If the firewall's timeout handling is connection-oriented rather than port- or host-oriented, and site measures can't remedy the problem, a course of action is the new Tivoli Request For Enhancement (RFE) Process that Andy recently posted (IBM site Flash 1449404), to try to get keepalive programmed into the servers at the socket level. (IBM did address this issue in the client environment, as per Technote 1109798.) You could try filing the issue with TSM Support as a problem report, but I suspect the response would be that the product is working as currently designed.
Richard Sims