XG 19 SD WAN Application timeout

Question

I have XG V19 Firewalls and created a SD-WAN policy to handle traffic for Site 2 Site Route based IPSec VPN with xfrm interfaces. 
 it works great, just some strange issue, many application that are used over that VPN timeout and crash after around 15 - 20 minutes, 
 so if a user has open an RDP session it will suddenly crash

Vivek Jagad · Answer

Hello Geniux , Thank you for providing the packet captures... Upon looking at the Conntrack captured we are able to see the initial tcp handshake: ============= But it looks like while capturing the pcap file, the packet capture was started late and hence it did not capture the initial tcp-handshake and just data packets were captured : Looks like there is a latency on either side especially when the packets coming from 4.159... As you notice the delta time, the packet response almost took 16s to reply and if you noticed the time reference, the packet took 120s, i.e. 2 mins, so if the server side has request time out set to 2 mins, there are chances the session may disconnect. You can compare this non-working scenario with the working scenario with the packet capture and try to diagnose whether or not latency occurs or not ? With the help of wireshark on either sides. Based on that whatever the packet loss or re-transmission or dup-ack from the server side, you can fine tune the timeout settings on the server side with the help of your server team. Additionally , on the Advance firewall settings you can toggle the following to see if that helps in improving the situation: You can check the status by logging with the admin credential via putty by SSH protocol > press 4 for the device console: console> show advanced-firewall =============================== And the try toggling the following: 1.) Midstream Connection Pickup 2.) TCP Seq Checking 3.) TCP Window Scaling 4.) TCP Selective Acknowledgements Commands can be found here along with the explanation: https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/Set/index.html