STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to filter inbound traffic on all external interfaces.

DISA Rule

SV-239865r991797_rule

Vulnerability Number

V-239865

Group Title

SRG-NET-000364-FW-000031

Rule Version

CASA-FW-000230

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Step 1: Configure the ACL to allow specific inbound traffic.

ASA(config)# access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.2 eq www
ASA(config)# access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.2 eq https
ASA(config)# access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.3 eq ftp
ASA(config)# access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.3 eq ftp-data
ASA(config)# access-list OUTSIDE_2_DMZ extended deny ip any any log

Step 2: Apply the ACL inbound to the external interface.

ASA(config)# access-group OUTSIDE_2_DMZ in interface OUTSIDE

Check Contents

Review the ASA configuration to verify that it is filtering inbound traffic on all external interfaces.

access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.2 eq www
access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.2 eq https
access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.3 eq ftp
access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.3 eq ftp-data
access-list OUTSIDE_2_DMZ extended deny ip any any log
…
…
…
access-group OUTSIDE_2_DMZ in interface OUTSIDE

If the ASA is not configured to filter inbound traffic on all external interfaces, this is a finding.

Vulnerability Number

V-239865

Documentable

False

Rule Version

CASA-FW-000230

Severity Override Guidance

Review the ASA configuration to verify that it is filtering inbound traffic on all external interfaces.

access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.2 eq www
access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.2 eq https
access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.3 eq ftp
access-list OUTSIDE_2_DMZ extended permit tcp any host 10.1.33.3 eq ftp-data
access-list OUTSIDE_2_DMZ extended deny ip any any log
…
…
…
access-group OUTSIDE_2_DMZ in interface OUTSIDE

If the ASA is not configured to filter inbound traffic on all external interfaces, this is a finding.

Check Content Reference

M

Target Key

5339