STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network.

DISA Rule

SV-239962r878134_rule

Vulnerability Number

V-239962

Group Title

SRG-NET-000565-VPN-002400

Rule Version

CASA-VN-000340

Severity

CAT I

CCI(s)

• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

Configure the VPN gateway to use cryptography that is compliant with CSNA/CNSSP-15 parameters when transporting classified traffic across an unclassified network as shown in the example below.

Step 1: Configure the IKE Phase 1.

ASA2(config)# crypto ikev2 policy 2
ASA2(config-ikev2-policy)# encryption aes-256
ASA2(config-ikev2-policy)# integrity null
ASA2(config-ikev2-policy)# group 20
ASA2(config-ikev2-policy)# prf sha384
ASA2(config-ikev2-policy)# exit

Step 2: Configure the IPsec proposal for AES 256 and apply to a crypto map as shown in the example below.

ASA2(config-ipsec-proposal)# protocol esp encryption aes-256
ASA2(config-ipsec-proposal)# exit
ASA2(config)# crypto map CSNA_MAP 10 set ikev2 ipsec-proposal AES-256
ASA2(config)# end

Check Contents

Verify the VPN gateway is configured to use cryptography that is compliant with CSNA/CNSSP when transporting classified traffic across an unclassified network.

Step 1: Verify CSNA/CNSSP-15 parameters have been configured for IKE Phase 1 as shown in the example below.

crypto ikev2 policy 2
encryption aes-256
integrity null
group 19
prf sha384

Step 2: Determine the crypto map for IKE Phase 2 used in compliance with CSNA/CNSSP-15.

crypto map CSNA_MAP 10 set ikev2 ipsec-proposal aes-256

Step 3: Verify the proposal specifies AES 256 parameters.

crypto ipsec ikev2 ipsec-proposal AES-256
protocol esp encryption aes-256

If the VPN gateway is not configured to use cryptography that is compliant with CSNA/CNSSP-15 parameters when transporting classified traffic across an unclassified network, this is a finding.

Vulnerability Number

V-239962

Documentable

False

Rule Version

CASA-VN-000340

Severity Override Guidance

Verify the VPN gateway is configured to use cryptography that is compliant with CSNA/CNSSP when transporting classified traffic across an unclassified network.

Step 1: Verify CSNA/CNSSP-15 parameters have been configured for IKE Phase 1 as shown in the example below.

crypto ikev2 policy 2
encryption aes-256
integrity null
group 19
prf sha384

Step 2: Determine the crypto map for IKE Phase 2 used in compliance with CSNA/CNSSP-15.

crypto map CSNA_MAP 10 set ikev2 ipsec-proposal aes-256

Step 3: Verify the proposal specifies AES 256 parameters.

crypto ipsec ikev2 ipsec-proposal AES-256
protocol esp encryption aes-256

If the VPN gateway is not configured to use cryptography that is compliant with CSNA/CNSSP-15 parameters when transporting classified traffic across an unclassified network, this is a finding.

Check Content Reference

M

Target Key

5344