STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to filter outbound traffic on all internal interfaces.

DISA Rule

SV-239866r991798_rule

Vulnerability Number

V-239866

Group Title

SRG-NET-000364-FW-000032

Rule Version

CASA-FW-000240

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Step 1: Configure the egress ACL similar to the example below.

ASA(config)# access-list INSIDE_2_OUT extended permit tcp any any eq https
ASA(config)# access-list INSIDE_2_OUT extended permit tcp any any eq http
ASA(config)# access-list INSIDE_2_OUT extended permit tcp any any eq domain
ASA(config)# access-list INSIDE_2_OUT extended permit tcp any any eq ftp
ASA(config)# access-list INSIDE_2_OUT extended permit tcp any any eq ftp-data
ASA(config)# access-list INSIDE_2_OUT extended permit tcp any host 10.1.22.3 eq ssh
ASA(config)# access-list INSIDE_2_OUT extended deny ip any any log

Step 2: Apply the ACL inbound on the internal interfaces as shown in the example below.

ASA(config)# access-group INSIDE_2_OUT in interface INSIDE
ASA(config)# end

Check Contents

Step 1: Verify that an ingress ACL has been applied to the internal interface as shown in the example below.

interface GigabitEthernet0/3
nameif INSIDE
security-level 100
ip address 10.1.11.1 255.255.255.0
…
…
…
access-group INSIDE_2_OUT in interface INSIDE

Step 2: Verify that the ACL only allows outbound traffic using authorized ports and services as shown in the example below.

access-list INSIDE_2_OUT extended permit tcp any any eq www
access-list INSIDE_2_OUT extended permit tcp any any eq https
access-list INSIDE_2_OUT extended permit tcp any any eq domain
access-list INSIDE_2_OUT extended permit tcp any any eq ftp
access-list INSIDE_2_OUT extended permit tcp any any eq ftp-data
access-list INSIDE_2_OUT extended permit tcp any host 10.1.22.3 eq ssh
access-list INSIDE_2_OUT extended deny ip any any log

If the ASA is not configured to filter outbound traffic on all internal interfaces, this is a finding.

Vulnerability Number

V-239866

Documentable

False

Rule Version

CASA-FW-000240

Severity Override Guidance

Step 1: Verify that an ingress ACL has been applied to the internal interface as shown in the example below.

interface GigabitEthernet0/3
nameif INSIDE
security-level 100
ip address 10.1.11.1 255.255.255.0
…
…
…
access-group INSIDE_2_OUT in interface INSIDE

Step 2: Verify that the ACL only allows outbound traffic using authorized ports and services as shown in the example below.

access-list INSIDE_2_OUT extended permit tcp any any eq www
access-list INSIDE_2_OUT extended permit tcp any any eq https
access-list INSIDE_2_OUT extended permit tcp any any eq domain
access-list INSIDE_2_OUT extended permit tcp any any eq ftp
access-list INSIDE_2_OUT extended permit tcp any any eq ftp-data
access-list INSIDE_2_OUT extended permit tcp any host 10.1.22.3 eq ssh
access-list INSIDE_2_OUT extended deny ip any any log

If the ASA is not configured to filter outbound traffic on all internal interfaces, this is a finding.

Check Content Reference

M

Target Key

5339