Controlling TCP keep-alives with SGOS

Products

• Advanced Secure Gateway Software - ASG
• ProxySG Software - SGOS
• ISG Proxy

Issue/Introduction

The EdgeSWG TCP keepalive timer can be adjusted to fit your networking environment.

 

Resolution

Starting with SGOS 7.3.7.1 and later, the EdgeSWG keep-alive can be adjusted with the following hidden parameters:

tcp-ip tcp-keepalive-idle <seconds> (default is 7200)
tcp-ip tcp-keepalive-interval <seconds> (default is 75)

tcp-keepalive-idle controls how long the EdgeSWG waits before transitioning a TCP connection to an idle state. The default of 7200 seconds means that the proxy will by default wait 2 hours for a connection to go on idle before the tcp-ip tcp-keepalive-interval starts kicking in.

tcp-keepalive-interval controls how long the EdgeSWG waits between each keepalive probe (assuming there is no response to the probe). After 8 probes without any response, the TCP connection will be reset.

These values will only be changed on newly created connections. Restart the EdgeSWG after making these changes so that the values can be adjusted to all TCP connections.

Exercise caution with these commands since they can introduce extra traffic overhead if the values are adjusted too low.

In SGOS releases prior to 7.3.7.1, the command:

tcp-ip tcp-keepalive-timeout <seconds> (default is 7200)

is available to adjust when the keepalive probe is to be sent after the TCP connection is considered idle.

This value will only be changed on newly created connections. Restart the EdgeSWG after making this change so that the values can be adjusted to all TCP connections.

Exercise caution with this command since it can introduce extra traffic overhead if the value is adjusted too low.