Home
Security Hardening
DISA STIG Cisco ASA FW V1R1

DISA STIG Cisco ASA FW V1R1

CASA-FW-000290 – The Cisco ASA must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF). – network-object
Details A compromised host in an enclave can be used by a malicious platform to launch cyberattacks on third parties....
CASA-FW-000290 – The Cisco ASA must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF). – URF
Details A compromised host in an enclave can be used by a malicious platform to launch cyberattacks on third parties....
CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – match address
Details When the production network is managed in-band, the management network could be housed at a NOC that is located...
CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – outside interface
Details When the production network is managed in-band, the management network could be housed at a NOC that is located...
CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – set ikev1
Details When the production network is managed in-band, the management network could be housed at a NOC that is located...
CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – set lifetime
Details When the production network is managed in-band, the management network could be housed at a NOC that is located...
CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – set peer
Details When the production network is managed in-band, the management network could be housed at a NOC that is located...
CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – tunnel-group
Details When the production network is managed in-band, the management network could be housed at a NOC that is located...
CASA-FW-000270 – The Cisco ASA must be configured to inspect all inbound and outbound traffic at the application layer.
Details Application inspection enables the firewall to control traffic based on different parameters that exist within the packets such as...
CASA-FW-000280 – The Cisco ASA must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.
Details IPv6 packets with unknown extension headers as well as out-of-order headers can create Denial-of-Service attacks for other networking components...

DISA STIG Cisco ASA FW V1R1

CASA-FW-000290 – The Cisco ASA must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF). – network-object

CASA-FW-000290 – The Cisco ASA must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF). – URF

CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – match address

CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – outside interface

CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – set ikev1

CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – set lifetime

CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – set peer

CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – tunnel-group

CASA-FW-000270 – The Cisco ASA must be configured to inspect all inbound and outbound traffic at the application layer.

CASA-FW-000280 – The Cisco ASA must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.