Simple definition
A FortiGate Session Helper is a FortiOS mechanism that assists protocols whose secondary connections or network information are negotiated inside application traffic.
Technical definition
For protocols such as FTP or some SIP deployments, tracking only the initial ports may be insufficient because the protocol dynamically announces addresses or additional connections. A session helper can inspect those exchanges, create session expectations, or adjust NAT handling so related flows can traverse the firewall.
How it works / role
Its role is similar to an ALG: understand selected complex protocols beyond the initial IP/port tuple so the required dynamic flows can be handled. This intervention can also conflict with some applications or modern architectures.
What is it used for?
Help protocols that open multiple connections or dynamically negotiate ports work through a firewall or NAT device.
Practical example
An FTP control session negotiates a separate data connection. The helper mechanism allows the FortiGate to recognize and handle the related flow correctly.
Common issues
- Helper remains active although the application already handles NAT correctly
- SIP traffic is altered, causing signaling or audio problems
- Helper is disabled without providing the required alternative handling
- Troubleshooting is complicated by dynamically created related sessions
Related terms
Key takeaway: Do not disable a session helper by habit alone; first confirm its role for the protocol and validate behavior after the change.