| Checked | Name | Title |
|---|
| ☐ | SV-239945r666241_rule | The Cisco ASA must be configured to generate log records containing information to establish what type of VPN events occurred. |
| ☐ | SV-239946r666244_rule | The Cisco ASA must be configured to generate log records containing information to establish when the events occurred. |
| ☐ | SV-239947r1001254_rule | The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. |
| ☐ | SV-239948r878129_rule | The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events. |
| ☐ | SV-239949r666253_rule | The Cisco ASA must be configured to validate certificates via a trustpoint that identifies a DoD or DoD-approved certificate authority. |
| ☐ | SV-239951r666259_rule | The Cisco ASA must be configured to use Internet Key Exchange (IKE) for all IPsec security associations. |
| ☐ | SV-239952r666262_rule | The Cisco ASA must be configured to use Internet Key Exchange v2 (IKEv2) for all IPsec security associations. |
| ☐ | SV-239953r916122_rule | The Cisco ASA must be configured to use NIST FIPS-validated cryptography for Internet Key Exchange (IKE) Phase 1. |
| ☐ | SV-239954r916233_rule | The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. |
| ☐ | SV-239955r916125_rule | The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes. |
| ☐ | SV-239956r916128_rule | The Cisco ASA must be configured to use a FIPS-validated cryptographic module to implement IPsec encryption services. |
| ☐ | SV-239957r916149_rule | The Cisco ASA must be configured to use a Diffie-Hellman (DH) Group of 16 or greater for Internet Key Exchange (IKE) Phase 1. |
| ☐ | SV-239958r916134_rule | The Cisco ASA must be configured to use FIPS-validated SHA-2 at 384 bits or higher for Internet Key Exchange (IKE) Phase 1. |
| ☐ | SV-239959r1005430_rule | The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2. |
| ☐ | SV-239960r666286_rule | The Cisco ASA VPN gateway must be configured to restrict what traffic is transported via the IPsec tunnel according to flow control policies. |
| ☐ | SV-239961r666289_rule | The Cisco ASA VPN gateway must be configured to identify all peers before establishing a connection. |
| ☐ | SV-239962r878134_rule | The Cisco ASA VPN gateway must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network. |
| ☐ | SV-239963r1015263_rule | The Cisco ASA VPN gateway must be configured to renegotiate the IPsec Security Association after eight hours or less. |
| ☐ | SV-239964r1015264_rule | The Cisco ASA VPN gateway must be configured to renegotiate the IKE security association after 24 hours or less. |
| ☐ | SV-239965r666301_rule | The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access. |
| ☐ | SV-239966r1001252_rule | The Cisco ASA remote access VPN server must be configured to use LDAP over SSL to determine authorization for granting access to the network. |
| ☐ | SV-239967r666307_rule | The Cisco ASA remote access VPN server must be configured to identify and authenticate users before granting access to the network. |
| ☐ | SV-239968r954210_rule | The Cisco ASA remote access VPN server must be configured to enforce certificate-based authentication before granting access to the network. |
| ☐ | SV-239969r929014_rule | The Cisco ASA remote access VPN server must be configured to map the distinguished name (DN) from the client’s certificate to entries in the authentication server to determine authorization to access the network. |
| ☐ | SV-239970r666316_rule | The Cisco ASA remote access VPN server must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the network. |
| ☐ | SV-239971r666319_rule | The Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event. |
| ☐ | SV-239972r666322_rule | The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred. |
| ☐ | SV-239973r666325_rule | The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish the source of the events. |
| ☐ | SV-239974r666328_rule | The Cisco ASA remote access VPN server must be configured to produce log records containing information to establish the outcome of the events. |
| ☐ | SV-239975r666331_rule | The Cisco ASA remote access VPN server must be configured to use TLS 1.2 or higher to protect the confidentiality of remote access connections. |
| ☐ | SV-239976r769253_rule | The Cisco ASA remote access VPN server must be configured to use a FIPS-validated algorithm and hash function to protect the integrity of TLS remote access sessions. |
| ☐ | SV-239977r666337_rule | The Cisco ASA remote access VPN server must be configured to generate unique session identifiers using a FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm. |
| ☐ | SV-239978r916146_rule | The Cisco ASA remote access VPN server must be configured to use SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions. |
| ☐ | SV-239979r987747_rule | The Cisco VPN remote access server must be configured to use AES256 or greater encryption for the Internet Key Exchange (IKE) Phase 1 to protect confidentiality of remote access sessions. |
| ☐ | SV-239980r916158_rule | The Cisco ASA VPN remote access server must be configured to use AES256 or greater encryption for the IPsec security association to protect the confidentiality of remote access sessions. |
| ☐ | SV-239981r856175_rule | The Cisco VPN remote access server must be configured to accept Common Access Card (CAC) credential credentials. |
| ☐ | SV-239982r1005432_rule | The Cisco ASA VPN remote access server must be configured to disable split-tunneling for remote clients. |
| ☐ | SV-239983r666355_rule | The Cisco ASA VPN remote access server must be configured to generate log records when successful and/or unsuccessful VPN connection attempts occur. |
| ☐ | SV-239984r666358_rule | The Cisco ASA VPN remote access server must be configured to validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation. |
| ☐ | SV-239985r878134_rule | The Cisco ASA VPN remote access server must be configured to use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network. |
| ☐ | SV-268314r1015320_rule | The Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication. |
STIGQter: STIG Summary: