STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable.

DISA Rule

SV-239947r1001254_rule

Vulnerability Number

V-239947

Group Title

SRG-NET-000336-VPN-001280

Rule Version

CASA-VN-000080

Severity

CAT II

CCI(s)

• CCI-001861 - Invoke a full system shutdown, partial system shutdown, or degraded operational mode with limited mission or business functionality available in the event of organization-defined audit logging failures, unless an alternate audit logging capability exists.

Weight

10

Fix Recommendation

To continue to allow new connections and queue log records in the event the syslog server is not reachable, configure logging permit-hostdown and increase the queue size.

ASA(config)# logging permit-hostdown
ASA(config)# logging queue 8192

Check Contents

If the ASA is configured to send syslog messages to a TCP-based syslog server, and if the syslog server is down new connections are blocked. To continue to allow new connections and queue log records verify that the logging permit-hostdown and the queue size has been increased (default is 512).

logging enable
…
…
…
logging queue 8192
logging host NDM_INTERFACE 10.1.22.2 6/1514
logging permit-hostdown

If the ASA is not configured to queue log records locally in the event that the central audit server is down or not reachable, this is a finding.

Vulnerability Number

V-239947

Documentable

False

Rule Version

CASA-VN-000080

Severity Override Guidance

If the ASA is configured to send syslog messages to a TCP-based syslog server, and if the syslog server is down new connections are blocked. To continue to allow new connections and queue log records verify that the logging permit-hostdown and the queue size has been increased (default is 512).

logging enable
…
…
…
logging queue 8192
logging host NDM_INTERFACE 10.1.22.2 6/1514
logging permit-hostdown

If the ASA is not configured to queue log records locally in the event that the central audit server is down or not reachable, this is a finding.

Check Content Reference

M

Target Key

5344