Default idle timeout for TCP connections (in ESTABLISHED state) in NGFW is 30 minutes so users in your case leave the Outlook open for 30+ minutes, and then NGFW removes the connection from state table when it hasn't seen any packets for connection within 30 minutes. When user tries to use Outlook after this, the connection to Exchange server will not work as NGFW drops the packets as it doesn't have connection in state table anymore.
It is possible to define global timeouts in firewall advanced properties, but since this would globally affect all TCP connections in established state, it's better to define idle timeout in the Access Rule that allows the traffic:
It's important that the rules, where you increase the idle timeout, only match traffic that requires longer idle timeout. The connection state table is kept in firewall memory and each connection takes small amount of memory. If lots of connections get long idle timeout unnecessarily this can lead to increased memory usage, and in worse case it could cause memory to run out and FW to crash.
Especially important is to make sure that ICMP and UDP traffic does not get unnecessarily long idle timeout as they don't have similar connection closing mechanism as TCP has. Thus FW will have to keep ICMP and UDP connections in state table for entire idle timeout. E.g. DNS connection is usually just one query from client to server, and reply from server, and after that connection is done. It would be quite stupid to keep that connection in FW memory for e.g. 4 hours.
Thus in your case, if the rule that currently allows Outlook-Exchange traffic matches also ICMP and UDP traffic, it would be best to add new rule for Outlook-Exchange traffic above current rule, and increase idle timeout in that rule to e.g. 2 hours or whatever you think is enough to prevent user's connections from timing out.
Thanks for the response Tero, will give this a go taking care to isolate on the affected traffic.
Hi Tero, looks this has fixed the issue...i need to be able to view the impact on has on memory though in order to put this info production, can you advise on the commands / tools to use for this.
You can check the memory usage with linux commands like free and top. Here's example of free output:
total used free shared buffers cached
Mem: 8087700 5108100 2979600 0 427028 1288356
-/+ buffers/cache: 3392716 4694984
Swap: 1932280 0 1932280
In above second line tells that about 3.4 GB of memory is in use (http://www.linuxnix.com/find-ram-size-in-linuxunix/).