STIGQter STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2.

DISA Rule

SV-239959r1005430_rule

Vulnerability Number

V-239959

Group Title

SRG-NET-000230-VPN-000780

Rule Version

CASA-VN-000240

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure the ASA to use FIPS-validated SHA-2 or higher for IKE Phase 2.

Step 1: Configure the IKE Phase 2 proposal as shown in the example below.

ASA1(config)# crypto ipsec ikev2 ipsec-proposal AES_SHA
ASA1(config-ipsec-proposal)# protocol esp integrity sha-384 sha-256
ASA1(config-ipsec-proposal)# exit

Step 2: Configure the crypto map using the configured proposal.

ASA1(config)# crypto map IPSEC_MAP 10 set ikev2 ipsec-proposal
ASA1(config)# end

Check Contents

Review the ASA configuration to verify that SHA-2 or higher is specified for IKE Phase 2 as shown in the example below.

Step 1: Review the crypto map for IKE Phase 2.

crypto map IPSEC_MAP 10 set ikev2 ipsec-proposal AES_SHA

Step 2: Verify that the proposal specifies SHA-2 or higher.

crypto ipsec ikev2 ipsec-proposal AES_SHA
protocol esp encryption …
protocol esp integrity sha-384 sha-256

If the ASA is not configured to use SHA-2 or higher for IKE Phase 2, this is a finding.

Vulnerability Number

V-239959

Documentable

False

Rule Version

CASA-VN-000240

Severity Override Guidance

Review the ASA configuration to verify that SHA-2 or higher is specified for IKE Phase 2 as shown in the example below.

Step 1: Review the crypto map for IKE Phase 2.

crypto map IPSEC_MAP 10 set ikev2 ipsec-proposal AES_SHA

Step 2: Verify that the proposal specifies SHA-2 or higher.

crypto ipsec ikev2 ipsec-proposal AES_SHA
protocol esp encryption …
protocol esp integrity sha-384 sha-256

If the ASA is not configured to use SHA-2 or higher for IKE Phase 2, this is a finding.

Check Content Reference

M

Target Key

5344