STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations.

DISA Rule

SV-239951r666259_rule

Vulnerability Number

V-239951

Group Title

SRG-NET-000512-VPN-002220

Rule Version

CASA-VN-000150

Severity

CAT I

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the ASA to use IKE for all IPsec VPN SAs.

Step 1: Configure IKE for the IPsec Phase 1 policy and enable it on applicable interfaces.

ASA1(config)# crypto ikev2 policy 1
ASA1(config-ikev2-policy)# encryption …

ASA1(config)# crypto ikev2 enable OUTSIDE

Step 2: Configure IKE for the IPsec Phase 2.

ASA1(config)# crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS

Check Contents

Step 1: Verify that IKE is configured for the IPsec Phase 1 policy and enabled on applicable interfaces.

crypto ikev2 policy 1
encryption …

crypto ikev2 enable OUTSIDE

Step 2: Verify that IKE is configured for the IPsec Phase 2.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp encryption …

Note: Although IKEv2 is preferred, IKEv1 will meet the intent of this requirement.

If the IKE is not configured for all IPsec security associations, this is a finding.

Vulnerability Number

V-239951

Documentable

False

Rule Version

CASA-VN-000150

Severity Override Guidance

Step 1: Verify that IKE is configured for the IPsec Phase 1 policy and enabled on applicable interfaces.

crypto ikev2 policy 1
encryption …

crypto ikev2 enable OUTSIDE

Step 2: Verify that IKE is configured for the IPsec Phase 2.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp encryption …

Note: Although IKEv2 is preferred, IKEv1 will meet the intent of this requirement.

If the IKE is not configured for all IPsec security associations, this is a finding.

Check Content Reference

M

Target Key

5344