Vpn connection timeout

[#1]

Hello, i have a problem. The users that work with Baan and SAP through a vpn connection are disconnected if they don`t work for five minutes. I woulk like to know how to increase the time before a connection expires. Im using Firmware Version Fortigate-400 2.80,build292,041116 Thanks in advance.

[wcbenyip]

Do you mean a vpn tunnel between your 400 box and the vpn client? I think you may enlarge the Keylife from VPN Phase 2 setting, or you can check the option of " Autokey Keep Alive" (usually set for site-to-site tunnel) to enable an always-on demanding tunnel once there is any traffic passing thru.

[#3]

Yes, the problem happens when a user is connected to the ERPs through a vpn connection. It occurs with PPTP and IPSEC vpns. It is important to say that the link with the ERPs is broken if there are five minutes of inactivity but the vpn connection keeps alive.

[#4]

Hello, the solution for my problem was to modify the parameter session_ttl. The default value is 300 (seconds) and i have increased it to 7200 and all is ok now. Regards, Toni

[wcbenyip]

oh... I heard this solution, but never tried. If enlarged the tcp session ttl, then it means that EVERY session would take longer time to live even they are not used? I guess that it would increase the no. of concurrent session... Anyone knows does there any way to just extend the ttl of the VPN connectivity? Is it correct as I said before for increasing the keylife from the vpn phase 2 setting? Please advise.

[#6]

Changing the keylife only extends the life of the key, not the connection. This weakens security. The connection will still last " session_ttl" seconds. If you want a persistent tunnel which never goes down, tick the ' autokey keep alive' in Phase2->Advanced. This will guarantee an open VPN connection.

[wcbenyip]

That means I have to set the session_ttl to extend the lifetime of the vpn session idle time? But I still in question about the " session" _ttl... does it means EVERY session would take longer time to live including vpn session? Would it increase the no. of concurrent session?

[Oberon]

Ad. Information: 1. The Timeout is also from Fortigate to Fortigate different! f.Ex. - Fortigate 60, default Timeout 300 - Fortigate 200A, default Timeout 3600 2. You also don' t need to set the " session_ttl" for every port! (in this case probably port 23) open CLI get system session_ttl 300 (or something different) config system session_ttl set default 3200 (the time you want) end (now the time si set for all ports) config system session_ttl config port edit 23 set timeout 3200 next end end (now the time si set only for port 23) Note: - why set the session_ttl only for one port? It' s better for the performance. - Do also set timeout just as high as you need it, it also better for your performance. But this things also depense on the power of your Fortigate! kr