STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to organization-defined personnel and/or the firewall administrator.

DISA Rule

SV-239943r1137890_rule

Vulnerability Number

V-239943

Group Title

SRG-APP-000516-NDM-000350

Rule Version

CASA-ND-001410

Severity

CAT I

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Configure the ASA to send log messages to the syslog servers as shown in the example below.

ASA(config)# logging host NDM_INTERFACE 10.1.48.10 6/1514
ASA(config)# logging host NDM_INTERFACE 10.1.48.11 6/1514
ASA(config)# logging trap notifications
ASA(config)# end

Check Contents

Verify the ASA is configured to send logs to at least two syslog servers. The configuration should look similar to the example below.

logging trap notifications
logging host NDM_INTERFACE 10.1.48.10 6/1514
logging host NDM_INTERFACE 10.1.48.11 6/1514

Note: A logging list can be used as an alternative to the severity level.

If the ASA is not configured to send log data to at least two syslog servers, this is a finding.

Vulnerability Number

V-239943

Documentable

False

Rule Version

CASA-ND-001410

Severity Override Guidance

Verify the ASA is configured to send logs to at least two syslog servers. The configuration should look similar to the example below.

logging trap notifications
logging host NDM_INTERFACE 10.1.48.10 6/1514
logging host NDM_INTERFACE 10.1.48.11 6/1514

Note: A logging list can be used as an alternative to the severity level.

If the ASA is not configured to send log data to at least two syslog servers, this is a finding.

Check Content Reference

M

Target Key

5342