FYI ....
Before going to sleep last night, I left a persistent connection open to an LDAP server:
SyncInfo Received
SyncInfo Received
SyncInfo Received
SyncInfo Received ldap_result: Can't contact LDAP server (-1) <-- sometime during the night, the connection breaks.
This turned out to be the Kerberos credentials acquired for this test command had expired.
Last night, I ran the same command via Simple Bind before going to sleep.
The connection is still alive several hours later.
This disproves the theory of firewall-induced timeouts for replication that is achieved outside the current local zone.
Jeff