STIGQter STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to generate traffic log entries containing information to establish what type of events occurred.

DISA Rule

SV-239855r665851_rule

Vulnerability Number

V-239855

Group Title

SRG-NET-000074-FW-000009

Rule Version

CASA-FW-000040

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the ASA to generate traffic log entries containing information to establish what type of events occurred as shown in the example below.

Step 1: Enable logging.

ASA(config)# logging enable

Step 2: Include the log parameter on all deny ACL statements.

ASA(config)# access-list OUTSIDE_OUT extended deny ip any any log

Check Contents

Review the ASA configuration to determine if it is compliant with the requirement.

Step 1: Verify that all ACL deny statements have the log parameter defined as shown in the example below.

access-list OUTSIDE_OUT extended deny ip any any log

Step 2: Verify logging is enabled.

logging enable

If the ASA is not configured to generate traffic log entries containing information to establish what type of events occurred, this is a finding.

Vulnerability Number

V-239855

Documentable

False

Rule Version

CASA-FW-000040

Severity Override Guidance

Review the ASA configuration to determine if it is compliant with the requirement.

Step 1: Verify that all ACL deny statements have the log parameter defined as shown in the example below.

access-list OUTSIDE_OUT extended deny ip any any log

Step 2: Verify logging is enabled.

logging enable

If the ASA is not configured to generate traffic log entries containing information to establish what type of events occurred, this is a finding.

Check Content Reference

M

Target Key

5339