Force idle dialup user ipsec vpn connections to drop?

Hello, was curious if there's an easy way to set an idle timeout on user-initiated client to site IPSec VPN connections?  Currently they seem to be able to just set there due to dead peer detection and/or keepalives, but aren't actually performing any valid work.  I like having DPD to keep the session up if it's being used intermittently, but would prefer to drop it if the user hasn't done anything in perhaps 20 minutes.