Issue with SSH and RDP connections times out

http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=285

 

 

Suggests:

 

Idle Timeout

 

 

The explanation of the idle timeout is fairly intuitive. This setting controls the number of seconds the connection remains idle before the LTM closes it. For most applications, the default 300 seconds is more than enough, but for applications with long-lived connections like remote desktop protocol, the user may want to leave the desk and get a cup of coffee without getting dumped but the administrators don't want to enable keepalives. The option can be configured with a numeric setting in seconds, or can be set to indefinite, in which case the abandoned connections will sit idle until a reaper reclaims them or services are restarted. I try to isolate applications onto their own virtual servers so I can maximize the profile settings, but in the case where a wildcard virtual is utilized, the idle timeout can be set in an iRule with the IP::idle_timeout command:

 

 

when CLIENT_ACCEPTED {

 

switch [TCP::local_port] {

 

"22" {

 

IP::idle_timeout 600

 

}

 

"23" {

 

IP::idle_timeout 600

 

}

 

"3389" {

 

IP::idle_timeout 3600

 

}

 

default {

 

IP::idle_timeout 120

 

}

 

}

 

 

....Maybe this is _the_ way to go. Dunno if during the 3600 seconds if the RDP keep-alive willl keep this session active so it wont disconnect after 60min. We'll see!

 

 

 

Any other ideas?

 

//Robert

 

Hi Robert,

 

 

Using an indefinite timeout would open yourself up to potential resource issues (ports and memory). If the VIPs are open to untrusted traffic, I'd definitely not use an indefinite timeout. Even for trusted clients, is it really a requirement to leave an idle connection up for more than eight hours? As Citizen Elah suggests in his article, it's more ideal if you can configure separate VIPs for separate protocols. If you want to keep the number of VIPs down and decide to use a single VIP for multiple protocols, then the iRule he provided does make good sense.

 

 

Aaron

Another option may be to enable RDP Keepalives on your servers. This will keep a constant flow of traffic, so the connections do not timeout. But may not be compatible with older RDP clients.