The most precise and recommended method to resolve this issue without affecting other services is to isolate the configuration change to only the specific traffic flow. This is achieved by creating a new, custom service object specifically for the Telnet traffic that requires a longer session timeout. Then, a new, dedicated firewall policy is created for this specific traffic (SSL VPN users to the Linux server via Telnet) using the new custom service object. By placing this new policy above the existing, more general SSL VPN policy, FortiGate will match the specific Telnet traffic first and apply the longer session timeout, while all other traffic falls through to the original policy with its default settings.

A. Modifying the predefined TELNET service object is a global change that would affect all firewall policies using this service, violating the requirement not to impact other services.

B. Setting the session TTL on the entire SSL VPN policy would apply the longer timeout to all traffic matching that policy (e.g., HTTP, DNS), not just Telnet, which is an unnecessarily broad change.

1. FortiOS 7.0.1 Administration Guide

Page 448 (Firewall policies): "FortiGate matches traffic to the first policy in the list that meets the criteria. Once a match is found

no other policies are checked. For this reason

you should place more specific policies at the top of the policy list." This supports the strategy in option D of creating a more specific policy and placing it first.

2. FortiOS 7.0.0 CLI Reference

Page 1018 (config firewall service custom): This section details the commands for creating a custom firewall service. Within this configuration context

the set session-ttl command is available. This confirms that a custom service object can be created with a specific session TTL

as described in option C.

3. Fortinet Cookbook (KB)

"Changing the session TTL" (FD30062): This document explains the different methods for modifying session TTL. It states

"The session TTL value can be configured globally

per VDOM

in a firewall policy

or in a firewall service." It implicitly supports the best practice of using the most granular method (a custom service within a specific policy) to avoid unintended consequences on other traffic.