Home
Security Hardening
DISA STIG Cisco ASA VPN V1R1

DISA STIG Cisco ASA VPN V1R1

CASA-VN-000310 – The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection. – ipsec-121
Details Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented...
CASA-VN-000310 – The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection. – local-authentication
Details Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented...
CASA-VN-000310 – The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection. – remote-authentication
Details Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented...
CASA-VN-000170 – The Cisco ASA must be configured to use NIST FIPS-validated cryptography for Internet Key Exchange (IKE) Phase 1.
Details Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway...
CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – crypto map
Details Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway...
CASA-VN-000180 – The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. – ikev2
Details PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise...
CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – encryption
Details Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway...
CASA-VN-000180 – The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. – peer
Details PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise...
CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – group
Details Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway...
CASA-VN-000180 – The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. – pfs
Details PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise...

Prev Next

DISA STIG Cisco ASA VPN V1R1

CASA-VN-000310 – The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection. – ipsec-121

CASA-VN-000310 – The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection. – local-authentication

CASA-VN-000310 – The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection. – remote-authentication

CASA-VN-000170 – The Cisco ASA must be configured to use NIST FIPS-validated cryptography for Internet Key Exchange (IKE) Phase 1.

CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – crypto map

CASA-VN-000180 – The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. – ikev2

CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – encryption

CASA-VN-000180 – The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. – peer

CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – group

CASA-VN-000180 – The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. – pfs