STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to authenticate Simple Network Management Protocol (SNMP) messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

DISA Rule

SV-239927r961506_rule

Vulnerability Number

V-239927

Group Title

SRG-APP-000395-NDM-000310

Rule Version

CASA-ND-001050

Severity

CAT II

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Configure the Cisco ASA to authenticate SNMP messages as shown in the example below.

ASA(config)# snmp-server group NETOPS v3 priv
ASA(config)# snmp-server user FWADMIN NETOPS v3 auth sha xxxxxxxxxxxxxxx
ASA(config)# snmp-server host NDM_INTERFACE 10.1.48.10 version 3 FWADMIN
ASA(config)# end

Check Contents

Review the Cisco ASA configuration to verify that it is compliant with this requirement as shown in the example below.

snmp-server group NETOPS v3 priv
snmp-server user FWADMIN NETOPS v3 engineID xxxxxxxxxxxx encrypted auth sha xxxxxxxxxxxxxxxx
snmp-server host NDM_INTERFACE 10.1.48.10 version 3 FWADMIN

If the Cisco ASA is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

Vulnerability Number

V-239927

Documentable

False

Rule Version

CASA-ND-001050

Severity Override Guidance

Review the Cisco ASA configuration to verify that it is compliant with this requirement as shown in the example below.

snmp-server group NETOPS v3 priv
snmp-server user FWADMIN NETOPS v3 engineID xxxxxxxxxxxx encrypted auth sha xxxxxxxxxxxxxxxx
snmp-server host NDM_INTERFACE 10.1.48.10 version 3 FWADMIN

If the Cisco ASA is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

Check Content Reference

M

Target Key

5342