If the firewall's timeout handling is connection-oriented rather than port- or 
host-oriented, and site measures can't remedy the problem, a course of action 
is the new Tivoli Request For Enhancement (RFE) Process that Andy recently 
posted (IBM site Flash 1449404), to try to get keepalive programmed into the 
servers at the socket level.  (IBM did address this issue in the client 
environment, as per Technote 1109798.)  You could try filing the issue with TSM 
Support as a problem report, but I suspect the response would be that the 
product is working as currently designed.

    Richard Sims