STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA perimeter firewall must be configured to block all outbound management traffic.

DISA Rule

SV-239867r891331_rule

Vulnerability Number

V-239867

Group Title

SRG-NET-000364-FW-000035

Rule Version

CASA-FW-000250

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Step 1: Configure the ingress ACL similar to the example below.

ASA(config)# access-list INSIDE_IN extended deny udp any any eq snmp
ASA(config)# access-list INSIDE_IN extended deny udp any any eq snmptrap
ASA(config)# access-list INSIDE_IN extended deny udp any any eq ntp
ASA(config)# access-list INSIDE_IN extended deny udp any any eq syslog
ASA(config)# access-list INSIDE_IN extended deny tcp any any eq 22
ASA(config)# access-list INSIDE_IN extended deny tcp any any eq tacacs
ASA(config)# access-list INSIDE_IN extended permit ip any any

Step 2: Apply the ACL inbound on the internal interfaces as shown in the example below.

ASA(config)# access-group INSIDE_IN out interface INSIDE
ASA(config)# end

Check Contents

Review the ASA configuration to determine if it blocks outbound management traffic.

Step 1: Verify that an ingress ACL has been applied to all internal interfaces as shown in the example below.

interface GigabitEthernet0/0
nameif INSIDE
security-level 100
ip address x.1.11.1 255.255.255.0
…
…
…
access-group INSIDE_IN in interface INSIDE

Step 2: Verify that the ingress ACL blocks outbound management traffic as shown in the example below.

access-list INSIDE_IN extended deny udp any any eq snmp
access-list INSIDE_IN extended deny udp any any eq snmptrap
access-list INSIDE_IN extended deny udp any any eq ntp
access-list INSIDE_IN extended deny udp any any eq syslog
access-list INSIDE_IN extended deny tcp any any eq 22
access-list INSIDE_IN extended deny tcp any any eq tacacs
access-list INSIDE_IN extended permit ip any any

Note: An exception is to allow management traffic destined to perimeter devices. In those cases, configure permit statements for that traffic before the deny statements in the example above.

If the ASA is not configured to block outbound management traffic, this is a finding.

Vulnerability Number

V-239867

Documentable

False

Rule Version

CASA-FW-000250

Severity Override Guidance

Review the ASA configuration to determine if it blocks outbound management traffic.

Step 1: Verify that an ingress ACL has been applied to all internal interfaces as shown in the example below.

interface GigabitEthernet0/0
nameif INSIDE
security-level 100
ip address x.1.11.1 255.255.255.0
…
…
…
access-group INSIDE_IN in interface INSIDE

Step 2: Verify that the ingress ACL blocks outbound management traffic as shown in the example below.

access-list INSIDE_IN extended deny udp any any eq snmp
access-list INSIDE_IN extended deny udp any any eq snmptrap
access-list INSIDE_IN extended deny udp any any eq ntp
access-list INSIDE_IN extended deny udp any any eq syslog
access-list INSIDE_IN extended deny tcp any any eq 22
access-list INSIDE_IN extended deny tcp any any eq tacacs
access-list INSIDE_IN extended permit ip any any

Note: An exception is to allow management traffic destined to perimeter devices. In those cases, configure permit statements for that traffic before the deny statements in the example above.

If the ASA is not configured to block outbound management traffic, this is a finding.

Check Content Reference

M

Target Key

5339