Controlling TCP keep-alives with SGOS

Products

• Advanced Secure Gateway Software - ASG
• ProxySG Software - SGOS
• ISG Proxy

Issue/Introduction

The ProxySG TCP keepalive timer can be adjusted to fit your networking environment.

 

Resolution

Starting with SGOS 7.3.7.1 and later, the Proxy SG keep-alive can be adjusted with the following hidden parameters:

tcp-ip tcp-keepalive-idle <seconds> (default is 7200)
tcp-ip tcp-keepalive-interval <seconds> (default is 75)

tcp-keepalive-idle controls how long the ProxySG waits before transitioning a TCP connection to an idle state.

tcp-keepalive-interval controls how long the ProxySG waits between each keepalive probe (assuming there is no response to the probe). After 8 probes without any response, the TCP connection will be reset.

These values will only be changed on newly created connections. Restart the ProxySG after making these changes so that the values can be adjusted to all TCP connections.

Exercise caution with these commands since they can introduce extra traffic overhead if the values are adjusted too low.

In SGOS releases prior to 7.3.7.1, the command:

tcp-ip tcp-keepalive-timeout <seconds> (default is 7200)

is available to adjust when the keepalive probe is to be sent after the TCP connection is considered idle.

This value will only be changed on newly created connections. Restart the ProxySG after making this change so that the values can be adjusted to all TCP connections.

Exercise caution with this command since it can introduce extra traffic overhead if the value is adjusted too low.