A few thoughts/hints : 1) GW stating caching is enabled and obsfuscate what's really happening 2) possible issue with the chaining the timeouts between LB persistency cookies > session time out on GW > session time out on SF ? 3) could be related to the presence/absence of a traffic policy that intercepts the logout request from client to SF and initiate the logout on GW ? 4) some of the browser behaviour with SF is solely based on client side rendering (I think session timeout and logout is one of those) and can differ between direct vs via-GW session.... I would compare (nstrace/wiresharhk/har choose your favorite) the exchanges during logout sequence initiated by time-out between direct and via-GW sessions. Last but not least, some hacks/IIS settings to allow relogging without needing to close the browser when using SAML/SmartCard can also play there (related to hint 4)....

Thanks for the info. I did some testing, and storefront has an actual timeout pop up it uses to log you out that doesn't carry through to gateway. But by disabling the caching it is better. It still won't return to login if you just sit there and stare at the screen, but with caching off as soon as the mouse moves on the screen, then it flips back to a login prompt. So that is at least somewhat better.