STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable.

DISA Rule

SV-239857r665857_rule

Vulnerability Number

V-239857

Group Title

SRG-NET-000089-FW-000019

Rule Version

CASA-FW-000090

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

To continue to allow new connections and queue log records in the event the syslog server is not reachable, configure logging buffered and increase the queue size as shown in the example below.

ASA(config)# logging buffered informational
ASA(config)# logging queue 8192

Check Contents

Review the ASA configuration and verify that logging to the buffer is enabled and that the queue size has been increased as shown in the example below.

logging enable
logging buffered informational
logging queue 8192
logging host NDM_INTERFACE 10.1.22.2 6/1514

Note: Configuring a value of 0 for the queue size will set it to maximum size for the specific platform.

If the ASA is not configured to queue log records locally In the event that the central audit server is down or not reachable, this is a finding.

Vulnerability Number

V-239857

Documentable

False

Rule Version

CASA-FW-000090

Severity Override Guidance

Review the ASA configuration and verify that logging to the buffer is enabled and that the queue size has been increased as shown in the example below.

logging enable
logging buffered informational
logging queue 8192
logging host NDM_INTERFACE 10.1.22.2 6/1514

Note: Configuring a value of 0 for the queue size will set it to maximum size for the specific platform.

If the ASA is not configured to queue log records locally In the event that the central audit server is down or not reachable, this is a finding.

Check Content Reference

M

Target Key

5339