STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA remote access VPN server must be configured to use SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions.

DISA Rule

SV-239978r916146_rule

Vulnerability Number

V-239978

Group Title

SRG-NET-000063-VPN-000220

Rule Version

CASA-VN-000630

Severity

CAT II

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Configure the ASA to use SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions as shown in the example below.

ASA1(config)# crypto ikev2 policy 1
ASA1(config-ikev2-policy)# integrity sha384
ASA1(config-ikev2-policy)# exit
ASA1(config)# crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
ASA1(config-ipsec-proposal)# protocol esp integrity sha-384
ASA1(config-ikev2-policy)# end

Check Contents

Verify that the ASA uses SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions as shown in the example below.

Step 1: Verify that SHA-2 at 384 bits or greater is used for IKE Phase 1 as shown in the example below.

crypto ikev2 policy 1
…
…
…
integrity sha384

Step 2: Verify that SHA-2 at 384 bits or greater is used for the IPsec Security Association.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp integrity sha-384

If the ASA does not use SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions, this is a finding.

Vulnerability Number

V-239978

Documentable

False

Rule Version

CASA-VN-000630

Severity Override Guidance

Verify that the ASA uses SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions as shown in the example below.

Step 1: Verify that SHA-2 at 384 bits or greater is used for IKE Phase 1 as shown in the example below.

crypto ikev2 policy 1
…
…
…
integrity sha384

Step 2: Verify that SHA-2 at 384 bits or greater is used for the IPsec Security Association.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp integrity sha-384

If the ASA does not use SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions, this is a finding.

Check Content Reference

M

Target Key

5344