Fortigate - Session Timeouts

For places that have lots of sessions and you’re using the session view lots the DNS sessions tend to be like 40% of the active sessions. FortiGate keeps them open for 3600 seconds by default which is a waste since most of the time dns only needs a couple of seconds. It also can’t really reuse the sessions.

 

The below will set the FortiGate to age out non active DNS protocol sessions after 15 seconds.

 

config system session-ttl

        config port

            edit 53

                set protocol 17

                set timeout 15

                set start-port 53

                set end-port 53

            next

        end

end