Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

FortiGate keeps a TCP session in its session table for a brief period after termination (receiving FIN/ACKs from both ends) to handle out-of-order or delayed packets. This state, analogous to the TCP TIMEWAIT state, ensures that late-arriving packets from the old session are correctly discarded and not misinterpreted as part of a new session that might reuse the same source/destination IP and port combination.

B. Security inspection is performed on packets as they transit the device in an active session, not after the session has already been terminated.

C. The NAT operation is tied to the session entry itself. The entry is kept for packet ordering reasons, not to perform a separate NAT removal task.

D. Logs are generated based on events (session setup, teardown). Keeping the session entry after termination is not required for the logging process itself.

1. FortiOS CLI Reference 7.0, config system session-ttl, p. 1788. The tcp-timewait timer is described: "TCP session time-out for sessions in the TIMEWAIT state (1 - 300 sec, default = 1)." This confirms a specific state exists for this purpose.

2. FortiOS Handbook - Troubleshooting 7.0, "Session table", p. 11. "After the session is closed, it is kept in the session table for a short time (the default is defined by the tcp-timewait timer) to allow for any out-of-order packets."