STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection.

DISA Rule

SV-239961r666289_rule

Vulnerability Number

V-239961

Group Title

SRG-NET-000148-VPN-000540

Rule Version

CASA-VN-000310

Severity

CAT II

CCI(s)

• CCI-000778 - Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

Configure the VPN Gateway to authenticate all peers before establishing a connection.

ASA1(config)# tunnel-group x.x.x.x type ipsec-l2l
ASA1(config)# tunnel-group x.x.x.x ipsec-attributes
ASA1(config-tunnel-ipsec)# ikev2 remote-authentication pre-shared-key xxxxxxx
ASA1(config-tunnel-ipsec)# ikev2 local-authentication pre-shared-key xxxxxxx
ASA1(config-tunnel-ipsec)# end

Note: The password complexity of pre-shared keys must be in compliance with NIST SP 800-53 control IA-5.

Check Contents

Verify the VPN Gateway authenticate all peers before establishing a connection as shown in the example below.

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****

Note: Authentication can be either pre-shared key or certificate.

If the VPN Gateway does not uniquely identify and authenticate all peers establishing a connection, this is a finding.

Vulnerability Number

V-239961

Documentable

False

Rule Version

CASA-VN-000310

Severity Override Guidance

Verify the VPN Gateway authenticate all peers before establishing a connection as shown in the example below.

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****

Note: Authentication can be either pre-shared key or certificate.

If the VPN Gateway does not uniquely identify and authenticate all peers establishing a connection, this is a finding.

Check Content Reference

M

Target Key

5344