Technical Alerts

TCP Keep-alive timer changed from 2 minutes in SGOS 4.x to 2 hours in SGOS 5.x

Technical Alerts ID:    TFA36
Version:    3.0
Status:    Published
Published date:    06/11/2010
Updated:    07/07/2010
 

Affected products and versions

ProxySG 5.1.1.1 and later

Problem description

ProxySG OS versions 5.1.1.1 and later has an RFC compliant TCP Keep-alive timer of 2 hours.  According to RFC1122, section 4.2.3.6:

Keep-alive packets MUST only be sent when no data or acknowledgement packets have been received for the connection within an interval.  This interval MUST be configurable and MUST default to no less than two hours.

However, this was not the implementation in SGOS 4.x.  In version 4.x, the keep-alive timer was set to 2 minutes (120 seconds).  Because of this implementation and the long history of SGOS 4, some Blue Coat customers may have implementations which rely on the shorter keep-alive timer. 

Though many applications do not rely on the TCP keep-alive timer and have their own application-based keep-alive messages, some applications such as FTP do use the TCP timer. 

For example, an FTP connection will have a control connection over which commands are sent and a separate data connection over which files are sent.  A slow connection will have a lot of activity on the data connection, but none on the control connection after it is established.  If the control connection times out, the file transfer may fail.

Status

While the issue, strictly speaking is not a violation of established standards, it is a change in functionality.  Therefore, Blue Coat has released a new version of SGOS 5.x (5.5.3.1) which provides a Command Line Interface command switch to allow an administrator to globally change the TCP Keep-alive timer.  The range will be anywhere from 60 seconds (1 minute) and 7200 seconds (2 hours).

Workaround

There is no workaround presently available in SGOS 5.  A fix is available in SGOS 5.5.3.1.

Resolution

This issue was resolved in SGOS 5.5.3.1.  The TCP-IP keepalive timeout can now be set, a range of 1 minute to 2 hours can be selected (60 and 7200 seconds).  This can be done using the following command in the ProxySG Command Line Interface in Config Terminal mode:
#(config)tcp-ip tcp-keepalive-timeout 7200

Administrators can view the current keepalive timeout with the following command:
#(config)show tcp-keepalive-timeout

You can download SGOS 5.5.3.1 here:
bto.bluecoat.com/download/product/41


Rate this Page

Please take a moment to complete this form to help us better serve you.

Did this document help answer your question?
 
 
If you are finished providing feedback, please click the RATE CONTENT button. Otherwise, please add more detail in the following text box and then click RATE CONTENT.
 
 

Your response will be used to improve our document content.

Ask a Question