STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.

DISA Rule

SV-239859r665863_rule

Vulnerability Number

V-239859

Group Title

SRG-NET-000131-FW-000025

Rule Version

CASA-FW-000130

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Disable features that should not be enabled unless required for operations.

ASA(config)# no http server enable
ASA(config)# no telnet 10.1.22.2 255.255.255.255 INSIDE
ASA(config)# end

Note: Telnet must always be disabled.

Check Contents

Features such as telnet should never be enabled, while other features should only be enabled if required for operations. In the example below, http and telnet service is enabled.

http server enable
…
…
…
telnet 10.1.22.2 255.255.255.255 INSIDE

Note: The command http server actually enables https and is required for ASDM.

If any unnecessary or non-secure ports, protocols, or services are enabled, this is a finding.

Vulnerability Number

V-239859

Documentable

False

Rule Version

CASA-FW-000130

Severity Override Guidance

Features such as telnet should never be enabled, while other features should only be enabled if required for operations. In the example below, http and telnet service is enabled.

http server enable
…
…
…
telnet 10.1.22.2 255.255.255.255 INSIDE

Note: The command http server actually enables https and is required for ASDM.

If any unnecessary or non-secure ports, protocols, or services are enabled, this is a finding.

Check Content Reference

M

Target Key

5339