Dirty Sessions and Network Changes Quiz

Session Flagging and Routing Changes

• If a session is flagged as dirty after a routing change, it is re-evaluated against the new route and firewall policy.
• A session is flagged as dirty when a routing change occurs, impacting the session's routing information.

Session Re-evaluation

• If the new action of the matching firewall is deny, the session is cleared.
• Dirty sessions are re-evaluated in both directions.
• Further packets matching a dirty session are blocked until the session is re-evaluated.

Routing Changes and SD-WAN

• Routing changes are common in SD-WAN, making dirty sessions common.
• Routing changes are common during SD-WAN path changes or when a link fails.

FortiGate Session Handling

• FortiGate flushes the routing information of impacted sessions after a routing change.
• If a session is offloaded to NPU, FortiGate sends a request to the NPU to flush the session.
• If a session is not offloaded to NPU, FortiGate re-evaluates the session.

Session Lookup

• FortiGate performs a route lookup and firewall policy lookup for the first packet in the original direction.
• FortiGate performs a reverse route lookup and firewall policy lookup for the first packet in the reply direction.

Session Re-evaluation Results

• If the firewall policy action is now denied during re-evaluation, the session is cleared.
• If the current route is not present in the FIB, the session is cleared.
• If the S-NAT IP changes during re-evaluation, the session is re-evaluated with the new S-NAT IP.

S-NAT Sessions

• The default behavior for S-NAT sessions after a routing change is to re-evaluate the session with the new route and firewall policy.
• If the new route and firewall policy lookup results in a change of the S-NAT IP during re-evaluation, the session is re-evaluated with the new S-NAT IP.
• The snat-route-change setting should be enabled when the S-NAT IP changes during re-evaluation.

TCP-Based Sessions

• If the impacted application is TCP-based and the session is cleared during re-evaluation, the TCP connection is terminated.

Debug Flow Output

• The debug flow output for S-NAT session during re-evaluation shows the re-evaluation process.

Snat-Route-Change Setting

• The purpose of enabling the snat-route-change setting is to re-evaluate S-NAT sessions when the S-NAT IP changes during a routing change.

FortiGate Actions

• FortiGate flushes the outgoing interface and gateway information when a route is removed from the FIB.
• If the S-NAT IP of the new path is different from the S-NAT IP of the current path during re-evaluation, the session is re-evaluated with the new S-NAT IP.