Home
Security Hardening
DISA STIG Cisco ASA VPN V1R1

DISA STIG Cisco ASA VPN V1R1

CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – integrity
Details Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway...
CASA-VN-000190 – The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes. – IKE Phase 1
Details FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal...
CASA-VN-000190 – The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes. – IPsec SA
Details FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal...
CASA-VN-000200 – The Cisco ASA must be configured to use a FIPS-validated cryptographic module to implement IPsec encryption services.
Details FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal...
CASA-VN-000210 – The Cisco ASA must be configured to use a Diffie-Hellman (DH) Group of 14 or greater for Internet Key Exchange (IKE) Phase 1.
Details Use of an approved DH algorithm ensures the Internet Key Exchange (IKE) (Phase 1) proposal uses FIPS-validated key management...
CASA-VN-000230 – The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 1.
Details Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Although allowed by SP800-131Ar2 for some...
CASA-VN-000240 – The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2. – IKE Phase 2
Details Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Although allowed by...
CASA-VN-000240 – The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2. – proposal
Details Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Although allowed by...
CASA-VN-000300 – The Cisco ASA VPN gateway must be configured to restrict what traffic is transported via the IPsec tunnel according to flow control policies. – ACL
Details Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally,...
CASA-VN-000400 – The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. – ldap-over-ssl
Details Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being...

Prev Next

DISA STIG Cisco ASA VPN V1R1

CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – integrity

CASA-VN-000190 – The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes. – IKE Phase 1

CASA-VN-000190 – The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes. – IPsec SA

CASA-VN-000200 – The Cisco ASA must be configured to use a FIPS-validated cryptographic module to implement IPsec encryption services.

CASA-VN-000210 – The Cisco ASA must be configured to use a Diffie-Hellman (DH) Group of 14 or greater for Internet Key Exchange (IKE) Phase 1.

CASA-VN-000230 – The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 1.

CASA-VN-000240 – The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2. – IKE Phase 2

CASA-VN-000240 – The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2. – proposal

CASA-VN-000300 – The Cisco ASA VPN gateway must be configured to restrict what traffic is transported via the IPsec tunnel according to flow control policies. – ACL

CASA-VN-000400 – The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. – ldap-over-ssl