Skip to content

Envoy must drop connections to disconnected clients.

An XCCDF Rule

Description

Envoy client connections that are established but no longer connected can consume resources that might otherwise be required by active connections. It is a best practice to terminate connections that are no longer connected to an active client. Envoy is hard coded to drop connections after three minutes of idle time. The absence of any "tcpKeepAliveTimeSec" settings means this default is in effect. This configuration must be verified and maintained.

ID
SV-256737r889149_rule
Version
VCRP-70-000001
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Navigate to and open: 
 
/etc/vmware-rhttpproxy/config.xml 
 
Locate the <config>/<envoy>/<L4Filter> block and configure <tcpKeepAliveTimeSec> as follows: