STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

DISA Rule

SV-239912r1051115_rule

Vulnerability Number

V-239912

Group Title

SRG-APP-000148-NDM-000346

Rule Version

CASA-ND-000450

Severity

CAT II

CCI(s)

• CCI-001358 - Establish privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.

Weight

10

Fix Recommendation

Step 1: Configure a local account with the necessary privilege level to troubleshoot network outage and restore operations as shown in the following example.

ASA(config)# username LAST_RESORT privilege 15
ASA(config)# username LAST_RESORT password xxxxxxxxxxxxx

Step 2: Define the AAA server.

ASA(config)# aaa-server RADIUS_GROUP protocol radius
ASA(config-aaa-server-group)# exit
ASA(config)# aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.10
ASA(config-aaa-server-host)# key xxxxxxxxx
ASA(config-aaa-server-host)# exit

Step 3: Configure the authentication to use an AAA server with the fallback to use the local account if the authentication server is not reachable as shown in the following example.

ASA(config)# aaa authentication serial console RADIUS_GROUP LOCAL
ASA(config)# aaa authentication ssh console RADIUS_GROUP LOCAL
ASA(config)# end

Check Contents

Step 1: Review the Cisco ASA configuration to verify that a local account for last resort has been configured with a privilege level that will enable the administrator to troubleshoot connectivity to the authentication server.

username LAST_RESORT password $sha512$5000$tb2eaIcI/Q5Q==$ScFJI1ChS4gIjXw== pbkdf2 privilege 15

Step 2: Verify the fallback to use local account has been configured as shown in the example below.

user-identity default-domain LOCAL
aaa authentication serial console RADIUS_GROUP LOCAL
aaa authentication ssh console RADIUS_GROUP LOCAL

If the Cisco ASA is not configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable, this is a finding.

Vulnerability Number

V-239912

Documentable

False

Rule Version

CASA-ND-000450

Severity Override Guidance

Step 1: Review the Cisco ASA configuration to verify that a local account for last resort has been configured with a privilege level that will enable the administrator to troubleshoot connectivity to the authentication server.

username LAST_RESORT password $sha512$5000$tb2eaIcI/Q5Q==$ScFJI1ChS4gIjXw== pbkdf2 privilege 15

Step 2: Verify the fallback to use local account has been configured as shown in the example below.

user-identity default-domain LOCAL
aaa authentication serial console RADIUS_GROUP LOCAL
aaa authentication ssh console RADIUS_GROUP LOCAL

If the Cisco ASA is not configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable, this is a finding.

Check Content Reference

M

Target Key

5342