Home
Security Hardening
DISA STIG Cisco ASA VPN V1R1

DISA STIG Cisco ASA VPN V1R1

CASA-VN-000020 – The Cisco ASA must be configured to generate log records containing information to establish when the events occurred.
Details Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an...
CASA-VN-000080 – The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. – logging permit-hostdown
Details If the system were to continue processing after audit failure, actions can be taken on the system that cannot...
CASA-VN-000080 – The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. – logging queue
Details If the system were to continue processing after audit failure, actions can be taken on the system that cannot...
CASA-VN-000090 – The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events. – logging host
Details It is critical for the appropriate personnel to be aware if a system is at risk of failing to...
CASA-VN-000090 – The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events. – logging trap
Details It is critical for the appropriate personnel to be aware if a system is at risk of failing to...
CASA-VN-000120 – The Cisco ASA must be configured to validate certificates via a trustpoint that identifies a DoD or DoD-approved certificate authority.
Details Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate...
CASA-VN-000130 – The Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication.
Details Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before...
CASA-VN-000150 – The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations. – Interface
Details Without IKE, the Security Parameter Index (SPI) is manually specified for each security association. IKE peers will negotiate the...
CASA-VN-000150 – The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations. – IPsec Phase
Details Without IKE, the Security Parameter Index (SPI) is manually specified for each security association. IKE peers will negotiate the...
CASA-VN-000300 – The Cisco ASA VPN gateway must be configured to restrict what traffic is transported via the IPsec tunnel according to flow control policies. – crypto map
Details Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally,...

Prev Next

DISA STIG Cisco ASA VPN V1R1

CASA-VN-000020 – The Cisco ASA must be configured to generate log records containing information to establish when the events occurred.

CASA-VN-000080 – The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. – logging permit-hostdown

CASA-VN-000080 – The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. – logging queue

CASA-VN-000090 – The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events. – logging host

CASA-VN-000090 – The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events. – logging trap

CASA-VN-000120 – The Cisco ASA must be configured to validate certificates via a trustpoint that identifies a DoD or DoD-approved certificate authority.

CASA-VN-000130 – The Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication.

CASA-VN-000150 – The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations. – Interface

CASA-VN-000150 – The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations. – IPsec Phase

CASA-VN-000300 – The Cisco ASA VPN gateway must be configured to restrict what traffic is transported via the IPsec tunnel according to flow control policies. – crypto map