Consider the following scenario:
You have a server that is running Microsoft Internet Security and Acceleration (ISA) 2006.
ISA 2006 uses Form Based Authentication (FBA) at the ISA layer.
You use ISA 2006 to publish Microsoft Office Outlook Web App to your users on Microsoft Exchange Server 2010.
In this scenario, Outlook Web App does not time out correctly. The idle time-out setting that is used in the FBA is not honored correctly.
This issue occurs because ISA 2006 does not recognize the uppercase parameter "UA=0" that is used by Outlook Web App to indicate user inactivity.
To resolve this problem, install the ISA Server 2006 hotfix rollup package that is described in the following Microsoft Knowledge Base article:
2616326 Description of the ISA Server 2006 hotfix package: September 2011