STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA remote access VPN server must be configured to enforce certificate-based authentication before granting access to the network.

DISA Rule

SV-239968r954210_rule

Vulnerability Number

V-239968

Group Title

SRG-NET-000140-VPN-000500

Rule Version

CASA-VN-000440

Severity

CAT I

CCI(s)

• CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.

Weight

10

Fix Recommendation

Configure the ASA to enforce certificate-based authentication before granting access to the network as shown in the example below.

ASA1(config)# tunnel-group ANY_CONNECT webvpn-attributes
ASA1(config-tunnel-webvpn)# authentication certificate
ASA1(config-tunnel-webvpn)# end

Check Contents

Review the ASA configuration to verify that it enforces certificate-based authentication before granting access to the network as shown in the example below.

tunnel-group ANY_CONNECT type remote-access
tunnel-group ANY_CONNECT webvpn-attributes
authentication certificate

If the ASA configuration does not enforce certificate-based authentication before granting access to the network, this is a finding.

Vulnerability Number

V-239968

Documentable

False

Rule Version

CASA-VN-000440

Severity Override Guidance

Review the ASA configuration to verify that it enforces certificate-based authentication before granting access to the network as shown in the example below.

tunnel-group ANY_CONNECT type remote-access
tunnel-group ANY_CONNECT webvpn-attributes
authentication certificate

If the ASA configuration does not enforce certificate-based authentication before granting access to the network, this is a finding.

Check Content Reference

M

Target Key

5344