The F5 BIG-IP appliance IPsec VPN must renegotiate the IKE Phase 2 security association after eight hours or less.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-266284	SRG-NET-000337-VPN-001300	F5BI-VN-300026	SV-266284r1024759_rule	2024-09-09	1

Description
When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.

Description

When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.

ℹ️ Check
From the BIG-IP GUI: 1. Network. 2. IPsec. 3. IPsec Policies. 4. Click on the name of the IPsec Policy. 5. Verify that the value for "Lifetime" under "IKE Phase 2" is set to 480 minutes or less. If the BIG-IP appliance is not configured to renegotiate the security association after 8 hours or less, this is a finding.

✔️ Fix
From the BIG-IP GUI: 1. Network. 2. IPsec. 3. IPsec Policies. 4. Click on the name of the IPsec Policy. 5. Configure the value for "Lifetime" under "IKE Phase 2" to 480 minutes or less. 6. Click "Update".