Home
Security Hardening
DISA STIG Cisco ASA FW V1R1

DISA STIG Cisco ASA FW V1R1

CASA-FW-000170 – The Cisco ASA perimeter firewall must be configured to filter traffic destined to the enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments. – ACL
Details The enclave’s internal network contains the servers where mission-critical data and applications reside. Malicious traffic can enter from an...
CASA-FW-000010 – The Cisco ASA must be configured to filter outbound traffic, allowing only authorized ports and services. – ACL Applied
Details Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or...
CASA-FW-000170 – The Cisco ASA perimeter firewall must be configured to filter traffic destined to the enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments. – Interface
Details The enclave’s internal network contains the servers where mission-critical data and applications reside. Malicious traffic can enter from an...
CASA-FW-000010 – The Cisco ASA must be configured to filter outbound traffic, allowing only authorized ports and services. – ingress ACL
Details Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or...
CASA-FW-000200 – The Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis. – Logging Host
Details Without the ability to centrally manage the content captured in the traffic log entries, identification, troubleshooting, and correlation of...
CASA-FW-000020 – The Cisco ASA must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.
Details Information flow policies regarding dynamic information flow control include, for example, allowing or disallowing information flows based on changes...
CASA-FW-000200 – The Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis. – Trap Notification
Details Without the ability to centrally manage the content captured in the traffic log entries, identification, troubleshooting, and correlation of...
CASA-FW-000030 – The Cisco ASA must be configured to restrict VPN traffic according to organization-defined filtering rules. – VPN Group Policy
Details Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities...
CASA-FW-000030 – The Cisco ASA must be configured to restrict VPN traffic according to organization-defined filtering rules. – VPN Rules
Details Remote access devices (such as those providing remote access to network devices and information systems) that lack automated capabilities...
CASA-FW-000040 – The Cisco ASA must be configured to generate traffic log entries containing information to establish what type of events occurred. – Logging Enabled
Details Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading...

DISA STIG Cisco ASA FW V1R1

CASA-FW-000010 – The Cisco ASA must be configured to filter outbound traffic, allowing only authorized ports and services. – ACL Applied

CASA-FW-000010 – The Cisco ASA must be configured to filter outbound traffic, allowing only authorized ports and services. – ingress ACL

CASA-FW-000200 – The Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis. – Logging Host

CASA-FW-000020 – The Cisco ASA must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.

CASA-FW-000200 – The Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis. – Trap Notification

CASA-FW-000030 – The Cisco ASA must be configured to restrict VPN traffic according to organization-defined filtering rules. – VPN Group Policy

CASA-FW-000030 – The Cisco ASA must be configured to restrict VPN traffic according to organization-defined filtering rules. – VPN Rules

CASA-FW-000040 – The Cisco ASA must be configured to generate traffic log entries containing information to establish what type of events occurred. – Logging Enabled