asked on

MSExchange ActiveSync Event ID 1040 Annoying?!

Log Name: Application
Source: MSExchange ActiveSync
Date: 6/15/2010 12:07:43 AM
Event ID: 1040
Task Category: Requests
Level: Warning
Keywords: Classic
User: N/A
Computer: exchserver.domain.local
Description:
The average of the most recent heartbeat intervals [350] for request [Ping] used by clients is less than or equal to [540].
Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed.

For more information about how to configure firewall settings when using Exchange ActiveSync, see Microsoft Knowledge Base article 905013, "Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=905013).

Getting this every now and then, is it serious? Should I be worried? Everything working fine, still. There is no ISA only a Sonicwall Firewall.

ASKER CERTIFIED SOLUTION

ron0110

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

digitap

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SpiderPig

ASKER

Should I change both UDP and TCP or just TCP? TCP was on 15 mins, so it had to be that.

Thanks.

digitap

Just TCP. I don't ever recall seeing one for UDP traffic. I believe that's because UDP isn't guaranteed and TCP is.

SpiderPig

ASKER

Shoot! I got another one after changing the FW WAN - LAN rule on (443 and 143).

Log Name: Application
Source: MSExchange ActiveSync
Date: 6/15/2010 9:41:32 PM
Event ID: 1040
Task Category: Requests
Level: Warning
Keywords: Classic
User: N/A
Computer: server.domain.local
Description:
The average of the most recent heartbeat intervals [412] for request [Ping] used by clients is less than or equal to [540].
Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed.

For more information about how to configure firewall settings when using Exchange ActiveSync, see Microsoft Knowledge Base article 905013, "Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=905013).

I think I am getting closer though, perhaps I should add another 10 mins?!

digitap

I've heard these settings being up to 30 minutes not being uncommon.

SpiderPig

ASKER

Event is gone

digitap

The event is gone after increasing the timeout within the firewall rule?

Thanks for the points!

SpiderPig

ASKER

Correct. Thank you.

DeeringBanjos

Where can this be adjusted in a Fortigate-60 ???

syszec

Session timeout settings on a FortiGate:

timeout per protocol (https, 443/tcp)

config system session-ttl 
     config port
       edit 443
         set protocol 6             //value of 6 means TCP
         set timeout 3600           //timeout in seconds
         set end-port 443
         set start-port 443
        next
      end
end

Open in new window

or timeout per policy

config firewall policy
     edit 36                         //replace number with the rule-ID
          set session-ttl 1800       //timeout in seconds
     next
end

Open in new window