STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to restrict VPN traffic according to organization-defined filtering rules.

DISA Rule

SV-239854r665848_rule

Vulnerability Number

V-239854

Group Title

SRG-NET-000061-FW-000001

Rule Version

CASA-FW-000030

Severity

CAT II

CCI(s)

• CCI-000067 - Employ automated mechanisms to monitor remote access methods.

Weight

10

Fix Recommendation

Step 1: Configure the ACL to restrict VPN traffic.

ASA(config)# access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255. host 192.168.1.12 eq http
ASA(config)# access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255. host 192.168.1.13 eq smtp
ASA(config)# access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255. host 192.168.1.14 eq ftp
ASA(config)# access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255. host 192.168.1.14 eq ftp-data
ASA(config)# access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.y host 192.168.1.15 eq domain
ASA(config)# access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255. host 192.168.1.16 eq sqlnet
ASA(config)# access-list RESTRICT_VPN extended deny ip any any log
ASA(config)# exit

Step 2: Apply the VPN filter to the applicable group policy as shown in the example below.

ASA(config)# group-policy VPN_POLICY attributes
ASA(config-group-policy)# vpn-filter value RESTRICT_VPN
ASA(config-group-policy)# end

Check Contents

Step 1: Verify that an ACL has been applied to the applicable VPN group policy via the vpn-filter attribute as shown in the example below.

group-policy VPN_POLICY internal
group-policy VPN_POLICY attributes
…
…
…
vpn-filter value RESTRICT_VPN

Step 2: Verify that the filter restricts traffic according to organization-defined filtering rules as shown in the example below.

access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.12 eq http
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.13 eq smtp
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.14 eq ftp
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.14 eq ftp-data
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.15 eq domain
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.16 eq sqlnet
access-list RESTRICT_VPN extended deny ip any any log

Note: In the example above, assume that the client-assigned IP address pool is 10.10.10.0/24 and the local private network is 192.168.1.0/24.

If the ASA is not configured to restrict VPN traffic according to organization-defined filtering rules, this is a finding.

Vulnerability Number

V-239854

Documentable

False

Rule Version

CASA-FW-000030

Severity Override Guidance

Step 1: Verify that an ACL has been applied to the applicable VPN group policy via the vpn-filter attribute as shown in the example below.

group-policy VPN_POLICY internal
group-policy VPN_POLICY attributes
…
…
…
vpn-filter value RESTRICT_VPN

Step 2: Verify that the filter restricts traffic according to organization-defined filtering rules as shown in the example below.

access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.12 eq http
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.13 eq smtp
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.14 eq ftp
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.14 eq ftp-data
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.15 eq domain
access-list RESTRICT_VPN extended permit tcp 10.0.0.0 255.255.255.0 host 192.168.1.16 eq sqlnet
access-list RESTRICT_VPN extended deny ip any any log

Note: In the example above, assume that the client-assigned IP address pool is 10.10.10.0/24 and the local private network is 192.168.1.0/24.

If the ASA is not configured to restrict VPN traffic according to organization-defined filtering rules, this is a finding.

Check Content Reference

M

Target Key

5339