STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of non-local maintenance and diagnostic communications.

DISA Rule

SV-239930r961554_rule

Vulnerability Number

V-239930

Group Title

SRG-APP-000411-NDM-000330

Rule Version

CASA-ND-001140

Severity

CAT I

CCI(s)

• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

SSH Example

Step 1: Enable FIPS mode via the fips enable command.

Step 2: Configure SSH to only use FIPS-compliant ciphers and Diffie-Hellman Group 14 for the key exchange.

ASA(config)# ssh cipher encryption fips
ASA(config)# ssh key-exchange group dh-group14-sha

SNMP Example

ASA(config)# snmp-server group NETOPS v3 auth
ASA(config)# snmp-server user FWADMIN NETOPS v3 auth sha xxxxxxxxxxxxxxx
ASA(config)# snmp-server host NDM_INTERFACE 10.1.48.10 version 3 FWADMIN
ASA(config)# end

Check Contents

SSH Example

Step 1: Verify that FIPS mode is enabled as shown in the example below.

fips enable

Step 2: Verify that SSH is configured to only use FIPS-compliant ciphers and that Diffie-Hellman Group 14 is used for the key exchange as shown in the example below.

ssh version 2
ssh cipher encryption fips
ssh key-exchange group dh-group14-sha1

Note: The ASA only supports SSHv2.

SNMP Example

snmp-server group NETOPS v3 auth
snmp-server user FWADMIN NETOPS v3 engineID xxxxxxxxxxxx encrypted auth sha xxxxxxxxxxxxxxxx
snmp-server host NDM_INTERFACE 10.1.48.10 version 3 FWADMIN

If the ASA is not configured to implement cryptographic mechanisms to protect the integrity of remote maintenance sessions using a FIPS 140-2 approved algorithm, this is a finding.

Vulnerability Number

V-239930

Documentable

False

Rule Version

CASA-ND-001140

Severity Override Guidance

SSH Example

Step 1: Verify that FIPS mode is enabled as shown in the example below.

fips enable

Step 2: Verify that SSH is configured to only use FIPS-compliant ciphers and that Diffie-Hellman Group 14 is used for the key exchange as shown in the example below.

ssh version 2
ssh cipher encryption fips
ssh key-exchange group dh-group14-sha1

Note: The ASA only supports SSHv2.

SNMP Example

snmp-server group NETOPS v3 auth
snmp-server user FWADMIN NETOPS v3 engineID xxxxxxxxxxxx encrypted auth sha xxxxxxxxxxxxxxxx
snmp-server host NDM_INTERFACE 10.1.48.10 version 3 FWADMIN

If the ASA is not configured to implement cryptographic mechanisms to protect the integrity of remote maintenance sessions using a FIPS 140-2 approved algorithm, this is a finding.

Check Content Reference

M

Target Key

5342