CASA-VN-000010 - The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred.

800-53|AU-3

CAT|III

CCI|CCI-000130

Rule-ID|SV-239945r666241_rule

STIG-ID|CASA-VN-000010

Vuln-ID|V-239945

CASA-VN-000020 - The Cisco ASA must be configured to generate log records containing information to establish when the events occurred.

CCI|CCI-000131

Rule-ID|SV-239946r666244_rule

STIG-ID|CASA-VN-000020

Vuln-ID|V-239946

CASA-VN-000080 - The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable.

800-53|AU-5(4)

CAT|II

CCI|CCI-001861

Rule-ID|SV-239947r1001254_rule

STIG-ID|CASA-VN-000080

Vuln-ID|V-239947

CASA-VN-000090 - The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events.

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-239948r878129_rule

STIG-ID|CASA-VN-000090

Vuln-ID|V-239948

CASA-VN-000120 - The Cisco ASA must be configured to validate certificates via a trustpoint that identifies a DoD or DoD-approved certificate authority.

800-53|IA-5(2)(a)

CCI|CCI-000185

Rule-ID|SV-239949r666253_rule

STIG-ID|CASA-VN-000120

Vuln-ID|V-239949

CASA-VN-000130 - The Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication.

800-53|IA-5(2)(d)

CAT|I

CCI|CCI-004068

Rule-ID|SV-268314r1015320_rule

STIG-ID|CASA-VN-000130

Vuln-ID|V-268314

CASA-VN-000150 - The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-239951r666259_rule

STIG-ID|CASA-VN-000150

Vuln-ID|V-239951

CASA-VN-000160 - The Cisco ASA must be configured to use Internet Key Exchange v2 (IKEv2) for all IPsec security associations.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-239952r666262_rule

STIG-ID|CASA-VN-000160

Vuln-ID|V-239952

CASA-VN-000170 - The Cisco ASA must be configured to use NIST FIPS-validated cryptography for Internet Key Exchange (IKE) Phase 1.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-239953r916122_rule

STIG-ID|CASA-VN-000170

Vuln-ID|V-239953

CASA-VN-000180 - The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation.

800-53|SC-8

CCI|CCI-002418

Rule-ID|SV-239954r916233_rule

STIG-ID|CASA-VN-000180

Vuln-ID|V-239954

CASA-VN-000190 - The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes.

Rule-ID|SV-239955r916125_rule

STIG-ID|CASA-VN-000190

Vuln-ID|V-239955

CASA-VN-000200 - The Cisco ASA must be configured to use a FIPS-validated cryptographic module to implement IPsec encryption services.

Rule-ID|SV-239956r916128_rule

STIG-ID|CASA-VN-000200

Vuln-ID|V-239956

CASA-VN-000210 - The Cisco ASA must be configured to use a Diffie-Hellman (DH) Group of 16 or greater for Internet Key Exchange (IKE) Phase 1 - IKE Phase 1.

800-53|AC-17(2)

CCI|CCI-000068

Rule-ID|SV-239957r916149_rule

STIG-ID|CASA-VN-000210

Vuln-ID|V-239957

CASA-VN-000230 - The Cisco ASA must be configured to use FIPS-validated SHA-2 at 384 bits or higher for Internet Key Exchange (IKE) Phase 1 - IKE Phase 1.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-239958r916134_rule

STIG-ID|CASA-VN-000230

Vuln-ID|V-239958

CASA-VN-000240 - The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2.

800-53|SC-23

CCI|CCI-001184

Rule-ID|SV-239959r1005430_rule

STIG-ID|CASA-VN-000240

Vuln-ID|V-239959

CASA-VN-000300 - The Cisco ASA VPN gateway must be configured to restrict what traffic is transported via the IPsec tunnel according to flow control policies.

800-53|AC-4

CCI|CCI-001414

Rule-ID|SV-239960r666286_rule

STIG-ID|CASA-VN-000300

Vuln-ID|V-239960

CASA-VN-000310 - The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection.

800-53|IA-3

CCI|CCI-000778

Rule-ID|SV-239961r666289_rule

STIG-ID|CASA-VN-000310

Vuln-ID|V-239961

CASA-VN-000340 - The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network.

Rule-ID|SV-239962r878134_rule

STIG-ID|CASA-VN-000340

Vuln-ID|V-239962

CASA-VN-000350 - The Cisco ASA VPN gateway must be configured to renegotiate the IPsec Security Association after eight hours or less.

800-53|IA-11

CCI|CCI-002038

CCI|CCI-004895

Rule-ID|SV-239963r1015263_rule

STIG-ID|CASA-VN-000350

Vuln-ID|V-239963

CASA-VN-000360 - The Cisco ASA VPN gateway must be configured to renegotiate the IKE security association after 24 hours or less.

Rule-ID|SV-239964r1015264_rule

STIG-ID|CASA-VN-000360

Vuln-ID|V-239964

CASA-VN-000390 - The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access.

800-53|IA-5(2)(c)

CCI|CCI-000187

Rule-ID|SV-239965r666301_rule

STIG-ID|CASA-VN-000390

Vuln-ID|V-239965

CASA-VN-000400 - The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network.

800-53|AC-24(1)

CCI|CCI-002353

Rule-ID|SV-239966r1001252_rule

STIG-ID|CASA-VN-000400

Vuln-ID|V-239966

CASA-VN-000410 - The Cisco ASA remote access VPN server must be configured to identify and authenticate users before granting access to the network.

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-239967r666307_rule

STIG-ID|CASA-VN-000410

Vuln-ID|V-239967

CASA-VN-000440 - The Cisco ASA remote access VPN server must be configured to enforce certificate-based authentication before granting access to the network.

800-53|IA-2(2)

CCI|CCI-000766

Rule-ID|SV-239968r954210_rule

STIG-ID|CASA-VN-000440

Vuln-ID|V-239968

CASA-VN-000450 - The Cisco ASA remote access VPN server must be configured to map the distinguished name (DN) from the client's certificate to entries in the authentication server to determine authorization to access the network.

Rule-ID|SV-239969r929014_rule

STIG-ID|CASA-VN-000450

Vuln-ID|V-239969

CASA-VN-000460 - The Cisco ASA remote access VPN server must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the network.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-239970r666316_rule

STIG-ID|CASA-VN-000460

Vuln-ID|V-239970

CASA-VN-000500 - The Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event.

CCI|CCI-001487

Rule-ID|SV-239971r666319_rule

STIG-ID|CASA-VN-000500

Vuln-ID|V-239971

CASA-VN-000510 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-239972r666322_rule

STIG-ID|CASA-VN-000510

Vuln-ID|V-239972

CASA-VN-000520 - The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-239973r666325_rule

STIG-ID|CASA-VN-000520

Vuln-ID|V-239973

CASA-VN-000530 - The Cisco ASA remote access VPN server must be configured to produce log records containing information to establish the outcome of the events.

CCI|CCI-000134

Rule-ID|SV-239974r666328_rule

STIG-ID|CASA-VN-000530

Vuln-ID|V-239974

CASA-VN-000550 - The Cisco ASA remote access VPN server must be configured to use TLS 1.2 or higher to protect the confidentiality of remote access connections.

Rule-ID|SV-239975r666331_rule

STIG-ID|CASA-VN-000550

Vuln-ID|V-239975

CASA-VN-000560 - The Cisco ASA remote access VPN server must be configured to use a FIPS-validated algorithm and hash function to protect the integrity of TLS remote access sessions.

CCI|CCI-001453

Rule-ID|SV-239976r769253_rule

STIG-ID|CASA-VN-000560

Vuln-ID|V-239976

CASA-VN-000610 - The Cisco ASA remote access VPN server must be configured to generate unique session identifiers using a FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.

800-53|SC-23(3)

CCI|CCI-001188

Rule-ID|SV-239977r666337_rule

STIG-ID|CASA-VN-000610

Vuln-ID|V-239977

CASA-VN-000630 - The Cisco ASA remote access VPN server must be configured to use SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions.

Rule-ID|SV-239978r916146_rule

STIG-ID|CASA-VN-000630

Vuln-ID|V-239978

CASA-VN-000640 - The Cisco VPN remote access server must be configured to use AES256 or greater encryption for the Internet Key Exchange (IKE) Phase 1 to protect confidentiality of remote access sessions - IKE Phase 1 to protect confidentiality of remote access sessions.

Rule-ID|SV-239979r987747_rule

STIG-ID|CASA-VN-000640

Vuln-ID|V-239979

CASA-VN-000650 - The Cisco ASA VPN remote access server must be configured to use AES256 or greater encryption for the IPsec security association to protect the confidentiality of remote access sessions - AES encryption for the IPsec security association to protect the confidentiality of remote access sessions.

Rule-ID|SV-239980r916158_rule

STIG-ID|CASA-VN-000650

Vuln-ID|V-239980

CASA-VN-000660 - The Cisco VPN remote access server must be configured to accept Common Access Card (CAC) credential credentials.

800-53|IA-2(12)

CCI|CCI-001953

Rule-ID|SV-239981r856175_rule

STIG-ID|CASA-VN-000660

Detections

Analytics

DISA STIG Cisco ASA VPN v2r2

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous