STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to use at least two authentication servers to authenticate users prior to granting administrative access.

DISA Rule

SV-239940r1137887_rule

Vulnerability Number

V-239940

Group Title

SRG-APP-000516-NDM-000336

Rule Version

CASA-ND-001310

Severity

CAT I

CCI(s)

• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.

Weight

10

Fix Recommendation

Configure the Cisco ASA to use at least two authentication servers as shown in the following example.

Step 1: Define the authentication group and protocol.

ASA(config)# aaa-server RADIUS_GROUP protocol radius

Step 2: Define the authentication servers.

ASA(config)# aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.10
ASA(config-aaa-server-host)# key bobby
ASA(config-aaa-server-host)# exit
ASA(config)# aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.11
ASA(config-aaa-server-host)# key bobby2
ASA(config-aaa-server-host)# exit

Step 3: Use the AAA server for login authentication for both in-band and console access methods.

ASA(config)# aaa authentication serial console RADIUS_GROUP LOCAL
ASA(config)# aaa authentication ssh console RADIUS_GROUP LOCAL
ASA(config)# end

Check Contents

Review the Cisco ASA configuration to verify the device is configured to use at least two authentication servers as primary source for authentication.

Step 1: Verify that an AAA group is configured for login authentication for both in-band and console access methods.

aaa authentication serial console RADIUS_GROUP LOCAL
aaa authentication ssh console RADIUS_GROUP LOCAL

Step 2: Verify that an AAA group and server has been defined for the group referenced in the above example.

aaa-server RADIUS_GROUP protocol radius
aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.10
key *****
aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.11
key *****

If the Cisco ASA is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Vulnerability Number

V-239940

Documentable

False

Rule Version

CASA-ND-001310

Severity Override Guidance

Review the Cisco ASA configuration to verify the device is configured to use at least two authentication servers as primary source for authentication.

Step 1: Verify that an AAA group is configured for login authentication for both in-band and console access methods.

aaa authentication serial console RADIUS_GROUP LOCAL
aaa authentication ssh console RADIUS_GROUP LOCAL

Step 2: Verify that an AAA group and server has been defined for the group referenced in the above example.

aaa-server RADIUS_GROUP protocol radius
aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.10
key *****
aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.11
key *****

If the Cisco ASA is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Check Content Reference

M

Target Key

5342