STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco VPN remote access server must be configured to use AES256 or greater encryption for the Internet Key Exchange (IKE) Phase 1 to protect confidentiality of remote access sessions.

DISA Rule

SV-239979r987747_rule

Vulnerability Number

V-239979

Group Title

SRG-NET-000317-VPN-001090

Rule Version

CASA-VN-000640

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

10

Fix Recommendation

Configure the ASA to use AES256 or greater encryption algorithm for IKE Phase 1 as shown in the example below.

ASA1(config)# crypto ikev2 policy 1
ASA1(config-ikev2-policy)# encryption aes-256

Check Contents

Verify IKE Phase 1 is set to use an AES256 or greater encryption algorithm as shown in the example below.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp encryption aes-256

If the value of the encryption algorithm for IKE Phase 1 is not set to use an AES256 or greater algorithm, this is a finding.

Vulnerability Number

V-239979

Documentable

False

Rule Version

CASA-VN-000640

Severity Override Guidance

Verify IKE Phase 1 is set to use an AES256 or greater encryption algorithm as shown in the example below.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp encryption aes-256

If the value of the encryption algorithm for IKE Phase 1 is not set to use an AES256 or greater algorithm, this is a finding.

Check Content Reference

M

Target Key

5344