Free DISA STIG and SRG Library | Vaulted

V-5615

Network devices must have TCP Keep-Alives enabled for TCP sessions.

Finding ID
NET0724
Rule ID
SV-5615r3_rule
Severity
Cat III
CCE
(None)
Group Title
TCP Keep-Alives must be enabled.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These "orphaned" sessions use up valuable router resources and can also be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keepalive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the keepalive message, the sending router will clear the connection and free resources allocated to the session.

Fix Text

Configure the device to enable TCP Keep-Alives.

Check Content

Review the device configuration to verify the "service tcp-keepalives-in" command is configured. If TCP Keep-Alives are not enabled, this is a finding.

Responsibility

Information Assurance Officer