STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA perimeter firewall must be configured to filter traffic destined to the enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

DISA Rule

SV-239861r665904_rule

Vulnerability Number

V-239861

Group Title

SRG-NET-000205-FW-000040

Rule Version

CASA-FW-000170

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

Step 1: Configure the ingress ACL similar to the example below.

ASA(config)# access-list OUTSIDE_IN extended permit tcp any any eq https
ASA(config)# access-list OUTSIDE_IN extended permit tcp any any eq http
ASA(config)# access-list OUTSIDE_IN extended permit tcp any any eq domain
ASA(config)# access-list OUTSIDE_IN extended permit tcp any any eq ftp
ASA(config)# access-list OUTSIDE_IN extended permit tcp any any eq ftp-data
ASA(config)# access-list OUTSIDE_IN extended permit udp any any eq sip
ASA(config)# access-list OUTSIDE_IN extended deny ip any any log

Step 2: Apply the ACL inbound on the external interface as shown in the example below.

ASA(config)# access-group OUTSIDE_IN in interface OUTSIDE
ASA(config)# end

Check Contents

Review the inbound ACL to verify the ports and services allowed are in accordance with the PPSM CAL.

Review the ASA configuration to determine if it only permits inbound traffic using authorized ports and services.

Step 1: Verify that an ingress ACL has been applied to the external interface as shown in the example below.

interface GigabitEthernet0/0
nameif OUTSIDE
security-level 0
ip address x.1.11.1 255.255.255.0
…
…
…
access-group OUTSIDE_IN in interface OUTSIDE

Step 2: Verify that the ingress ACL only allows inbound traffic in accordance with the PPSM CAL as shown in the example below.

access-list OUTSIDE_IN extended permit tcp any any eq www
access-list OUTSIDE_IN extended permit tcp any any eq https
access-list OUTSIDE_IN extended permit tcp any any eq domain
access-list OUTSIDE_IN extended permit tcp any any eq ftp
access-list OUTSIDE_IN extended permit tcp any any eq ftp-data
access-list OUTSIDE_IN extended permit udp any any eq sip
access-list OUTSIDE_IN extended deny ip any any log

If the ASA is not configured to only allow inbound traffic in accordance with the PPSM CAL, this is a finding.

Vulnerability Number

V-239861

Documentable

False

Rule Version

CASA-FW-000170

Severity Override Guidance

Review the inbound ACL to verify the ports and services allowed are in accordance with the PPSM CAL.

Review the ASA configuration to determine if it only permits inbound traffic using authorized ports and services.

Step 1: Verify that an ingress ACL has been applied to the external interface as shown in the example below.

interface GigabitEthernet0/0
nameif OUTSIDE
security-level 0
ip address x.1.11.1 255.255.255.0
…
…
…
access-group OUTSIDE_IN in interface OUTSIDE

Step 2: Verify that the ingress ACL only allows inbound traffic in accordance with the PPSM CAL as shown in the example below.

access-list OUTSIDE_IN extended permit tcp any any eq www
access-list OUTSIDE_IN extended permit tcp any any eq https
access-list OUTSIDE_IN extended permit tcp any any eq domain
access-list OUTSIDE_IN extended permit tcp any any eq ftp
access-list OUTSIDE_IN extended permit tcp any any eq ftp-data
access-list OUTSIDE_IN extended permit udp any any eq sip
access-list OUTSIDE_IN extended deny ip any any log

If the ASA is not configured to only allow inbound traffic in accordance with the PPSM CAL, this is a finding.

Check Content Reference

M

Target Key

5339