STIGQter STIGQter: STIG Summary: F5 BIG-IP TMOS VPN Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Sep 2024:

The F5 BIG-IP appliance IPsec VPN must renegotiate the IKE Phase 2 security association after eight hours or less.

DISA Rule

SV-266284r1024759_rule

Vulnerability Number

V-266284

Group Title

SRG-NET-000337-VPN-001300

Rule Version

F5BI-VN-300026

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. Network.
2. IPsec.
3. IPsec Policies.
4. Click on the name of the IPsec Policy.
5. Configure the value for "Lifetime" under "IKE Phase 2" to 480 minutes or less.
6. Click "Update".

Check Contents

From the BIG-IP GUI:
1. Network.
2. IPsec.
3. IPsec Policies.
4. Click on the name of the IPsec Policy.
5. Verify that the value for "Lifetime" under "IKE Phase 2" is set to 480 minutes or less.

If the BIG-IP appliance is not configured to renegotiate the security association after 8 hours or less, this is a finding.

Vulnerability Number

V-266284

Documentable

False

Rule Version

F5BI-VN-300026

Severity Override Guidance

From the BIG-IP GUI:
1. Network.
2. IPsec.
3. IPsec Policies.
4. Click on the name of the IPsec Policy.
5. Verify that the value for "Lifetime" under "IKE Phase 2" is set to 480 minutes or less.

If the BIG-IP appliance is not configured to renegotiate the security association after 8 hours or less, this is a finding.

Check Content Reference

M

Target Key

5642