AOS, when used as a VPN Gateway, must renegotiate the security association after 24 hours or less or as defined by the organization.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-266997 | SRG-NET-000337-VPN-001300 | ARBA-VN-001300 | SV-266997r1040757_rule | 2024-10-29 | 1 |
| Description |
|---|
| When a VPN gateway creates an IPsec security association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway's inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice. Satisfies: SRG-NET-000337-VPN-001300, SRG-NET-000337-VPN-001290 |
| ℹ️ Check |
|---|
| Verify the AOS configuration with the following commands: show crypto-local ipsec-map show crypto dynamic-map If the configured IPSec maps are not configured to support a security association lifetime of 28,800 seconds (8 hours), this is a finding. |
| ✔️ Fix |
|---|
| Configure AOS with the following commands: configure terminal crypto-local ipsec-map <name> <priority> set security-association lifetime seconds 28800 exit write memory crypto dynamic-map <name> <priority> set security-association lifetime seconds 28800 exit write memory |