← Back to HPE Aruba Networking AOS VPN Security Technical Implementation Guide

V-266997

CAT II (Medium)

AOS, when used as a VPN Gateway, must renegotiate the security association after 24 hours or less or as defined by the organization.

Rule ID

SV-266997r1040757_rule

STIG

HPE Aruba Networking AOS VPN Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-002038

Discussion

When a VPN gateway creates an IPsec security association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway's inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice. Satisfies: SRG-NET-000337-VPN-001300, SRG-NET-000337-VPN-001290

Check Content

Verify the AOS configuration with the following commands:
show crypto-local ipsec-map
show crypto dynamic-map
 
If the configured IPSec maps are not configured to support a security association lifetime of 28,800 seconds (8 hours), this is a finding.

Fix Text

Configure AOS with the following commands:
configure terminal
crypto-local ipsec-map <name> <priority>
set security-association lifetime seconds 28800
exit
write memory
 
crypto dynamic-map <name> <priority>
set security-association lifetime seconds 28800
exit
write memory