STIGQter: STIG Summary: F5 BIG-IP TMOS ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The F5 BIG-IP appliance must terminate all network connections associated with a communications session at the end of the session or after 15 minutes of inactivity.

DISA Rule

SV-266155r1024382_rule

Vulnerability Number

V-266155

Group Title

SRG-NET-000213-ALG-000107

Rule Version

F5BI-AP-300056

Severity

CAT I

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the name of the Access Profile.
5. Set "Inactivity Timeout" to 900 seconds.
Note: If the setting is grayed out, check the box to the right of the setting.
6. Click "Update".

Check Contents

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the name of the Access Profile.
5. Verify "Inactivity Timeout" is configured for 900 seconds.

If the BIG-IP appliance is not configured to terminate all network connections associated with a user (nonprivileged) communications session after 15 minutes of inactivity, this is a finding.

Vulnerability Number

V-266155

Documentable

False

Rule Version

F5BI-AP-300056

Severity Override Guidance

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click the name of the Access Profile.
5. Verify "Inactivity Timeout" is configured for 900 seconds.

If the BIG-IP appliance is not configured to terminate all network connections associated with a user (nonprivileged) communications session after 15 minutes of inactivity, this is a finding.

Check Content Reference

M

Target Key

5640