You have to be careful with idle-time and especially when using Windows PC's. They generally send broadcasts and all sorts of traffic (Netbios, Windows networking, etc) in the background without you actually doing something on the PC. If any of these packets traverse the VPN then that is considered traffic and the idle time is reset.
To see if your tunnel is actually idle, check the statistics on the tunnel when you stop working on the PC, and then check it 10 minutes later, I'll pretty much guarantee that some data has gone over the tunnel in that time. There's nothing we can do about this from a Cisco standpoint, it is how Windows works, and there's no way we can differentiate between background traffic and actual user-initiated traffic.
Max-time will definately disconnect them after the time period, but then you run the risk of a user being right in the middle of actually working when they get disconnected.
