STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA remote access VPN server must be configured to generate unique session identifiers using a FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.

DISA Rule

SV-239977r666337_rule

Vulnerability Number

V-239977

Group Title

SRG-NET-000234-VPN-000810

Rule Version

CASA-VN-000610

Severity

CAT II

CCI(s)

• CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.

Weight

10

Fix Recommendation

Configure the ASA to have FIPS-mode enabled as shown in the example below.

ASA1(config)# fips enable
ASA1(config)# end

Note: FIPS mode change will not take effect until the configuration is saved and the device rebooted.

Check Contents

Review the ASA configuration to verify that FIPS mode has been enabled as shown in the example below.

ASA Version x.x
!
hostname ASA1
fips enable

If the ASA is not configured to be enabled in FIPS mode, this is a finding.

Vulnerability Number

V-239977

Documentable

False

Rule Version

CASA-VN-000610

Severity Override Guidance

Review the ASA configuration to verify that FIPS mode has been enabled as shown in the example below.

ASA Version x.x
!
hostname ASA1
fips enable

If the ASA is not configured to be enabled in FIPS mode, this is a finding.

Check Content Reference

M

Target Key

5344