跳至主要內容

会话管理

2025/10/29大约 7 分钟

会话管理

CLI 方式

使用diagnose sys session命令可以过滤、查看和删除会话。

过滤条件

  1. 查看和删除某特定会话时，都需要先设置 filter。

    diagnose sys session filter ?    //键入?查看会话支持的过滤条件，如源IP，目的IP，目的端口等//
vd                Index of virtual domain. -1 matches all.
vd-name           Name of virtual domain. -1 or "any" matches all.
sintf             Source interface.
dintf             Destination interface.
src               Source IP address.
nsrc              NAT'd source ip address
dst               Destination IP address.
proto             Protocol number.
sport             Source port.
nport             NAT'd source port
dport             Destination port.
policy            Policy ID.
expire            expire
duration          duration
proto-state       Protocol state.
session-state1    Session state1.
session-state2    Session state2.
ext-src           Add a source address to the extended match list.
ext-dst           Add a destination address to the extended match list.
ext-src-negate    Add a source address to the negated extended match list.
ext-dst-negate    Add a destination address to the negated extended match list.
clear             Clear session filter.
negate            Inverse filter.

  2. 查看当前的过滤条件。

    diagnose sys session filter    //直接键入回车查看当前的过滤条件//
session filter:
        vd: any
        sintf: any
        dintf: any
        proto: any
        proto-state: any
        source ip: any
        NAT'd source ip: any
        dest ip: any
        source port: any
        NAT'd source port: any
        dest port: any
        policy id: any
        expire: any
        duration: any
        state1: any
        state2: any

查看会话

  1. 查看某特定会话时，需要先设置 filter。如果不设置过滤条件，则 diagnose sys session list 将列出 FortiGate 当前所有的会话。

    diagnose sys session filter proto 1
diagnose sys session filter src 192.168.1.10

  2. 查看设置的过滤条件。

    diagnose sys session filter 
session filter:
        vd: any
        sintf: any
        dintf: any
        proto: 1-1
        proto-state: any
        source ip: 192.168.1.10-192.168.1.10
        NAT'd source ip: any
        dest ip: any
        source port: any
        NAT'd source port: any
        dest port: any
        policy id: any
        expire: any
        duration: any
        state1: any

  3. 查看过滤后的会话。

    diagnose sys session list
session info: proto=1 proto_state=00 duration=1 expire=59 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=may_dirty npu 
statistic(bytes/packets/allow_err): org=168/2/1 reply=168/2/1 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=13->14/14->13 gwy=192.168.2.10/192.168.1.10
hook=pre dir=org act=noop 192.168.1.10:13898->192.168.2.10:8(0.0.0.0:0)
hook=post dir=reply act=noop 192.168.2.10:13898->192.168.1.10:0(0.0.0.0:0)
misc=0 policy_id=8 pol_uuid_idx=520 auth_info=0 chk_client_info=0 vd=0
serial=00091df7 tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfwid=n/a
npu_state=0x4000c00 ofld-O ofld-R
npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=158/156, ipid=156/158, vlan=0x0000/0x0000
vlifid=156/158, vtag_in=0x0000/0x0000 in_npu=1/1, out_npu=1/1, fwd_en=0/0, qid=5/4
total session 1    //过滤的会话，总共有1条//

删除会话

  1. 删除某特定会话时，需要先设置 filter。如果不设置过滤条件，则 diagnose sys session clear 将清空 FortiGate 当前所有的会话，可能会引起断网。

    diagnose sys session filter proto 1
diagnose sys session filter src 192.168.1.10

  2. 查看设置的过滤条件。

    diagnose sys session filter 
session filter:
        vd: any
        sintf: any
        dintf: any
        proto: 1-1
        proto-state: any
        source ip: 192.168.1.10-192.168.1.10
        NAT'd source ip: any
        dest ip: any
        source port: any
        NAT'd source port: any
        dest port: any
        policy id: any
        expire: any
        duration: any
        state1: any

  3. 查看过滤后的会话是否是需要删除的会话。

    FortiGate # diagnose sys session list
session info: proto=1 proto_state=00 duration=1 expire=59 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=may_dirty npu 
statistic(bytes/packets/allow_err): org=168/2/1 reply=168/2/1 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=13->14/14->13 gwy=192.168.2.10/192.168.1.10
hook=pre dir=org act=noop 192.168.1.10:13898->192.168.2.10:8(0.0.0.0:0)
hook=post dir=reply act=noop 192.168.2.10:13898->192.168.1.10:0(0.0.0.0:0)
misc=0 policy_id=8 pol_uuid_idx=520 auth_info=0 chk_client_info=0 vd=0
serial=00091df7 tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfwid=n/a
npu_state=0x4000c00 ofld-O ofld-R
npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=158/156, ipid=156/158, vlan=0x0000/0x0000
vlifid=156/158, vtag_in=0x0000/0x0000 in_npu=1/1, out_npu=1/1, fwd_en=0/0, qid=5/4
total session 1

  4. 确认无误后，再执行删除会话的命令。

    FortiGate # diagnose sys session clear

GUI 方式

重要

该功能在 FortiOS 7.4.0 及以上版本支持。

过滤条件

  1. 登录设备的管理页面，进入仪表盘 → FortiView 会话页面，可以看到当前设备所有活动的会话信息。

    image-20250829162321339

  2. 在页面上方的搜索框中点击“+”按钮，可以根据不同的会话参数配置过滤条件，可以设置多个过滤条件，点击应用按钮，可以过滤出对应的会话列表。

    image-20250829162511542

查看会话

部分列会被隐藏，右键点击任意列标题，可以配置显示/隐藏的会话参数列。

image-20250829162909840

删除会话

删除过滤结果中的会话

  1. 删除过滤结果中的会话，配置筛选条件后查询会话信息（如下所示过滤所有的 ICMP 协议会话），然后点击页面左上角的“结束会话 → 仅筛选”按钮（不会删除本地会话）。

    image-20250829163203060

  2. 弹出确认提示，点击 OK 按钮。

    image-20250829163343245

  3. 会话删除成功，查看系统日志，显示管理员删除会话的记录，日志中会显示删除会话时所用的过滤器（filter:vd:0;sintf:not 0;dintf:not 0;proto:1-1;policy id:not 4294967295-4294967295;state1:not (100 mask:102);)，包含 IPv4 和 IPv6 会话。

    date=2025-08-29 time=16:34:19 eventtime=1756456458243468840 tz="+0800" logid="0100036883" type="event" subtype="system" level="warning" vd="root" logdesc="Clear active sessions" user="admin" ui="GUI(192.168.100.177)" method="https" msg="User:admin from GUI(192.168.100.177) clean active IPv6 sessions ( filter:vd:0;sintf:not 0;dintf:not 0;proto:1-1;policy id:not 4294967295-4294967295;state1:not (100 mask:102);)"

date=2025-08-29 time=16:34:19 eventtime=1756456458231928019 tz="+0800" logid="0100036883" type="event" subtype="system" level="warning" vd="root" logdesc="Clear active sessions" user="admin" ui="GUI(192.168.100.177)" method="https" msg="User:admin from GUI(192.168.100.177) clean active IPv4 sessions ( filter:vd:0;sintf:not 0;dintf:not 0;proto:1-1;policy id:not 4294967295-4294967295;state1:not (100 mask:102);)"

删除手工选中的会话

  1. 会话左侧手工选中 4 条会话（或使用 Ctrl/Shift + 鼠标点击选中），右键点击会话，并选择“结束会话”，只会删除手工选中的这 4 个会话（不会删除本地会话）。

    image-20250829164126424

  2. 弹出确认提示，点击 OK 按钮。

    image-20250829164229673

  3. 会话删除成功，查看系统日志，显示管理员删除会话的记录，日志中会显示这 4 个会话对应的过滤器。

    date=2025-08-29 time=16:44:38 eventtime=1756457078331716159 tz="+0800" logid="0100036883" type="event" subtype="system" level="warning" vd="root" logdesc="Clear active sessions" user="admin" ui="GUI(192.168.100.177)" method="https" msg="User:admin from GUI(192.168.100.177) clean active IPv4 sessions ( filter:vd:0;proto:6-6;source ip:192.168.100.177-192.168.100.177;dest ip:116.196.143.218-116.196.143.218;source port:55986-55986;dest port:443-443;)"

date=2025-08-29 time=16:44:38 eventtime=1756457078281143959 tz="+0800" logid="0100036883" type="event" subtype="system" level="warning" vd="root" logdesc="Clear active sessions" user="admin" ui="GUI(192.168.100.177)" method="https" msg="User:admin from GUI(192.168.100.177) clean active IPv4 sessions ( filter:vd:0;proto:6-6;source ip:192.168.100.177-192.168.100.177;dest ip:221.194.131.205-221.194.131.205;source port:58421-58421;dest port:443-443;)"

date=2025-08-29 time=16:44:38 eventtime=1756457078230556839 tz="+0800" logid="0100036883" type="event" subtype="system" level="warning" vd="root" logdesc="Clear active sessions" user="admin" ui="GUI(192.168.100.177)" method="https" msg="User:admin from GUI(192.168.100.177) clean active IPv4 sessions ( filter:vd:0;proto:6-6;source ip:192.168.100.177-192.168.100.177;dest ip:113.108.2.94-113.108.2.94;source port:55510-55510;dest port:18300-18300;)"

date=2025-08-29 time=16:44:38 eventtime=1756457078179695119 tz="+0800" logid="0100036883" type="event" subtype="system" level="warning" vd="root" logdesc="Clear active sessions" user="admin" ui="GUI(192.168.100.177)" method="https" msg="User:admin from GUI(192.168.100.177) clean active IPv4 sessions ( filter:vd:0;proto:6-6;source ip:192.168.100.177-192.168.100.177;dest ip:10.10.12.1-10.10.12.1;source port:63860-63860;dest port:22-22;)"

删除全部会话

重要

通过 GUI 删除全部会话，全部会话也包含本地会话，例如 BGP 路由会话和管理会话等，请谨慎操作。

  1. 删除整机转发流量的全部 IPv4/IPv6 会话，点击页面左上角的“结束会话 → 全部会话”按钮。

    image-20250829164902154

  2. 弹出确认提示，注意全部会话也包含本地会话，例如 BGP 路由会话和管理会话等，请谨慎操作，点击 OK 按钮。

    image-20250829165027644

  3. 会话删除成功，查看系统日志，显示管理员删除会话的记录，日志中显示全部会话的过滤器为filter:vd:0。

    date=2025-08-29 time=16:51:29 eventtime=1756457488487037179 tz="+0800" logid="0100036883" type="event" subtype="system" level="warning" vd="root" logdesc="Clear active sessions" user="admin" ui="GUI(192.168.100.177)" method="https" msg="User:admin from GUI(192.168.100.177) clean active IPv6 sessions ( filter:vd:0;)"

date=2025-08-29 time=16:51:29 eventtime=1756457488475491179 tz="+0800" logid="0100036883" type="event" subtype="system" level="warning" vd="root" logdesc="Clear active sessions" user="admin" ui="GUI(192.168.100.177)" method="https" msg="User:admin from GUI(192.168.100.177) clean active IPv4 sessions ( filter:vd:0;)"
最近更新:
统计数据加载中…
Copyright © 2025 Fortinet Inc. All rights reserved. Powered by Fortinet TAC Team.