Intermittent OPC UA Session Drops After HA Change
An energy company runs a FortiGate 200F HA pair in active-passive between a DCS and a remote HMI over a 40 ms WAN. After adding a new policy for OPC UA on TCP 4840, the HMI loses its session every 4-6 minutes for 20-40 seconds, then reconnects. The DCS logs show TCP resets; FortiGate logs show session timeouts and occasional HA failover. The OPC UA server also opens dynamic ports for some subscriptions. The pair uses interface monitoring on the WAN and HA override is enabled. A packet capture on the DCS shows retransmissions and a 1400-byte MTU path. No issues occurred before the policy change. The team wants to disable IPS and HA to stabilize the link.
1. Build a troubleshooting sequence to isolate whether the drops are caused by HA, policy/session handling, MTU, or OPC UA dynamic ports.
Read the worked answer
Build a timeline first. Correlate HMI drop times with HA event logs, interface monitor flaps, and policy install times. If drops align with HA failovers, the WAN monitor or HA override is the cause; a 40 ms path can trip aggressive thresholds.
If not, inspect session tables and diagnose debug flow for the OPC UA flows: look for RSTs from FortiGate, session timeouts, and whether return traffic uses a different path. Test MTU with DF-bit pings at 1400 bytes and check MSS clamping and ICMP fragmentation-needed handling. Capture on both sides to see whether the server or firewall resets.
Then check OPC UA dynamic ports: if subscriptions open ports outside 4840 and the policy only permits 4840, the subscription will fail or time out. The 4-6 minute period suggests a keepalive or session timeout more than an immediate policy deny, so do not start by disabling IPS.
2. Which FortiGate settings or design changes would you correct, and which proposed workaround would you reject?
Read the worked answer
Correct the HA design first: disable HA override unless there is a deliberate reason, relax or remove the WAN interface monitor if the 40 ms link is flapping, and ensure session pickup is enabled. Fix path MTU by clamping MSS on the OPC UA policy and permitting ICMP fragmentation-needed; do not just lower the interface MTU blindly. If OPC UA uses dynamic ports, define the known range in the policy or use an OT application signature that tracks the control channel, and document the risk.
Reject disabling IPS and HA as a permanent fix; that trades availability risk for security and resilience loss. If a temporary bypass is needed, scope it to the OPC UA policy and set an expiry. Also verify the new policy is synced to both HA units and that NAT or session helpers are not altering the OPC UA control flow.
3. What evidence would confirm root cause before you change the design?
Read the worked answer
Before changing anything, collect HA event logs with timestamps, HMI and DCS reconnect logs, FortiGate session table snapshots during and after a drop, diagnose debug flow output for one failed session, packet captures on both sides, MTU/DF ping results, and the OPC UA server's actual listening ports.
Confirm that the same five-tuple fails and whether the FortiGate or server sends the RST. A controlled test during a maintenance window, with one HMI and one subscription, with and without the new policy, can isolate policy versus HA. Only after the evidence points to one cause should you change monitor thresholds, MSS, or port rules. This avoids stacking workarounds until the original symptom disappears but the root cause remains.