STIGQter: STIG Summary: F5 BIG-IP Local Traffic Manager 11.x Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The BIG-IP Core implementation must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity.

DISA Rule

SV-215765r557356_rule

Vulnerability Number

V-215765

Group Title

SRG-NET-000213-ALG-000107

Rule Version

F5BI-LT-000093

Severity

CAT II

CCI(s)

• CCI-001133 - The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Configure BIG-IP Core to terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged sessions), the session must be terminated after 15 minutes of inactivity.

Check Contents

Verify the BIG-IP Core is configured to terminate all network connections associated with a communications session at the end of the session as follows:

Verify a Protocol Profile is configured to terminate a session at the end of a specified time.

Navigate to the BIG-IP System manager >> Local Traffic >> Profiles >> Protocol >> TCP.

Select a profile for an in-band managed session.

Verify the TCP profile 'idle-timeout' is set to 600/900 seconds

Select a profile for a user session.

Verify the TCP profile 'idle-timeout' is set to 600/900 seconds

Verify the BIG-IP LTM is configured to use the Protocol Profile.

Navigate to the BIG-IP System manager >> Local Traffic >> Virtual Servers >> Virtual Servers List tab.

Select appropriate virtual server.

Verify the TCP profile 'idle-timeout' is set to 600/900 seconds

If the BIG-IP Core is not configured to terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged sessions), the session must be terminated after 15 minutes of inactivity, this is a finding.

Vulnerability Number

V-215765

Documentable

False

Rule Version

F5BI-LT-000093

Severity Override Guidance

Verify the BIG-IP Core is configured to terminate all network connections associated with a communications session at the end of the session as follows:

Verify a Protocol Profile is configured to terminate a session at the end of a specified time.

Navigate to the BIG-IP System manager >> Local Traffic >> Profiles >> Protocol >> TCP.

Select a profile for an in-band managed session.

Verify the TCP profile 'idle-timeout' is set to 600/900 seconds

Select a profile for a user session.

Verify the TCP profile 'idle-timeout' is set to 600/900 seconds

Verify the BIG-IP LTM is configured to use the Protocol Profile.

Navigate to the BIG-IP System manager >> Local Traffic >> Virtual Servers >> Virtual Servers List tab.

Select appropriate virtual server.

Verify the TCP profile 'idle-timeout' is set to 600/900 seconds

If the BIG-IP Core is not configured to terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged sessions), the session must be terminated after 15 minutes of inactivity, this is a finding.

Check Content Reference

M

Target Key

4019

Comments