STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes.

DISA Rule

SV-239955r916125_rule

Vulnerability Number

V-239955

Group Title

SRG-NET-000510-VPN-002160

Rule Version

CASA-VN-000190

Severity

CAT II

CCI(s)

CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

Fix Recommendation

Configure the ASA to use a FIPS-validated cryptographic module to generate cryptographic hashes as shown in the examples below.

ASA1(config)# crypto ikev2 policy 1
ASA1(config-ikev2-policy)# integrity sha384
ASA1(config-ikev2-policy)# exit

ASA1(config)# crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
ASA1(config-ipsec-proposal)# protocol esp integrity sha-384
ASA1(config-ipsec-proposal)# end

Check Contents

Verify the ASA is configured to use a FIPS-validated cryptographic module to generate cryptographic hashes.

Step 1: Verify that a FIPS-validated hash is used for IKE Phase 1 as shown in the example below.

crypto ikev2 policy 1
…
…
…
integrity sha384

Step 2: Verify that a FIPS-validated hash is used for the IPsec SA.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp integrity sha-384

If the ASA is not configured to use a FIPS-validated cryptographic module to generate cryptographic hashes, this is a finding.

The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key