The VPN Gateway must renegotiate the security association after 24 hours or less or as defined by the organization.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207238	SRG-NET-000337-VPN-001300	SV-207238r608988_rule		Medium

Description
When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.

Description

When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.

STIG	Date
Virtual Private Network (VPN) Security Requirements Guide	2021-09-27

Details

Check Text ( C-7498r378335_chk )
Verify the VPN Gateway renegotiates the security association after 24 hours or less or as defined by the organization. If the VPN Gateway does not renegotiate the security association after 24 hours or less or as defined by the organization, this is a finding.

Fix Text (F-7498r378336_fix)
Configure the VPN Gateway to renegotiate the security association after 24 hours or less or as defined by the organization.