What should I consider in the Timeouts and vService Limits profiles for Microsoft Exchange (OWA / ActiveSync)?

Short answer

Exchange traffic includes connections that stay open for a long time and sudden connection increases in the morning hours; therefore, it is recommended to create a separate Timeouts profile and a separate vService Limits profile for the Exchange vService. In Timeouts, HTTP Keepalive Timeout, Server Timeout and Client Timeout are kept above the default; in vService Limits, Max. Total Connections and Max. Total SSL Connections are increased according to the number of concurrent Outlook and mobile clients. TR7 has no ready-made Exchange template or fixed recommended number; the values are adjusted gradually according to the measured behavior of the environment.

Timeouts Profile

Field	Default	Approach
HTTP Keepalive Timeout	120 s	Above the default; clients use the same connection for a long time
Server Timeout / Client Timeout	90 s / 90 s	Can be above the default; requests kept open for a long time must not be cut off
Connect Timeout	20 s	Not kept very low
Queue Timeout	60 s	Enough not to cause interruptions at busy hours
Tunnel(Websocket) Timeout	120 s	Increased if there are long-lived tunnel connections

Low values can lead to connection drops, re-authentication loops and delayed startup in Outlook (Exchange recommendations).

vService Limits Profile

Field	Default	Approach
Max. Total Connections	20,000	Enough to handle the concurrent Outlook and mobile clients
Max. Connections/s, Max. New Connecions/s	10,000 / 5,000	According to the sudden increase at the morning startup
Max. Total SSL Connections, Max. SSL Connections/s	5,000 / 2,000	According to all of the HTTPS traffic
Max. Failed Connection Retries	3	Balanced

Details: Exchange recommendations

Applying and Monitoring

1. Exchange-specific profiles are created with Add on the Load Balancer → Profiles → Timeouts and Load Balancer → Profiles → vService Limits screens (Timeouts · How to Add?, vService Limits · How to Add?).
2. The Exchange vService is opened with Edit; in the Details panel, these profiles are selected in the Timeout and vService Limits boxes and Save is clicked. Timeouts are applied without interruption; in vService Limits, if Max. connections/s, Max. Session Rate/s, the two SSL fields or Buffer size(kB) changed, the vService restarts. In a cluster, it is also sent to the peer device with the default auto-sync.
3. In Live Stats → Frontend section, the peak value in the tooltip of the Current Sessions card is compared with the defined upper limit; the 504 records in HTTP Logs and, while Debug mode is on, the Termination State values in Debug Mode Logs are monitored.
4. The values are changed gradually according to the measured behavior (operational best practices).

Common Misconceptions

• "The default profile is sufficient for Exchange." With the default values, long-lived connections and sudden increases can lead to drops and waits.
• "Enlarging the profile of all vServices is sufficient." An Exchange-specific profile allows the adjustment to be made without affecting other applications.
• "Connection sharing is always suitable in Exchange." In Exchange, which uses connection-bound authentication such as NTLM or Kerberos, Never or Safe is preferred for Connection Share Strategy in the HTTP TCP Multiplexing action (What is HTTP TCP Multiplexing; how does it reduce the number of backend connections?).
• "Changing limit and SSL values is uninterrupted." Changes to Max. connections/s, Max. Session Rate/s, SSL and Buffer size(kB) in vService Limits restart the vService; they are made in a maintenance window.

How it is done in the documentation

• Timeouts · Microsoft Exchange (Outlook / OWA / ActiveSync)
• vService Limits · Microsoft Exchange (Outlook / OWA / ActiveSync)
• Timeouts · Operational Best Practices

Related questions

• What do the values in the Timeouts profile (HTTP Keepalive Timeout, HTTP Request Timeout, Connect, Server, Client, Queue, Tunnel(Websocket) Timeout, Client FIN, Server FIN) mean?
• What is the vService Limits profile; what are the default limits?
• What happens when the connection limit is reached?