STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication.

DISA Rule

SV-268314r1015320_rule

Vulnerability Number

V-268314

Group Title

SRG-NET-000345-VPN-002430

Rule Version

CASA-VN-000130

Severity

CAT I

CCI(s)

• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

Weight

10

Fix Recommendation

Configure the ASA to not accept certificates that have been revoked.

Revocation checking using CRL example:

ASA1(config)# crypto ca trustpoint CA_X
ASA1(config-ca-trustpoint)# revocation-check crl
ASA1(config-ca-crl)# end

Revocation checking using OCSP example:

ASA1(config)# crypto ca trustpoint CA_X
ASA1(config-ca-trustpoint)# revocation-check ocsp
ASA1(config-ca-crl)# end

Check Contents

If PKI certificates are not implemented on the ASA, this requirement is not applicable.

Verify the ASA does not accept certificates that have been revoked.

Revocation checking using CRL example:

crypto ca trustpoint CA_X
revocation-check crl

Note: By default, the ASA will use the distribution points listed in CDP extension of the certificate that is being validated.

Revocation checking using OCSP example:

crypto ca trustpoint CA_X
revocation-check ocsp

Note: By default, the ASA will use the OSCP responder address found in the Authority Information Access (AIA) field of the client's certificate. Deployment with CAC would be an exception.

If the ASA accepts certificates that have been revoked, this is a finding.

Vulnerability Number

V-268314

Documentable

False

Rule Version

CASA-VN-000130

Severity Override Guidance

If PKI certificates are not implemented on the ASA, this requirement is not applicable.

Verify the ASA does not accept certificates that have been revoked.

Revocation checking using CRL example:

crypto ca trustpoint CA_X
revocation-check crl

Note: By default, the ASA will use the distribution points listed in CDP extension of the certificate that is being validated.

Revocation checking using OCSP example:

crypto ca trustpoint CA_X
revocation-check ocsp

Note: By default, the ASA will use the OSCP responder address found in the Authority Information Access (AIA) field of the client's certificate. Deployment with CAC would be an exception.

If the ASA accepts certificates that have been revoked, this is a finding.

Check Content Reference

M

Target Key

5344