An error occurred:

Cisco ASA VPN STIG

Cisco ASA VPN Security Technical Implementation Guide

ID Vuln ID Title Cat Status
CASA-VN-000010 V-239945 The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred. Cat III
CASA-VN-000020 V-239946 The Cisco ASA must be configured to generate log records containing information to establish when the events occurred. Cat III
CASA-VN-000080 V-239947 The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. Cat II
CASA-VN-000090 V-239948 The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events. Cat II
CASA-VN-000120 V-239949 The Cisco ASA must be configured to validate certificates via a trustpoint that identifies a DoD or DoD-approved certificate authority. Cat II
CASA-VN-000130 V-239950 The Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication. Cat I
CASA-VN-000150 V-239951 The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations. Cat I
CASA-VN-000160 V-239952 The Cisco ASA must be configured to use Internet Key Exchange v2 (IKEv2) for all IPsec security associations. Cat II
CASA-VN-000170 V-239953 The Cisco ASA must be configured to use NIST FIPS-validated cryptography for Internet Key Exchange (IKE) Phase 1. Cat II
CASA-VN-000180 V-239954 The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. Cat II
CASA-VN-000190 V-239955 The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes. Cat II
CASA-VN-000200 V-239956 The Cisco ASA must be configured to use a FIPS-validated cryptographic module to implement IPsec encryption services. Cat II
CASA-VN-000210 V-239957 The Cisco ASA must be configured to use a Diffie-Hellman (DH) Group of 16 or greater for Internet Key Exchange (IKE) Phase 1. Cat I
CASA-VN-000230 V-239958 The Cisco ASA must be configured to use FIPS-validated SHA-2 at 384 bits or higher for Internet Key Exchange (IKE) Phase 1. Cat II
CASA-VN-000240 V-239959 The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2. Cat I

Print

Display this benchmark in a printer-friendly format for off-line reference. This display does not include any commands.

Version Changes

If there are multiple versions of this benchmark, Xylok can display the differences between any changes in the checks.