Home
Security Hardening
DISA STIG Cisco ASA VPN V1R1

DISA STIG Cisco ASA VPN V1R1

CASA-VN-000410 – The Cisco ASA remote access VPN server must be configured to identify and authenticate users before granting access to the network.
Details To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and...
CASA-VN-000440 – The Cisco ASA remote access VPN server must be configured to enforce certificate-based authentication before granting access to the network.
Details To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise...
CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – ipsec-proposal
Details Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway...
CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – prf
Details Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway...
CASA-VN-000350 – The Cisco ASA VPN gateway must be configured to renegotiate the IPsec Security Association after eight hours or less.
Details The IPsec SA and its corresponding key will expire either after the number of seconds or amount of traffic...
CASA-VN-000360 – The Cisco ASA VPN gateway must be configured to renegotiate the IKE security association after 24 hours or less.
Details When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These...
CASA-VN-000390 – The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access.
Details The VPN interacts directly with public networks and devices and should not contain user authentication information for all users....
CASA-VN-000400 – The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. – authorization-required
Details Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being...
CASA-VN-000400 – The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. – authorization-server-group
Details Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being...
CASA-VN-000400 – The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. – ldap
Details Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being...

DISA STIG Cisco ASA VPN V1R1

CASA-VN-000410 – The Cisco ASA remote access VPN server must be configured to identify and authenticate users before granting access to the network.

CASA-VN-000440 – The Cisco ASA remote access VPN server must be configured to enforce certificate-based authentication before granting access to the network.

CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – ipsec-proposal

CASA-VN-000340 – The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. – prf

CASA-VN-000350 – The Cisco ASA VPN gateway must be configured to renegotiate the IPsec Security Association after eight hours or less.

CASA-VN-000360 – The Cisco ASA VPN gateway must be configured to renegotiate the IKE security association after 24 hours or less.

CASA-VN-000390 – The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access.

CASA-VN-000400 – The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. – authorization-required

CASA-VN-000400 – The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. – authorization-server-group

CASA-VN-000400 – The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. – ldap