CASA-FW-000010 - The Cisco ASA must be configured to filter outbound traffic, allowing only authorized ports and services - ACL Applied

800-53|AC-4

CAT|I

CCI|CCI-001414

Rule-ID|SV-239852r665842_rule

STIG-ID|CASA-FW-000010

Vuln-ID|V-239852

CASA-FW-000010 - The Cisco ASA must be configured to filter outbound traffic, allowing only authorized ports and services - ingress ACL

CASA-FW-000020 - The Cisco ASA must immediately use updates made to policy enforcement mechanisms such as firewall rules, security policies, and security zones.

CAT|II

Rule-ID|SV-239853r665845_rule

STIG-ID|CASA-FW-000020

Vuln-ID|V-239853

CASA-FW-000030 - The Cisco ASA must be configured to restrict VPN traffic according to organization-defined filtering rules - VPN Group Policy

800-53|AC-17(1)

CCI|CCI-000067

Rule-ID|SV-239854r665848_rule

STIG-ID|CASA-FW-000030

Vuln-ID|V-239854

CASA-FW-000030 - The Cisco ASA must be configured to restrict VPN traffic according to organization-defined filtering rules - VPN Rules

CASA-FW-000040 - The Cisco ASA must be configured to generate traffic log entries containing information to establish what type of events occurred - Log Parameters

800-53|AU-3

CCI|CCI-000130

Rule-ID|SV-239855r665851_rule

STIG-ID|CASA-FW-000040

Vuln-ID|V-239855

CASA-FW-000040 - The Cisco ASA must be configured to generate traffic log entries containing information to establish what type of events occurred - Logging Enabled

CASA-FW-000050 - The Cisco ASA must be configured to generate traffic log entries containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-239856r665854_rule

STIG-ID|CASA-FW-000050

Vuln-ID|V-239856

CASA-FW-000090 - The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable - Buffer Enabled

800-53|AU-5b.

CCI|CCI-000140

Rule-ID|SV-239857r665857_rule

STIG-ID|CASA-FW-000090

Vuln-ID|V-239857

CASA-FW-000090 - The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable - Queue

CASA-FW-000100 - The Cisco ASA must be configured to use TCP when sending log records to the central audit server - Logging Host

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-239858r819136_rule

STIG-ID|CASA-FW-000100

Vuln-ID|V-239858

CASA-FW-000100 - The Cisco ASA must be configured to use TCP when sending log records to the central audit server - Logging Permit-hostdown

CASA-FW-000130 - The Cisco ASA must be configured to disable or remove unnecessary network services and functions that are not used as part of its role in the architecture - HTTP

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-239859r665863_rule

STIG-ID|CASA-FW-000130

Vuln-ID|V-239859

CASA-FW-000130 - The Cisco ASA must be configured to disable or remove unnecessary network services and functions that are not used as part of its role in the architecture - Telnet

CASA-FW-000150 - The Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.

800-53|SC-5(2)

CCI|CCI-001095

CCI|CCI-004866

Rule-ID|SV-239860r991796_rule

STIG-ID|CASA-FW-000150

Vuln-ID|V-239860

CASA-FW-000170 - The Cisco ASA perimeter firewall must be configured to filter traffic destined to the enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM)  Category Assurance List (CAL) and vulnerability assessments - ACL

800-53|SC-7a.

CCI|CCI-001097

Rule-ID|SV-239861r665904_rule

STIG-ID|CASA-FW-000170

Vuln-ID|V-239861

CASA-FW-000170 - The Cisco ASA perimeter firewall must be configured to filter traffic destined to the enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM)  Category Assurance List (CAL) and vulnerability assessments - Interface

CASA-FW-000200 - The Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis - Logging Host

800-53|CM-1a.1.

CCI|CCI-001821

Rule-ID|SV-239862r953982_rule

STIG-ID|CASA-FW-000200

Vuln-ID|V-239862

CASA-FW-000200 - The Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis - Trap Notification

CASA-FW-000210 - The Cisco ASA must be configured to generate a real-time alert to organization-defined personnel and/or the firewall administrator in the event communication with the central audit server is lost - From-address

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-239863r855805_rule

STIG-ID|CASA-FW-000210

Vuln-ID|V-239863

CASA-FW-000210 - The Cisco ASA must be configured to generate a real-time alert to organization-defined personnel and/or the firewall administrator in the event communication with the central audit server is lost - Logging Errors

CASA-FW-000210 - The Cisco ASA must be configured to generate a real-time alert to organization-defined personnel and/or the firewall administrator in the event communication with the central audit server is lost - Recipient-address

CASA-FW-000210 - The Cisco ASA must be configured to generate a real-time alert to organization-defined personnel and/or the firewall administrator in the event communication with the central audit server is lost - Severity

CASA-FW-000210 - The Cisco ASA must be configured to generate a real-time alert to organization-defined personnel and/or the firewall administrator in the event communication with the central audit server is lost - smtp

CASA-FW-000220 - The Cisco ASA must be configured to implement scanning threat detection.

800-53|SC-5

CCI|CCI-002385

Rule-ID|SV-239864r891328_rule

STIG-ID|CASA-FW-000220

Vuln-ID|V-239864

CASA-FW-000230 - The Cisco ASA must be configured to filter inbound traffic on all external interfaces - ACL

800-53|SC-7(11)

CCI|CCI-002403

CCI|CCI-004891

Rule-ID|SV-239865r991797_rule

STIG-ID|CASA-FW-000230

Vuln-ID|V-239865

CASA-FW-000230 - The Cisco ASA must be configured to filter inbound traffic on all external interfaces - Interface

CASA-FW-000240 - The Cisco ASA must be configured to filter outbound traffic on all internal interfaces - ACL

Rule-ID|SV-239866r991798_rule

STIG-ID|CASA-FW-000240

Vuln-ID|V-239866

CASA-FW-000240 - The Cisco ASA must be configured to filter outbound traffic on all internal interfaces - Interface

CASA-FW-000250 - The Cisco ASA perimeter firewall must be configured to block all outbound management traffic - ACL

Rule-ID|SV-239867r891331_rule

STIG-ID|CASA-FW-000250

Vuln-ID|V-239867

CASA-FW-000250 - The Cisco ASA perimeter firewall must be configured to block all outbound management traffic - Interface

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - ACL

CCI|CCI-004931

Rule-ID|SV-239868r991800_rule

STIG-ID|CASA-FW-000260

Vuln-ID|V-239868

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - authentication

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - crypto ipsec

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - encryption

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - group

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - hash sha

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - inside interface

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - lifetime

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - match address

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - outside interface

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - set ikev1

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - set lifetime

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - set peer

CASA-FW-000260 - The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel - tunnel-group

CASA-FW-000270 - The Cisco ASA must be configured to inspect all inbound and outbound traffic at the application layer.

Rule-ID|SV-239869r665893_rule

STIG-ID|CASA-FW-000270

Vuln-ID|V-239869

CASA-FW-000280 - The Cisco ASA must be configured to inspect all inbound and outbound IPv6 traffic for unknown or out-of-order extension headers.

Rule-ID|SV-239870r665896_rule

STIG-ID|CASA-FW-000280

Vuln-ID|V-239870

CASA-FW-000290 - The Cisco ASA must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF) - ACL

Rule-ID|SV-239871r665899_rule

STIG-ID|CASA-FW-000290

Vuln-ID|V-239871

CASA-FW-000290 - The Cisco ASA must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF) - network-object

CASA-FW-000290 - The Cisco ASA must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF) - URF

CASA-FW-000300 - The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected - basic-threat

800-53|SI-4(5)

CCI|CCI-002664

Rule-ID|SV-239872r971533_rule

STIG-ID|CASA-FW-000300

Vuln-ID|V-239872

CASA-FW-000300 - The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected - From-address

CASA-FW-000300 - The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected - logging severity

CASA-FW-000300 - The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected - Recipient-address

CASA-FW-000300 - The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected - scanning-threat

CASA-FW-000300 - The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected - smtp

DISA_STIG_Cisco_ASA_FW_v2r1.audit from DISA Cisco ASA Firewall v2r1 STIG

Detections

Analytics

DISA STIG Cisco ASA FW v2r1

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Mar 24, 2026 Miscellaneous Metadata updated. See also link updated.
Revision 1.1 Jan 20, 2026 Miscellaneous Metadata updated. References updated. See also link updated.

Detections

Analytics

DISA STIG Cisco ASA FW v2r1 Download File

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG Cisco ASA FW v2r1