Overview
The Override Idle Timeout setting prevents FortiGate API sessions from expiring because of inactivity.
When enabled, FortiGate keeps API sessions active for longer periods. This can help integrations that make API requests infrequently and otherwise experience unexpected session expiration or disconnection.
When this setting may help
Consider this setting when:
- An API integration makes requests at long intervals.
- API sessions expire between scheduled requests.
- The integration reports intermittent logouts or session disconnects.
- API requests succeed when made frequently but fail after a period of inactivity.
The setting is not normally required for every FortiGate API integration.
Recommended default
Keep Override Idle Timeout disabled unless the integration is affected by API session expiration.
Before enabling it, confirm that the issue is related to session timeout rather than:
- Invalid or revoked API credentials.
- Insufficient API permissions.
- Trusted Hosts restrictions.
- Network connectivity problems.
- FortiOS compatibility.
- API rate limits or session limits.
Security considerations
Longer-lived API sessions can slightly increase risk if API credentials or tokens are exposed.
If you enable the setting:
- Use a dedicated FortiGate API administrator for Auvik.
- Apply the least-privilege Administrator Profile required by the integration.
- Restrict API access using Trusted Hosts where appropriate.
- Store API keys securely.
- Rotate API keys according to your security policy.
- Remove unused API administrators and credentials.
- Review active API sessions periodically.
Resource considerations
Persistent API sessions generally use minimal resources, but a large number of integrations or clients can create unnecessary session activity.
Monitor the FortiGate if:
- Multiple integrations connect to the device.
- The device has limited resources.
- Active API sessions continue to accumulate.
- The device reports session-capacity warnings.
Troubleshooting unexpected API disconnects
Before enabling Override Idle Timeout, verify:
- The FortiGate API administrator is enabled.
- The API key has not been revoked or regenerated.
- The assigned Administrator Profile has the required permissions.
- REST API access is enabled.
- The Auvik Collector can reach the FortiGate over HTTPS.
- The Collector’s source IP is permitted by Trusted Hosts.
- FortiOS is supported by Auvik.
- FortiGate logs do not show denied API requests.
- No API rate limit or session limit is being reached.
If these checks are successful and sessions still expire during long periods of inactivity, enable Override Idle Timeout and monitor the integration.
When to contact Support
Contact Auvik Support if:
- API sessions continue to drop after the setting is enabled.
- Enabling the setting causes unexpected behavior.
- The FortiGate shows excessive active API sessions.
- Auvik authentication succeeds but API collection remains intermittent.
Include the following information:
- FortiGate model and FortiOS version.
- Whether Override Idle Timeout is enabled or disabled.
- Auvik device name and site.
- API client or integration name.
- Approximate session-drop timestamps, including timezone.
- Relevant FortiGate API or administrative log messages.
- Any HTTP status codes or error messages returned by the integration.