Title

The Cisco ASA remote access VPN server must be configured to use TLS 1.2 or higher to protect the confidentiality of remote access connections. (Cat I impact)

Discussion

Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.

Check Content

Verify the TLS ASA is configured to use TLS 1.2 or higher as shown in the example below. ssl server-version tlsv1.2 dtlsv1.2 Note: ASA supports TLS version 1.2 starting from software version 9.3.1 for secure message transmission for Clientless SSL VPN and AnyConnect VPN. If the ASA is not configured to use TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission, this is a finding.

Fix Text

Configure the ASA to use TLS 1.2 or higher as shown in the example below. ASA1(config)# ssl server-version tlsv1.2 dtlsv1.2

Additional Identifiers

Rule ID: SV-239975r666331_rule

Vulnerability ID: V-239975

Group Title: SRG-NET-000062-VPN-000200

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.