The VPN gateway must implement IPSec security associations that terminate after one hour or less of idle time.

From IPSec VPN Gateway Security Technical Implementation Guide

Part of Idle IPSec security associations do not terminate.

Associated with IA controls: ECSC-1

SV-41003r1_rule The VPN gateway must implement IPSec security associations that terminate after one hour or less of idle time.

Vulnerability discussion

When a VPN gateway creates an IPSec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPSec endpoint inactivity which could result in the gateway’s inability to create new SAs for other endpoints; thereby, preventing new sessions from connecting. The IPSec SA idle timer allows SAs associated with inactive endpoints to be deleted before the SA lifetime has expired.

Check content

Review all IPSec Security Associations configured globally or within IPSec profiles on the VPN gateway and examine the configured idle time. The idle time value must be 1 hour or less. If idle time is not configured, determine the default used by the gateway.

Fix text

Configure an idle time value of 1 hour or less for all IPSec security associations either within IPSec profiles or as a global command.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.