STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA remote access VPN server must be configured to map the distinguished name (DN) from the client’s certificate to entries in the authentication server to determine authorization to access the network.

DISA Rule

SV-239969r929014_rule

Vulnerability Number

V-239969

Group Title

SRG-NET-000166-VPN-000590

Rule Version

CASA-VN-000450

Severity

CAT II

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.

Weight

10

Fix Recommendation

Configure the ASA to map the DN or UPN from the client’s certificate to entries in the authentication server to determine authorization as shown in the example.

ASA2(config)# tunnel-group ANY_CONNECT general-attributes
ASA2(config-tunnel-general)# authorization-required
ASA2(config-tunnel-general)# authorization-server-group LDAP
ASA2(config-tunnel-general)# username-from-certificate username-from-certificate use-entire-name
ASA2(config-tunnel-general)# end

Check Contents

Review the tunnel group configured for remote access and verify that the DN or UPN from the client’s certificate is used to map to entries in the authentication server to determine authorization as shown in the example below.

tunnel-group ANY_CONNECT type remote-access
tunnel-group ANY_CONNECT general-attributes
authorization-server-group LDAP
authorization-required
username-from-certificate use-entire-name

If the ASA is not configured to map the distinguished name or UPN from the client’s certificate to entries in the authentication server to determine authorization, this is a finding.

Vulnerability Number

V-239969

Documentable

False

Rule Version

CASA-VN-000450

Severity Override Guidance

Review the tunnel group configured for remote access and verify that the DN or UPN from the client’s certificate is used to map to entries in the authentication server to determine authorization as shown in the example below.

tunnel-group ANY_CONNECT type remote-access
tunnel-group ANY_CONNECT general-attributes
authorization-server-group LDAP
authorization-required
username-from-certificate use-entire-name

If the ASA is not configured to map the distinguished name or UPN from the client’s certificate to entries in the authentication server to determine authorization, this is a finding.

Check Content Reference

M

Target Key

5344