ssl vpn auth-timeout 0 not working when no packet send and receieve.

[Kazumi-k]

The VPN connection will be broken if the computer connected by FortiClient with the following settings does not send or receive packets passing through the VPN for 259200 seconds (3 days).

---

config vpn ssl setting

 set idle-timeout 0

 set auth-timeout 0

 <omit>

end

---

Monitoring in “Dashboard>Users & Devices>Firewall Users>” shows that when there is no communication, the remaining time gradually decreases, and when communication starts, the remaining time resets to 3 days.

It seems like a disconnection due to idle-timeout, but the VPN event disconnect reaseon is an auth-timeout.

Is it possible to keep the VPN connection for more than 259200 seconds (3 days) even if no packets are sent or received?

[AEK]

According to "FortiOS CLI reference" doc, 259200 is the maximum value.

If you need it to stay connected then you may schedule a job to generate a ping periodically.

[Kanbeik]

Thanks for the reply.
Doesn't the following setting(Minimum value:0) mean that it will not time out?
“set idle-timeout 0”

“set auth-timeout 0”

config vpn ssl settings | FortiGate / FortiOS 7.2.1 | Fortinet Document Library

[AEK]

According to this tech tip you are right, zero should mean no timeout.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-timers-explanation-and-SSL-VPN-Log...

Try some tests to make sure about the reason of the disconnection. Meanwhile you can still try periodic pings through the tunnel to confirm (or invalidate) the involvement of idle-timeout.

[Kazumi-k]

When checking from the command line, idle-timeout is displayed as N/A.

However, when checking from the WebUI,
even when idle-timeout=0 is set, the remaining time continues to decrease from 259200 seconds (3 days).

When I start communicating with ping, the remaining time is reset to 259200 seconds (3 days).

As you can see from (3), idle-timeout=0 same result as idle-timeout=259200.

[AEK]

Then probably the doc is wrong.