OpenControls Logo

STIG Viewer

STIGViewer Support

The Palo Alto Networks security platform must terminate communications sessions after 15 minutes of inactivity.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-228846PANW-AG-000052SV-228846r971530_ruleCCI-001133medium
Description
Idle sessions can accumulate, leading to an exhaustion of memory in network elements processing traffic flows. Note that the 15 minute period is a maximum value; Administrators can choose shorter timeout values to account for system- or network-specific requirements. On a Palo Alto Networks security platform, a session is defined by two uni-directional flows, each uniquely identified by a 6-tuple key: source-address, destination-address, source-port, destination-port, protocol, and security-zone. Besides the six attributes that identify a session, each session has few more notable identifiers: end hosts - the source IP and destination IP which will be marked as client(source IP) and server(destination IP) and flow direction - each session is bi-directional and is identified by a two uni-directional flows, the first flow is client-to-server(c2s) and the returning flow is server-to-client(s2c). Sessions between endpoints are kept active by either normal traffic or by keepalive messages (also sometimes referred to as heartbeat messages). On the Palo Alto Networks security platform, the session timeout period is the time (seconds) required for the application to time out due to inactivity. Session timeouts are configured globally and on a per-application basis. When configured, timeouts for an application override the global TCP or UDP session timeouts.
STIGDate
Palo Alto Networks ALG Security Technical Implementation Guide2025-03-12

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-07Network Connection Termination
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-12(2)Termination Message
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-7Unsuccessful Logon Attempts
1.00

+14 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.9
1.00
CCI1 mapping
CCI-001133
1.00

Details

Check Text (C-228846r971530_chk)

To check global values: Go to Device >> Setup >> Session In the "Session Timeouts" pane, if the TCP field has a value of greater than "900", this is a finding. Obtain the list of authorized applications for the system or network. To check application-specific values: Go to Objects >> Applications Select, in turn, each authorized application. In the "Application" window, in the "Options" pane, view the "TCP" and "UDP Timeout" fields, if the value is greater than "900", this is a finding. Many applications will not have one of these two fields.

Fix Text (F-31058r513834_fix)

To configure the global values: Go to Device >> Setup >> Session In the "Session Timeouts" pane, select the "Edit" icon (the gear symbol in the upper-right corner of the pane). In the "TCP" field, enter "900". Select "OK". To configure application-specific values: Go to Objects >> Applications Select an application name to view additional details about the application. To search for a specific application, enter the "application name" or "description" in the "Search" field. In the "Application" window, in the "Options" pane, in the "TCP Timeout" field, select "Customize". In the Application specific window, in the "TCP" and "UDP Timeout" fields, enter "900" if the existing value is greater than "900". Many applications will not have one of these two fields. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.