Session drops without notifying the device

[phadobas]

I've been scratching my head on this for months. I have users with Blackberry phones (remember those?). They have a built-in, IP-based communication feature called PIN messaging. A version of that is Blackberry Messenger, but right now I'm talking about PIN messaging only. We have been using this for years without any issue ever.

That is until (what it looks like) we got Fortigate firewall for the organization and since then, when a Blackberry is on our corporate wifi behind this firewall, often a message sent to a Blackberry gets delayed by 5-10-15 minutes. It used to always be instant. When I turn the wifi off on the phone, and allow it to use its data connection from the carrier (cell phone service provider), the issue goes away.

When you send a PIN message from one Blackberry to another, the sender phone sends it to the "Blackberry Infrastructure", they receive the message and push it on to the other Blackberry. 

So I opened a ticket with Blackberry (the company) and they anaylized their logs for some of the delayed messages I reported to them. What they say is this:

-----

From the logs we can see that for the delay, there are open TCP connections over WiFi but by the time we receive message and attempt a delivery the TCP connection is no longer available, as if it was disconnected at the remote end. We suspect that this is a WiFi or other internal network issue where established connections are being disconnected too early and the handheld is not being notified that the established connection is dropped. Things you could check 1. Check networking devices/firewalls to ensure that if it does disconnect established connections that it sends a reset to the device 2. There is a keepalive of about 15-16 minutes. It would be helpful to check if established connections are dropped before this time or too early 3. It would also be helpful to have you connect to another WiFi network and test this like already suggested.

-----

The only change in our network was a firewall upgrade, time coincident to when this issue started. When I go to other wifi (tested it on Starbucks wifi), the issue doesn't occur. That's why I'm suspecting Fortigate and that's why I'm posting this.

The IT person who manages this firewall changed the session timeout setting to a higher value (I think it was changed to 1hr from the default), but it didn't make any difference.

Anybody has any idea what to look at?