We help IT Professionals succeed at work.

MSExchange ActiveSync Event ID 1040 Annoying?!

SpiderPig
SpiderPig asked
on
Log Name:      Application
Source:        MSExchange ActiveSync
Date:          6/15/2010 12:07:43 AM
Event ID:      1040
Task Category: Requests
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      exchserver.domain.local
Description:
The average of the most recent heartbeat intervals [350] for request [Ping] used by clients is less than or equal to [540].
Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed.

For more information about how to configure firewall settings when using Exchange ActiveSync, see Microsoft Knowledge Base article 905013, "Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=905013).

Getting this every now and then, is it serious? Should I be worried? Everything working fine, still. There is no ISA only a Sonicwall Firewall.
Comment
Watch Question

Commented:
It should be fine as long as no one is complaining.  You can up the time out of port 80 and 443 to 30 minutes in the Sonicwall.  Also try changing the connection timeout in IIS to 30 mins for the default website and if your running SBS change the timeout in the exchange-oma site.

Are any users using an iPhone?
Top Expert 2010
Commented:
you change the timeout on the sonicwall withing the LAN > WAN and WAN > LAN firewall rule for the respective ports.  If you've grouped the services within the same firewall rule, then you only need to change that firewall rule.  It's under the advanced tab.

Author

Commented:
Should I change both UDP and TCP or just TCP? TCP was on 15 mins, so it had to be that.

Thanks.
Top Expert 2010

Commented:
Just TCP.  I don't ever recall seeing one for UDP traffic.  I believe that's because UDP isn't guaranteed and TCP is.

Author

Commented:
Shoot! I got another one after changing the FW WAN - LAN rule on (443 and 143).

Log Name:      Application
Source:        MSExchange ActiveSync
Date:          6/15/2010 9:41:32 PM
Event ID:      1040
Task Category: Requests
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      server.domain.local
Description:
The average of the most recent heartbeat intervals [412] for request [Ping] used by clients is less than or equal to [540].
Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed.

For more information about how to configure firewall settings when using Exchange ActiveSync, see Microsoft Knowledge Base article 905013, "Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=905013).


I think I am getting closer though, perhaps I should add another 10 mins?!
Top Expert 2010

Commented:
I've heard these settings being up to 30 minutes not being uncommon.

Author

Commented:
Event is gone
Top Expert 2010

Commented:
The event is gone after increasing the timeout within the firewall rule?

Thanks for the points!

Author

Commented:
Correct. Thank you.
Where can this be adjusted in a Fortigate-60 ???

Commented:
Session timeout settings on a FortiGate:

timeout per protocol (https, 443/tcp)
config system session-ttl 
     config port
       edit 443
         set protocol 6             //value of 6 means TCP
         set timeout 3600           //timeout in seconds
         set end-port 443
         set start-port 443
        next
      end
end

Open in new window

or timeout per policy
config firewall policy
     edit 36                         //replace number with the rule-ID
          set session-ttl 1800       //timeout in seconds
     next
end

Open in new window