STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to encrypt Simple Network Management Protocol (SNMP) messages using a FIPS 140-2 approved algorithm.

DISA Rule

SV-239928r961506_rule

Vulnerability Number

V-239928

Group Title

SRG-APP-000395-NDM-000310

Rule Version

CASA-ND-001070

Severity

CAT II

CCI(s)

CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

Fix Recommendation

Configure the Cisco ASA to encrypt SNMP messages using a FIPS 140-2 approved algorithm as shown in the example below.

ASA(config)# snmp-server group NETOPS v3 priv
ASA(config)# snmp-server user FWADMIN NETOPS v3 auth sha xxxxxxxxxx priv aes xxxxxxxxxx
ASA(config)# snmp-server host NDM_INTERFACE 10.1.48.10 version 3 FWADMIN
ASA(config)# end

Check Contents

Review the Cisco ASA configuration to verify that it is compliant with this requirement as shown in the example below.

snmp-server group NETOPS v3 priv
snmp-server user FWADMIN NETOPS v3 engineID xxxxxxxxxxxx encrypted auth sha xxxxxxxxxxxx priv aes xxxxxxxxxxxx
snmp-server host NDM_INTERFACE 10.1.48.10 version 3 FWADMIN

If the Cisco ASA is not configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm, this is a finding.

The Cisco ASA must be configured to encrypt Simple Network Management Protocol (SNMP) messages using a FIPS 140-2 approved algorithm.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key