CASA-VN-000010 - The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred - svc

800-53|AU-3

CAT|III

CCI|CCI-000130

Rule-ID|SV-239945r666241_rule

STIG-ID|CASA-VN-000010

Vuln-ID|V-239945

CASA-VN-000010 - The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred - vpn

CASA-VN-000010 - The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred - vpnc

CASA-VN-000010 - The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred - vpnfo

CASA-VN-000010 - The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred - webfo

CASA-VN-000010 - The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred - webvpn

CASA-VN-000020 - The Cisco ASA must be configured to generate log records containing information to establish when the events occurred.

CCI|CCI-000131

Rule-ID|SV-239946r666244_rule

STIG-ID|CASA-VN-000020

Vuln-ID|V-239946

CASA-VN-000080 - The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable - logging permit-hostdown

800-53|AU-5(4)

CAT|II

CCI|CCI-001861

Rule-ID|SV-239947r856162_rule

STIG-ID|CASA-VN-000080

Vuln-ID|V-239947

CASA-VN-000080 - The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable - logging queue

CASA-VN-000090 - The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events - logging host

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-239948r878129_rule

STIG-ID|CASA-VN-000090

Vuln-ID|V-239948

CASA-VN-000090 - The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events - logging trap

CASA-VN-000120 - The Cisco ASA must be configured to validate certificates via a trustpoint that identifies a DoD or DoD-approved certificate authority.

800-53|IA-5(2)(a)

CCI|CCI-000185

Rule-ID|SV-239949r666253_rule

STIG-ID|CASA-VN-000120

Vuln-ID|V-239949

CASA-VN-000130 - The Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication.

800-53|CM-6b.

CAT|I

CCI|CCI-000366

Rule-ID|SV-239950r666256_rule

STIG-ID|CASA-VN-000130

Vuln-ID|V-239950

CASA-VN-000150 - The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations - Interface

Rule-ID|SV-239951r666259_rule

STIG-ID|CASA-VN-000150

Vuln-ID|V-239951

CASA-VN-000150 - The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations - IPsec Phase

CASA-VN-000150 - The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations - Policy

CASA-VN-000160 - The Cisco ASA must be configured to use Internet Key Exchange v2 (IKEv2) for all IPsec security associations - Interface

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-239952r666262_rule

STIG-ID|CASA-VN-000160

Vuln-ID|V-239952

CASA-VN-000160 - The Cisco ASA must be configured to use Internet Key Exchange v2 (IKEv2) for all IPsec security associations - IPsec Phase

CASA-VN-000160 - The Cisco ASA must be configured to use Internet Key Exchange v2 (IKEv2) for all IPsec security associations - Policy

CASA-VN-000170 - The Cisco ASA must be configured to use NIST FIPS-validated cryptography for Internet Key Exchange (IKE) Phase 1.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-239953r916122_rule

STIG-ID|CASA-VN-000170

Vuln-ID|V-239953

CASA-VN-000180 - The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation - ikev2

800-53|SC-8

CCI|CCI-002418

Rule-ID|SV-239954r916233_rule

STIG-ID|CASA-VN-000180

Vuln-ID|V-239954

CASA-VN-000180 - The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation - peer

CASA-VN-000180 - The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation - pfs

CASA-VN-000190 - The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes - IKE Phase 1

Rule-ID|SV-239955r916125_rule

STIG-ID|CASA-VN-000190

Vuln-ID|V-239955

CASA-VN-000190 - The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes - IPsec SA

CASA-VN-000200 - The Cisco ASA must be configured to use a FIPS-validated cryptographic module to implement IPsec encryption services.

Rule-ID|SV-239956r916128_rule

STIG-ID|CASA-VN-000200

Vuln-ID|V-239956

CASA-VN-000210 - The Cisco ASA must be configured to use a Diffie-Hellman (DH) Group of 16 or greater for Internet Key Exchange (IKE) Phase 1 - IKE Phase 1.

800-53|AC-17(2)

CCI|CCI-000068

Rule-ID|SV-239957r916149_rule

STIG-ID|CASA-VN-000210

Vuln-ID|V-239957

CASA-VN-000230 - The Cisco ASA must be configured to use FIPS-validated SHA-2 at 384 bits or higher for Internet Key Exchange (IKE) Phase 1 - IKE Phase 1.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-239958r916134_rule

STIG-ID|CASA-VN-000230

Vuln-ID|V-239958

CASA-VN-000240 - The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2 - IKE Phase 2

800-53|SC-23

CCI|CCI-001184

Rule-ID|SV-239959r916152_rule

STIG-ID|CASA-VN-000240

Vuln-ID|V-239959

CASA-VN-000240 - The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2 - proposal

CASA-VN-000300 - The Cisco ASA VPN gateway must be configured to restrict what traffic is transported via the IPsec tunnel according to flow control policies - ACL

800-53|AC-4

CCI|CCI-001414

Rule-ID|SV-239960r666286_rule

STIG-ID|CASA-VN-000300

Vuln-ID|V-239960

CASA-VN-000300 - The Cisco ASA VPN gateway must be configured to restrict what traffic is transported via the IPsec tunnel according to flow control policies - crypto map

CASA-VN-000310 - The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection - ipsec-121

800-53|IA-3

CCI|CCI-000778

Rule-ID|SV-239961r666289_rule

STIG-ID|CASA-VN-000310

Vuln-ID|V-239961

CASA-VN-000310 - The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection - local-authentication

CASA-VN-000310 - The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection - remote-authentication

CASA-VN-000340 - The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network - crypto map

Rule-ID|SV-239962r878134_rule

STIG-ID|CASA-VN-000340

Vuln-ID|V-239962

CASA-VN-000340 - The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network - encryption

CASA-VN-000340 - The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network - group

CASA-VN-000340 - The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network - integrity

CASA-VN-000340 - The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network - ipsec-proposal

CASA-VN-000340 - The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network - prf

CASA-VN-000350 - The Cisco ASA VPN gateway must be configured to renegotiate the IPsec Security Association after eight hours or less.

800-53|IA-11

CCI|CCI-002038

Rule-ID|SV-239963r856172_rule

STIG-ID|CASA-VN-000350

Vuln-ID|V-239963

CASA-VN-000360 - The Cisco ASA VPN gateway must be configured to renegotiate the IKE security association after 24 hours or less.

Rule-ID|SV-239964r856173_rule

STIG-ID|CASA-VN-000360

Vuln-ID|V-239964

CASA-VN-000390 - The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access.

800-53|IA-5(2)(c)

CCI|CCI-000187

Rule-ID|SV-239965r666301_rule

STIG-ID|CASA-VN-000390

Vuln-ID|V-239965

CASA-VN-000400 - The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network - authorization-required

800-53|AC-24(1)

CCI|CCI-002353

Rule-ID|SV-239966r856174_rule

STIG-ID|CASA-VN-000400

Vuln-ID|V-239966

CASA-VN-000400 - The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network - authorization-server-group

CASA-VN-000400 - The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network - ldap

CASA-VN-000400 - The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network - ldap-over-ssl

CASA-VN-000410 - The Cisco ASA remote access VPN server must be configured to identify and authenticate users before granting access to the network.

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-239967r666307_rule

STIG-ID|CASA-VN-000410

Vuln-ID|V-239967

CASA-VN-000440 - The Cisco ASA remote access VPN server must be configured to enforce certificate-based authentication before granting access to the network.

800-53|IA-2(2)

CCI|CCI-000766

Rule-ID|SV-239968r666310_rule

STIG-ID|CASA-VN-000440

Vuln-ID|V-239968

CASA-VN-000450 - The Cisco ASA remote access VPN server must be configured to map the distinguished name (DN) from the client's certificate to entries in the authentication server to determine authorization to access the network - authorization-required

Rule-ID|SV-239969r929014_rule

STIG-ID|CASA-VN-000450

Vuln-ID|V-239969

CASA-VN-000450 - The Cisco ASA remote access VPN server must be configured to map the distinguished name (DN) from the client's certificate to entries in the authentication server to determine authorization to access the network - authorization-server-group

CASA-VN-000450 - The Cisco ASA remote access VPN server must be configured to map the distinguished name (DN) from the client's certificate to entries in the authentication server to determine authorization to access the network - username-from-certificate

CASA-VN-000460 - The Cisco ASA remote access VPN server must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the network.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-239970r666316_rule

STIG-ID|CASA-VN-000460

Vuln-ID|V-239970

CASA-VN-000500 - The Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event - svc

CCI|CCI-001487

Rule-ID|SV-239971r666319_rule

STIG-ID|CASA-VN-000500

Vuln-ID|V-239971

CASA-VN-000500 - The Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event - vpn

CASA-VN-000500 - The Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event - vpnc

CASA-VN-000500 - The Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event - vpnfo

CASA-VN-000500 - The Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event - webfo

CASA-VN-000500 - The Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event - webvpn

CASA-VN-000510 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred - svc

CCI|CCI-000132

Rule-ID|SV-239972r666322_rule

STIG-ID|CASA-VN-000510

Vuln-ID|V-239972

CASA-VN-000510 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred - vpn

CASA-VN-000510 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred - vpnc

CASA-VN-000510 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred - vpnfo

CASA-VN-000510 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred - webfo

CASA-VN-000510 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred - webvpn

CASA-VN-000520 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish the source of the events - svc

CCI|CCI-000133

Rule-ID|SV-239973r666325_rule

STIG-ID|CASA-VN-000520

Vuln-ID|V-239973

CASA-VN-000520 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish the source of the events - vpn

CASA-VN-000520 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish the source of the events - vpnc

Detections

Analytics

DISA STIG Cisco ASA VPN v1r3

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous