STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events.

DISA Rule

SV-239948r878129_rule

Vulnerability Number

V-239948

Group Title

SRG-NET-000335-VPN-001270

Rule Version

CASA-VN-000090

Severity

CAT II

CCI(s)

• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

Configure the Cisco ASA to send critical to emergency log messages to the syslog server as shown in the example below.

ASA(config)# logging host NDM_INTERFACE 10.1.48.10 6/1514
ASA(config)# logging trap critical
ASA(config)# end

Note: The parameter "critical" can replaced with a lesser severity (i.e., error, warning, notice, informational). A logging list can be used as an alternative to the severity level.

Check Contents

Review the Cisco ASA configuration to verify that it is compliant with this requirement as shown in the example below.

logging trap critical
logging host NDM_INTERFACE 10.1.48.10 6/1514

Note: The parameter "critical" can replaced with a lesser severity (i.e., error, warning, notice, informational). A logging list can be used as an alternative to the severity level.

If the Cisco ASA is not configured to generate an alert that can be forwarded to organization-defined personnel and/or firewall administrator of all log failure events, this is a finding.

Vulnerability Number

V-239948

Documentable

False

Rule Version

CASA-VN-000090

Severity Override Guidance

Review the Cisco ASA configuration to verify that it is compliant with this requirement as shown in the example below.

logging trap critical
logging host NDM_INTERFACE 10.1.48.10 6/1514

Note: The parameter "critical" can replaced with a lesser severity (i.e., error, warning, notice, informational). A logging list can be used as an alternative to the severity level.

If the Cisco ASA is not configured to generate an alert that can be forwarded to organization-defined personnel and/or firewall administrator of all log failure events, this is a finding.

Check Content Reference

M

Target Key

5344