SAP (business application) disconnecting

NGUSER6947

I've been experiencing daily SAP dropouts. Support is asking me to enable TCP Keepalive. I've not messed with any of those types of settings before in pfSense. Can anyone provide any assistance?

This application (SAP) only runs on my work computer, which is the only device on the OPT interface on my SG-1100.

They also suggested increasing the DHCP lease time to the maximum available duration.

Appreciate any suggestions.

michmoor

@nguser6947 Is your work computer on a company VPN when these dropouts happen?

NGUSER6947

@michmoor Yes, ZScaler. They (the ZScaler support folks) can see the dropouts. They've changed some other settings inside the VPN but the problem persists.

Unfortunately I can't run the SAP application at all with the VPN disconnected, to be able to test it. Without the VPN it won't launch.

michmoor

@nguser6947 Dont really see how this is related to pfsense in any way.
Are you able to use zScaler on another machine and connect to SAP? If so do the disconnects continue?

stephenw10

You can just set the firewall optimisation to conservative to increase the state timeouts:

https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#firewall-optimization-options

A TCP keep-alive would be something inside the VPN which I assume is from your client on OPT to the remove Zscaler device directly.

Steve

NGUSER6947

@michmoor said in SAP (business application) disconnecting:

@nguser6947 Dont really see how this is related to pfsense in any way.
Are you able to use zScaler on another machine and connect to SAP? If so do the disconnects continue?

I don't see how either. I'm just trying to comply with their requests, to eliminate potential sources of the issue.

Others in the company, for the most part, do not have this issue and it is only that one application that exhibits this symptom.

NGUSER6947

@stephenw10 said in SAP (business application) disconnecting:

You can just set the firewall optimisation to conservative to increase the state timeouts:

https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#firewall-optimization-options

A TCP keep-alive would be something inside the VPN which I assume is from your client on OPT to the remove Zscaler device directly.

Steve

I'll follow those instructions, thank you!