in case its getting a hit there.