AOS, when used as a VPN Gateway, must terminate all network connections associated with a communications session at the end of the session.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
low	V-266990	SRG-NET-000213-VPN-000720	ARBA-VN-000720	SV-266990r1040736_rule	2024-10-29	1

Description
Idle Transmission Control Protocol (TCP) sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These "orphaned" sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep-alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep-alive message, the sending router will clear the connection and free resources allocated to the session.

Description

Idle Transmission Control Protocol (TCP) sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These "orphaned" sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep-alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep-alive message, the sending router will clear the connection and free resources allocated to the session.

ℹ️ Check
Verify the AOS configuration with the following command: show configuration effective \| include dpd If DPD is not configured, this is a finding.

✔️ Fix
Configure AOS with the following commands: configure terminal crypto-local isakmp dpd idle-timeout <idle_sec> retry-timeout <retry_sec> retry-attempts <retry_number> write memory