Session Timeout Value Change

[#1]

Have any of you had trouble with applications running through your FG either via plain-text Internet or VPN? My company has had several problems with the default session ttl of 300 seconds. Most of the problems deal with sessions to applications being run over VPN, but there is a circumstance that deals with FTP as well, i.e. someone tries to download a large (several hundred MB) file that takes longer than 300 seconds to download and gets disconnected. The VPN problems relate to Terminal Service sessions being disconnected after 300 seconds, Outlook MAPI connections that are being disconnected when running over VPN, etc... I' ve decided to change the default 300 seconds to 14400 seconds with the command:

set system session_ttl default 14400

I realize that this will result in more sessions being left open for longer than required in some circumstances, which will result in a loss of performance. However, we have an FG-300 which is capable of supporting 200,000 sessions. During an extremely heavy day, our company has at most 500 sessions going. That' s .25% of the boxes maximum capability. I think I have room to increase the session timeout a bit. ;-) Does anyone else have an opinion on this move? Has anyone else made a similar move with their FG?

[Johan_Lysen]

I had the same kind of problems My solution was to set session timeout higher AND disable NIDS/NIPS, logging and antivirus - now all my problems are gone I suspect the NIDS/NIPS /Johan