STIGQter STIGQter: STIG Summary: Cisco ASA Firewall Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected.

DISA Rule

SV-239872r971533_rule

Vulnerability Number

V-239872

Group Title

SRG-NET-000392-FW-000042

Rule Version

CASA-FW-000300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Step 1: Configure basic and scanning threat detection as shown below.

ASA(config)# threat-detection basic-threat
ASA(config)# threat-detection scanning-threat

Step 2: Configure the ASA to send an email alert to the organization-defined personnel and/or firewall administrator for syslog messages at severity level 4.

ASA(config)# logging mail 4
ASA(config)# logging recipient-address OurFWadmin@mail.mil
ASA(config)# logging recipient-address OurISSO@mail.mil
ASA(config)# logging from-address firewall@mail.mil
ASA(config)# smtp-server 10.1.12.33
ASA(config)# end

Note: As an alternative to sending email alerts, SNMP traps could be sent to an SIEM that is monitored.

Check Contents

NOTE: When operating the ASA in multi-context mode with a separate IDPS, threat detection cannot be enabled, and this check is Not Applicable.

Step 1: Verify that basic and scanning threat detection has been configured as shown below.

threat-detection basic-threat
threat-detection scanning-threat

Step 2: Configure the ASA to send an email to organization-defined personnel and/or the firewall administrator for syslog messages at severity level 4 (warnings) as shown in the example below.

logging mail warnings
logging from-address firewall@mail.mil
logging recipient-address OurFWadmin@mail.mil level warnings
logging recipient-address OurISSO@mail.mil level warnings
…
…
…
smtp-server 10.1.12.33

Note: When a basic threat is detected, the ASA generates syslog message %ASA-4-733100. When scanning threat is detected, the ASA generates syslog message %ASA-4-733101. As an alternative to sending email alerts, SNMP traps could be sent to an SIEM that is monitored.

If the ASA is not configured to generate an alert that can be forwarded to the organization-defined personnel and/or firewall administrator when a threat has been detected, this is a finding.

Vulnerability Number

V-239872

Documentable

False

Rule Version

CASA-FW-000300

Severity Override Guidance

NOTE: When operating the ASA in multi-context mode with a separate IDPS, threat detection cannot be enabled, and this check is Not Applicable.

Step 1: Verify that basic and scanning threat detection has been configured as shown below.

threat-detection basic-threat
threat-detection scanning-threat

Step 2: Configure the ASA to send an email to organization-defined personnel and/or the firewall administrator for syslog messages at severity level 4 (warnings) as shown in the example below.

logging mail warnings
logging from-address firewall@mail.mil
logging recipient-address OurFWadmin@mail.mil level warnings
logging recipient-address OurISSO@mail.mil level warnings
…
…
…
smtp-server 10.1.12.33

Note: When a basic threat is detected, the ASA generates syslog message %ASA-4-733100. When scanning threat is detected, the ASA generates syslog message %ASA-4-733101. As an alternative to sending email alerts, SNMP traps could be sent to an SIEM that is monitored.

If the ASA is not configured to generate an alert that can be forwarded to the organization-defined personnel and/or firewall administrator when a threat has been detected, this is a finding.

Check Content Reference

M

Target Key

5339