STIGQter: STIG Summary: HPE Aruba Networking AOS NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

AOS must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity except to fulfill documented and validated mission requirements.

DISA Rule

SV-266941r1039844_rule

Vulnerability Number

V-266941

Group Title

SRG-APP-000190-NDM-000267

Rule Version

ARBA-ND-000267

Severity

CAT I

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Configure AOS with the following commands:
configure terminal
loginsession timeout 5
web-server profile
session-timeout 300
exit
write memory

Check Contents

Verify the AOS configuration with the following commands:
show running-config | include "loginsession timeout"
show web-server profile

If the login session timeout is not set to "5" (minutes), this is a finding.

If "User session timeout <30-3600> (seconds)" is not set to "300", this is a finding.

Vulnerability Number

V-266941

Documentable

False

Rule Version

ARBA-ND-000267

Severity Override Guidance

Verify the AOS configuration with the following commands:
show running-config | include "loginsession timeout"
show web-server profile

If the login session timeout is not set to "5" (minutes), this is a finding.

If "User session timeout <30-3600> (seconds)" is not set to "300", this is a finding.

Check Content Reference

M

Target Key

5648