<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Selinux is not enabled and no firewall is active (except iproutes rules).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Looking in the TLS module, I found the modparam
</span><b><i><span style="font-size:14.0pt;font-family:"Calibri","sans-serif";color:#1F497D">connection_timeout</span></i></b><span style="font-size:14.0pt;font-family:"Calibri","sans-serif";color:#1F497D">
</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">By default, this parameter is set to 10 minutes (!), but the description says : “</span><span class="apple-converted-space"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black;background:white"> </span></span><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black;background:white">If
an I/O event occurs, the timeout will be extended with tcp_connection_lifetime”</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">So I was expecting that after the first successful REGISTER, this timeout was set to my own param tcp_connection_lifetime value (3605). But it seems this is
not the case.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I added the TLS parameter connection_timeout and set it also to 3605, and the first result show it seems to work, but I must do more tests to verify it is ok.
Setting this parameter to -1 means the TLS connection will never be closed: do you think it is a good idea to set it to -1?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Giovanni<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Daniel-Constantin Mierla-6 [via SIP Router] [mailto:ml-node+<a href="/user/SendEmail.jtp?type=node&node=152658&i=0" target="_top" rel="nofollow" link="external">[hidden email]</a>]
<br>
<b>Sent:</b> jeudi 20 octobre 2016 15:28<br>
<b>To:</b> Mele Giovanni<br>
<b>Subject:</b> Re: TCP FIN after 10 minutes<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello, <br>
<br>
do you have selinux enabled or some firewall active on the system? <br>
<br>
Cheers, <br>
Daniel <br>
<br>
<br>
On 20/10/16 13:25, gmele wrote: <o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
> Hello, <br>
> <br>
> we have deployed a Kamailio acting as SIP proxy on a RHEL 7.2 machine. <br>
> Clients (mainly mobile phones) connects to the proxy using a TLS protected <br>
> TCP connection. <br>
> <br>
> In the kamailio config, we've set : <br>
> <br>
> #!ifdef WITH_TLS <br>
> enable_tls=yes <br>
> tcp_async=yes <br>
> tcp_connection_lifetime=3605 <br>
> tcp_accept_no_cl=yes <br>
> tcp_crlf_ping = yes <br>
> #!endif <br>
> <br>
> Our problem is that, even if we set the tcp_connection_lifetime to > 1 hour, <br>
> the tcp connection is closed after 10 minutes: on tcp dumps, we see clearly <br>
> the TCP FIN sent by machine hosting the kamailio proxy... Setting parameters <br>
> tcp_keepidle/keepintlv/keepcnt in the kamailio config didn't change the <br>
> behavior. We also set TCP keepalived at system level, but without result... <br>
> This TCP closure is causing us lot of problems when calls between 2 UAs last <br>
> more than 10 minutes because the REINVITE or BYE messages are lost. Also, <br>
> closing the TCP connection will wake up the mobile app and make it resend a <br>
> REGISTER, thing we absolutely want to avoid. <br>
> <br>
> Is there a parameter we can use to avoid this closure? I had a look in <br>
> previous posts, found people with the same problem as mine, but no real <br>
> solution... <br>
> <br>
> Thx for your help. <br>
> <br>
> Giovanni <br>
> <br>
> <br>
> <br>
> -- <br>
> View this message in context: <a href="http://sip-router.1086192.n5.nabble.com/TCP-FIN-after-10-minutes-tp152646.html" target="_top" rel="nofollow" link="external">
http://sip-router.1086192.n5.nabble.com/TCP-FIN-after-10-minutes-tp152646.html</a><br>
> Sent from the Users mailing list archive at Nabble.com. <br>
> <br>
> _______________________________________________ <br>
> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list <br>
> <a href="/user/SendEmail.jtp?type=node&node=152653&i=0" target="_top" rel="nofollow" link="external">[hidden email]</a>
<br>
> <a href="http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users" target="_top" rel="nofollow" link="external">
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users</a><o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
-- <br>
Daniel-Constantin Mierla <br>
<a href="http://twitter.com/#!/miconda" target="_top" rel="nofollow" link="external">http://twitter.com/#!/miconda</a> -
<a href="http://www.linkedin.com/in/miconda" target="_top" rel="nofollow" link="external">http://www.linkedin.com/in/miconda</a><br>
Kamailio Advanced Training, Berlin, Oct 24-26, 2016 - <a href="http://www.asipto.com" target="_top" rel="nofollow" link="external">
http://www.asipto.com</a><br>
<br>
<br>
_______________________________________________ <br>
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list <br>
<a href="/user/SendEmail.jtp?type=node&node=152653&i=1" target="_top" rel="nofollow" link="external">[hidden email]</a>
<br>
<a href="http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users" target="_top" rel="nofollow" link="external">http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users</a><br>
<br>
<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="1" width="100%" noshade="" style="color:#CCCCCC" align="center">
</div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Tahoma","sans-serif";color:#444444">If you reply to this email, your message will be added to the discussion below:<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Tahoma","sans-serif";color:#444444"><a href="http://sip-router.1086192.n5.nabble.com/TCP-FIN-after-10-minutes-tp152646p152653.html" target="_top" rel="nofollow" link="external">http://sip-router.1086192.n5.nabble.com/TCP-FIN-after-10-minutes-tp152646p152653.html</a>
<o:p></o:p></span></p>
</div>
<div style="margin-top:4.8pt">
<p class="MsoNormal" style="line-height:18.0pt"><span style="font-size:8.5pt;font-family:"Tahoma","sans-serif";color:#666666">To unsubscribe from TCP FIN after 10 minutes,
<a href="" target="_top" rel="nofollow" link="external">
click here</a>.<br>
<a href="http://sip-router.1086192.n5.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml" target="_top" rel="nofollow" link="external"><span style="font-size:7.0pt;font-family:"Times New Roman","serif"">NAML</span></a>
<o:p></o:p></span></p>
</div>
</div>
<br/><hr align="left" width="300" />
View this message in context: <a href="http://sip-router.1086192.n5.nabble.com/TCP-FIN-after-10-minutes-tp152646p152658.html">RE: TCP FIN after 10 minutes</a><br/>
Sent from the <a href="http://sip-router.1086192.n5.nabble.com/Users-f3.html">Users mailing list archive</a> at Nabble.com.<br/>