Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Cisco ASA VPN gateway must be configured to renegotiate the IKE security association after 24 hours or less.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-239964 | CASA-VN-000360 | SV-239964r991818_rule | Medium |
| Description |
|---|
| When a VPN gateway creates an IPsec security association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice. |
| STIG | Date |
|---|---|
| Cisco ASA VPN Security Technical Implementation Guide | 2024-06-10 |
Details
| Check Text ( C-43197r666296_chk ) |
|---|
| Verify the VPN gateway renegotiates the IKE security association after 24 hours or less as shown in the example below. crypto ikev2 policy 2 encryption … … … … lifetime seconds 86400 If the VPN gateway does not renegotiate the IKE security association after 24 hours or less, this is a finding. |
| Fix Text (F-43156r666297_fix) |
|---|
| Configure the VPN gateway to renegotiate the IKE security association after 24 hours or less as shown in the example below. ASA2(config)# crypto ikev2 policy 2 ASA2(config-ikev2-policy)# lifetime seconds 86400 ASA2(config-ikev2-policy)# end |