STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network.

DISA Rule

SV-239966r1001252_rule

Vulnerability Number

V-239966

Group Title

SRG-NET-000320-VPN-001120

Rule Version

CASA-VN-000400

Severity

CAT II

CCI(s)

• CCI-002353 - Transmit organization-defined access authorization information using organization-defined controls to organization-defined systems that enforce access control decisions.

Weight

10

Fix Recommendation

Step 1: Configure the ASA to use LDAP over SSL as shown in the example below.

ASA2(config)# aaa-server LDAP protocol ldap
ASA2(config)# aaa-server LDAP (INSIDE) host 10.1.1.1
ASA2(config-aaa-server-host)# ldap-over-ssl enable
ASA2(config-aaa-server-host)# exit

Step 2: Configure the ASA to enforce authorization using the common name (CN) from the user’s certificate.

ASA2(config)# tunnel-group ANY_CONNECT general-attributes
ASA2(config-tunnel-general)# authorization-required
ASA2(config-tunnel-general)# authorization-server-group LDAP
ASA2(config-tunnel-general)# end

Check Contents

Step 1: Verify that authorization is enforced as shown in the example below.

tunnel-group ANY_CONNECT type remote-access
tunnel-group ANY_CONNECT general-attributes
authorization-server-group LDAP
authorization-required

Step 2: Verify that LDAP over SSL has been enabled.

aaa-server LDAP protocol ldap
aaa-server LDAP (INSIDE) host 10.1.1.1
ldap-over-ssl enable

If the ASA is not configured to use LDAP over SSL to determine authorization for granting access to the network, this is a finding.

Vulnerability Number

V-239966

Documentable

False

Rule Version

CASA-VN-000400

Severity Override Guidance

Step 1: Verify that authorization is enforced as shown in the example below.

tunnel-group ANY_CONNECT type remote-access
tunnel-group ANY_CONNECT general-attributes
authorization-server-group LDAP
authorization-required

Step 2: Verify that LDAP over SSL has been enabled.

aaa-server LDAP protocol ldap
aaa-server LDAP (INSIDE) host 10.1.1.1
ldap-over-ssl enable

If the ASA is not configured to use LDAP over SSL to determine authorization for granting access to the network, this is a finding.

Check Content Reference

M

Target Key

5344