Administration Console timeouts

[rsm_gbg]

Hi,

I got a very complicated access path from the office to my NBU master server. (7.1.0.3)
It is probably not supported in any way but it works

This is briefly how it is setup

My WS (Solaris) -> fw1 -> "private LAN to remote site" -> fw2 -> Master server

To accomplish this there is a ssh-tunnel (3-way tunnel, 3 ports) between fw1 and the Master.
My WS runs the Admin Console and use that ssh-tunnel to connect to the Master.
I have run like this for years without any problems, just occasional restarts of the Admin console.

Now I got a new problem, Network restructured our network so there is another fw between my WS and fw1.
eg.

My WS (Solaris) -> fw1 -> fw2 -> "private LAN to remote site" -> fw3 -> Master server

I got the same ssh-tunnel (between fw2 and fw3) and all is working fine,
BUT 10 times a day my console "hangs" and I have to restart it.
Very annoying and we been trying to figure out what is causing it to hang.
All fw rules seems to work as expected and nothing is blocked anywhere.
The only thing we can see is that it might be a timeout issue between the Admin Console and Master.

To many fw and stuff on the way that sometimes it just takes to long before the Admin Console gets a response back so it might hang.
This is just a theory of mine...

The question is if there is some setting that could Tweak the Admin Console to wait a bit more.
I could test increasing it to see if it helps.

btw I'm running /usr/openv/netbackup/bin/jnbSA

- Roland

[Nicolai]

Have you configured  TCP_KEEP_ALIVE and TCP_KEEP_ALIVE_RETRY ?

Normal a firewall with its default configuration will close all sessions that has been idle for 15 minutes. Configure tcp keepalive parameters on workstation and master server to send keep alive packages within 15 minutes.

See :

http://www.starquest.com/Supportdocs/techStarLicense/SL002_TCPKeepAlive.shtml

http://www.symantec.com/docs/TECH125896 

Hope it helps :)

[rsm_gbg]

I have played around will all sorts of parameters now and nothing seems to help.

Any more ideas?

[Mark_Solutions]

Some firewalls have a keep alive setting which defaults to 1 hour - have that checked out and increased (or you ip addresses excluded from the setting)

For the servers themselves i find the following work well:

tcp_keepalive_time set to 510

tcp_keepalive_intvl set to 3

tcp_keepalive_probes set to 3

Hope this helps