STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation.

DISA Rule

SV-239954r916233_rule

Vulnerability Number

V-239954

Group Title

SRG-NET-000371-VPN-001640

Rule Version

CASA-VN-000180

Severity

CAT II

CCI(s)

• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.

Weight

10

Fix Recommendation

Configure the ASA to specify PFS for the IPsec SA during IKE Phase 2 negotiation as shown in the example below.

ASA3(config)# crypto map IPSEC_CRYPTO_MAP 1 set pfs group5

Check Contents

Review crypto maps that reference an IPsec proposal. Verify the ASA is configured to specify PFS as shown in the example below.

crypto map IPSEC_CRYPTO_MAP 1 set pfs group5
crypto map IPSEC_CRYPTO_MAP 1 set peer x.x.x.x
crypto map IPSEC_CRYPTO_MAP 1 set ikev2 ipsec-proposal IPSEC_TRANS

If the ASA is not configured to specify PFS for the IPsec SA during IKE Phase 2 negotiation, this is a finding.

Vulnerability Number

V-239954

Documentable

False

Rule Version

CASA-VN-000180

Severity Override Guidance

Review crypto maps that reference an IPsec proposal. Verify the ASA is configured to specify PFS as shown in the example below.

crypto map IPSEC_CRYPTO_MAP 1 set pfs group5
crypto map IPSEC_CRYPTO_MAP 1 set peer x.x.x.x
crypto map IPSEC_CRYPTO_MAP 1 set ikev2 ipsec-proposal IPSEC_TRANS

If the ASA is not configured to specify PFS for the IPsec SA during IKE Phase 2 negotiation, this is a finding.

Check Content Reference

M

Target Key

5344