STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis.

DISA Rule

SV-239862r953982_rule

Vulnerability Number

V-239862

Group Title

SRG-NET-000333-FW-000014

Rule Version

CASA-FW-000200

Severity

CAT II

CCI(s)

• CCI-001821 - Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management policy is to be disseminated.

Weight

10

Fix Recommendation

Configure the ASA to send log messages to the syslog server as shown in the example below.

ASA(config)# logging host NDM_INTERFACE 10.1.48.10/1514
ASA(config)# logging trap notifications
ASA(config)# end

Check Contents

Verify that the ASA is configured to send logs to a syslog server. The configuration should look similar to the example below.

logging trap notifications
logging host NDM_INTERFACE 10.1.48.10/1514

If the ASA is not configured to send log data to the syslog server, this is a finding.

Vulnerability Number

V-239862

Documentable

False

Rule Version

CASA-FW-000200

Severity Override Guidance

Verify that the ASA is configured to send logs to a syslog server. The configuration should look similar to the example below.

logging trap notifications
logging host NDM_INTERFACE 10.1.48.10/1514

If the ASA is not configured to send log data to the syslog server, this is a finding.

Check Content Reference

M

Target Key

5339