STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access.

DISA Rule

SV-239965r666301_rule

Vulnerability Number

V-239965

Group Title

SRG-NET-000166-VPN-000580

Rule Version

CASA-VN-000390

Severity

CAT II

CCI(s)

CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.

Weight

Fix Recommendation

Configure the ASA to use a separate authentication server as shown in the example below.

ASA2(config)# aaa-server LDAP protocol ldap
ASA2(config)# aaa-server LDAP (INSIDE) host 10.1.1.1

Check Contents

In the example below, radius server at 10.1.1.2 is used for administrative access authentication while the LDAP server will be used for granting remote access to the network.

aaa-server LDAP protocol ldap
aaa-server LDAP (INSIDE) host 10.1.1.1
…
…
…
aaa-server RADIUS_GROUP protocol radius
aaa-server RADIUS_GROUP (INSIDE) host 10.1.1.2
key *****
…
…
…
aaa authentication serial console RADIUS_GROUP LOCAL
aaa authentication ssh console RADIUS_GROUP LOCAL

If the ASA is not configured to use a separate authentication server than that used for administrative access, this is a finding.

The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key