AOS, when used as a VPN Gateway, must renegotiate the security association after 24 hours or less or as defined by the organization.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-266997 | ARBA-VN-001300 | SV-266997r1040757_rule | CCI-002038 | medium |
| Description | ||||
| When a VPN gateway creates an IPsec security association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway's inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice. Satisfies: SRG-NET-000337-VPN-001300, SRG-NET-000337-VPN-001290 | ||||
| STIG | Date | |||
| HPE Aruba Networking AOS VPN Security Technical Implementation Guide | 2024-10-29 | |||
Details
Check Text (C-266997r1040757_chk)
Verify the AOS configuration with the following commands:
show crypto-local ipsec-map
show crypto dynamic-map
If the configured IPSec maps are not configured to support a security association lifetime of 28,800 seconds (8 hours), this is a finding.
Fix Text (F-70824r1040756_fix)
Configure AOS with the following commands:
configure terminal
crypto-local ipsec-map <name> <priority>
set security-association lifetime seconds 28800
exit
write memory
crypto dynamic-map <name> <priority>
set security-association lifetime seconds 28800
exit
write memory