This fully depends on the kind of applications you are running. If this is only simple web traffic then a timeout of a minute should already be sufficient. But, if you have long living TCP connections which can be idle for a long time and where the peers don't use TCP keep alive or similar to keep the connection open then even 10 minutes will be to short. Typical applications like this might be telnet or SSH sessions but also IMAP connections which expect the server to notify the client if new mails arrive can be idle for a long time.
Thus, know your network, know what kind of applications are in use and how they behave in the network and only then you can decide what an appropriate timeout will be. And unless your firewall exposes only basic functionality you could also have different timeouts based on the target port of the TCP connection and maybe dynamic adjustments of timeouts based on the number of currently tracked states, i.e. shorter timeouts when more states are open to keep the memory usage down.