STIGQter STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to generate a real-time alert to organization-defined personnel and/or the firewall administrator in the event communication with the central audit server is lost.

DISA Rule

SV-239863r855805_rule

Vulnerability Number

V-239863

Group Title

SRG-NET-000335-FW-000017

Rule Version

CASA-FW-000210

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the ASA to send an email alert to the organization-defined personnel and/or firewall administrator for syslog messages at severity level 3.

ASA(config)# logging mail 3
ASA(config)# logging recipient-address OurFWadmin@mail.mil
ASA(config)# logging recipient-address OurISSO@mail.mil
ASA(config)# logging from-address firewall@mail.mil
ASA(config)# smtp-server 10.1.12.33
ASA(config)# end

Check Contents

Review the ASA configuration to determine if it will send an email alert to organization-defined personnel and/or the firewall administrator if communication with the central audit server is lost as shown in the example below.

logging enable
logging host NDM_INTERFACE 10.1.22.2 6/1514
logging permit-hostdown
logging mail errors
logging from-address firewall@mail.mil
logging recipient-address OurFWadmin@mail.mil level errors
logging recipient-address OurISSO@mail.mil level errors
…
…
…
smtp-server 10.1.12.33

Note: Severity level must be set at 3 (errors) or higher as the following message is seen when an ASA loses communication with the syslog server: %ASA-3-201008 or %ASA-3-414003: Disallowing new connections.

If the ASA is not configured to generate a real-time alert to organization-defined personnel and/or the firewall administrator if communication with the central audit server is lost, this is a finding.

Vulnerability Number

V-239863

Documentable

False

Rule Version

CASA-FW-000210

Severity Override Guidance

Review the ASA configuration to determine if it will send an email alert to organization-defined personnel and/or the firewall administrator if communication with the central audit server is lost as shown in the example below.

logging enable
logging host NDM_INTERFACE 10.1.22.2 6/1514
logging permit-hostdown
logging mail errors
logging from-address firewall@mail.mil
logging recipient-address OurFWadmin@mail.mil level errors
logging recipient-address OurISSO@mail.mil level errors
…
…
…
smtp-server 10.1.12.33

Note: Severity level must be set at 3 (errors) or higher as the following message is seen when an ASA loses communication with the syslog server: %ASA-3-201008 or %ASA-3-414003: Disallowing new connections.

If the ASA is not configured to generate a real-time alert to organization-defined personnel and/or the firewall administrator if communication with the central audit server is lost, this is a finding.

Check Content Reference

M

Target Key

5339