Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

By terminating inactive sessions you reduce the risk of attackers taking advantage of them.

Establish a policy specifying the period of inactivity before a network connection is terminated. An example is 60 minutes. This can be implemented on your firewall by setting the idle time out settings (e.g., in seconds: UDP = 5, TCP = 1800, ICMP = 5, Other = 180). The same can be applied to your VPN connections.