By default the session timout is set to the same as the ASP.Net timeout + 10 minutes.
Here is the internal code for it:
if (!WAFRuntime.Engine.IsSessionTimeoutSet) {
WAFRuntime.Engine.SessionTimeout = new TimeSpan(0, httpSession.Timeout + 10, 0);
}
You can set your own by setting this value manually:
WAFRuntime.Engine.SessionTimeout
or perhaps better, specify it in the web.config by addting this:
<appSettings>
.....
.....
<add key="WAF.SessionTimeout" value="20" />
.....
.....
<appSettings>
The unit is minutes.
Will this help?