TCP Keep-alive timer changed from 2 minutes in SGOS 4.x to 2 hours in SGOS 5.x


<< Back to Knowledge Search

Technical Alert

Affected Products

ProxySG 5.1.1.1 and later

Overview

ProxySG OS versions 5.1.1.1 and later has an RFC compliant TCP Keep-alive timer of 2 hours.  According to RFC1122, section 4.2.3.6:

Keep-alive packets MUST only be sent when no data or acknowledgement packets have been received for the connection within an interval.  This interval MUST be configurable and MUST default to no less than two hours.

However, this was not the implementation in SGOS 4.x.  In version 4.x, the keep-alive timer was set to 2 minutes (120 seconds).  Because of this implementation and the long history of SGOS 4, some Blue Coat customers may have implementations which rely on the shorter keep-alive timer. 

Though many applications do not rely on the TCP keep-alive timer and have their own application-based keep-alive messages, some applications such as FTP do use the TCP timer. 

For example, an FTP connection will have a control connection over which commands are sent and a separate data connection over which files are sent.  A slow connection will have a lot of activity on the data connection, but none on the control connection after it is established.  If the control connection times out, the file transfer may fail.

Status

While the issue, strictly speaking is not a violation of established standards, it is a change in functionality.  Therefore, Blue Coat has released a new version of SGOS 5.x (5.5.3.1) which provides a Command Line Interface command switch to allow an administrator to globally change the TCP Keep-alive timer.  The range will be anywhere from 60 seconds (1 minute) and 7200 seconds (2 hours).

Resolution

This issue was resolved in SGOS 5.5.3.1.  The TCP-IP keepalive timeout can now be set, a range of 1 minute to 2 hours can be selected (60 and 7200 seconds).  This can be done using the following command in the ProxySG Command Line Interface in Config Terminal mode:
#(config)tcp-ip tcp-keepalive-timeout 7200

Administrators can view the current keepalive timeout with the following command:
#(config)show tcp-keepalive-timeout

You can download SGOS 5.5.3.1 here:
bto.bluecoat.com/download/product/41

Workaround

There is no workaround presently available in SGOS 5.  A fix is available in SGOS 5.5.3.1.

Bug Number

140474

InQuira Doc IdTFA36
Attachment

Article Feedback

Hide Properties
First Published      10/01/2014
Last Modified      10/01/2014
Last Published      10/01/2014
Article Audience
Product      ProxySG
Software      SGOS 5
Topic      Networking
Article Number      000007650
Summary     
Was this helpful?
Comments:
 
Previous MonthNext Month
SunMonTueWedThuFriSat