Verify SM_ENABLE_TCP_KEEPALIVE is working?
Article ID: 15634
Updated On:
Products
Issue/Introduction
How to verify " SM_ENABLE_TCP_KEEPALIVE " setting when a firewall exists between the Policy Server and the Web Agent?
How to know if SM_ENABLE_TCP_KEEPALIVE works?
Some errors appear in the Policy Server and Web Agent.
- smps.log:
[2424828/140236688439040][Mon Apr 14 2025 11:06:18.770][CServer.cpp:2416][ERROR][sm-Server-01080] Failed to send response on session # 3188099 : <server>/10.0.1:58128. Socket error 104
- WebAgent.log:
[09/13/2024][09:25:24][13304270][21589][CSmLowLevelAgent.cpp:552][IsResourceProtected][][*10.0.0.8][][<agent>][/<app>][<user>][Communication failure between SiteMinder policy server and web agent.]
There are also "Ghost" connections that the Policy Server does not detect.
The connections cut off by the firewall are not being detected.
The Policy Server continues to show these connections in an ESTABLISHED state with no real traffic, indicating they are "ghost" connections disconnected by the firewall but remaining active in SiteMinder.
Environment
SiteMinder Policy Server (All Versions)
SiteMinder Web Agent / Access Gateway
Resolution
To verify TCP Keep-Alive is working, capture network trace and produce a disconnection from the Web Agent to the Policy Server.
When the server detects that the other end is disconnected, it sends the keep-alive packets, which will appear in the network trace.
This can be done by setting a firewall rule that drops requests from the Web Agent to the Policy Server while capturing the network trace.
Then, depending on the OS TCP Keep-Alive settings, packets will appear in the network trace according to the intervals set in the system.
First, verify that the environment variable is correctly set to 1 on both servers (the Policy Server side and the Web Agent side) by checking the current variables:
SM_ENABLE_TCP_KEEPALIVE=1
Check the current TCP Keep-Alive OS settings (1):
# cat /proc/sys/net/ipv4/tcp_keepalive_time
7200
# cat /proc/sys/net/ipv4/tcp_keepalive_intvl
75
# cat /proc/sys/net/ipv4/tcp_keepalive_probes
9
To change any values, use echo to update the values:
# echo 600 > /proc/sys/net/ipv4/tcp_keepalive_time
Don't change any value without consulting the sysadmin.
For more information on OS TCP Keep-Alive settings, check OS vendor documentation.
Also, a service restart is needed for the changes to apply after setting the SM_ENABLE_TCP_KEEPALIVE environment variable.
The Keep-Alive packets in network traces will look like the following (For reference only):
17922 10:33:21.988218 <PS IP> <WA IP> TCP 66 [TCP Keep-Alive] 44443 → 45935 [ACK] Seq=230 Ack=155 Win=14528 Len=0 TSval=4180041061 TSecr=3010560045
17949 10:33:23.263118 <PS IP> <WA IP> TCP 66 [TCP Keep-Alive] 44443 → 45934 [ACK] Seq=20290 Ack=1367 Win=17152 Len=0 TSval=4180042336 TSecr=3010561322
17986 10:33:25.324121 <PS IP> <WA IP> TCP 66 [TCP Keep-Alive] 44443 → 45938 [ACK] Seq=230 Ack=155 Win=14528 Len=0 TSval=4180044397 TSecr=3010563383
17987 10:33:25.330148 <PS IP> <WA IP> TCP 66 [TCP Keep-Alive] 44443 → 45937 [ACK] Seq=17241 Ack=230 Win=14528 Len=0 TSval=4180044403 TSecr=3010563389
When using Wireshark to review the network traces, use the filter "tcp.analysis.keep_alive" to see only these packets.
Additional Information
Feedback
