TCP Connection drops after a while on a IBM AS/400

[Nikolaos_Liakop]

We have an issue regarding a specific connection on a S2S VPN between a CP cluster and Cisco ASA.
Specifically, whilst the tunnel poses no issues and everything seems to be fine, an IBM AS/400 server is behind the CP and the clients accessing it are behind the ASA.
The clients complain that the sessions all of a sudden close after an arbitrary amount of time.
I have proceeded with creating a new telnet service with the following characteristics, but the issue seems to still occur.

Any ideas ?

Regards

[Alex-]

Check your IPS if you run it and core protections. I had AS/400 connections blocked because Telnet is considered insecure and blocked by this blade and needed to configure exceptions.

Also, there's obviously the ASA side which might not match your protocol definitions.

[Nikolaos_Liakop]

It is not an IPS issue.

The connection gets established.

However after some arbitrary time the connections gets droppped and they need to relogin...

Protocol is telnet

[Chris_Atkinson]

Arbitrary like when the firewall policy is installed or when a rekey occurs for the VPN?

[Timothy_Hall]

As Chris said this is probably related to the VPN more than the basic session timeouts, but try enabling TCP state logging to obtain more details about how and why your telnet connections are being terminated: 

sk101221: TCP state logging

Is there some particular reason you are not synchronizing the telnet sessions across the cluster members?  If deployed as shown in your screenshot a failover will cause all of the currently open telnet sessions to be killed on the newly active member.

Also note that the TCP connection timeout can now be increased well beyond 86400 seconds if you have the latest Jumbo HFA: sk168872: Virtual session timeout for a TCP Service (86400 seconds) is not long enough for a specifi...