STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA VPN remote access server must be configured to use AES256 or greater encryption for the IPsec security association to protect the confidentiality of remote access sessions.

DISA Rule

SV-239980r916158_rule

Vulnerability Number

V-239980

Group Title

SRG-NET-000525-VPN-002330

Rule Version

CASA-VN-000650

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

10

Fix Recommendation

Configure the ASA to use AES256 or greater encryption algorithm to implement IPsec encryption services as shown in the example below.

ASA2(config)# crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
ASA2(config-ipsec-proposal)# protocol esp encryption aes-256
ASA2(config-ipsec-proposal)# end

Check Contents

Verify all IPsec proposals are set to use the AES256 or greater encryption algorithm as shown in the example below.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp encryption aes-256

If the value of the encryption algorithm for any IPsec proposal is not set to use an AES256 or greater algorithm, this is a finding.

Vulnerability Number

V-239980

Documentable

False

Rule Version

CASA-VN-000650

Severity Override Guidance

Verify all IPsec proposals are set to use the AES256 or greater encryption algorithm as shown in the example below.

crypto ipsec ikev2 ipsec-proposal IPSEC_TRANS
protocol esp encryption aes-256

If the value of the encryption algorithm for any IPsec proposal is not set to use an AES256 or greater algorithm, this is a finding.

Check Content Reference

M

Target Key

5344