STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA remote access VPN server must be configured to identify and authenticate users before granting access to the network.

DISA Rule

SV-239967r666307_rule

Vulnerability Number

V-239967

Group Title

SRG-NET-000138-VPN-000490

Rule Version

CASA-VN-000410

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Configure the ASA to uniquely identify and authenticate users before granting access to the network.

ASA1(config)# tunnel-group ANY_CONNECT webvpn-attributes
ASA1(config-tunnel-webvpn)# authentication certificate
ASA1(config-tunnel-webvpn)# end

Check Contents

Verify the ASA is configured to uniquely identify and authenticate users before granting access to the network as shown in the example below.

tunnel-group ANY_CONNECT type remote-access
tunnel-group ANY_CONNECT webvpn-attributes
authentication certificate

If the ASA is not configured to identify and authenticate users before granting access to the network, this is a finding.

Vulnerability Number

V-239967

Documentable

False

Rule Version

CASA-VN-000410

Severity Override Guidance

Verify the ASA is configured to uniquely identify and authenticate users before granting access to the network as shown in the example below.

tunnel-group ANY_CONNECT type remote-access
tunnel-group ANY_CONNECT webvpn-attributes
authentication certificate

If the ASA is not configured to identify and authenticate users before granting access to the network, this is a finding.

Check Content Reference

M

Target Key

5344