What changed in Cisco ASA Firewall STIG V2R1V2R1 changes

Cisco ASA Firewall STIG V2R1 (2024-07-24) replaced V1R4 (2023-04-27): 4 checks updated. It has 21 checks, against 21 in V1R4.

V2R1 checklistV1R4 checklist Compare V1R4 and V2R1 in STIG Compare

  • 0 added
  • 0 removed
  • 4 updated

Updated fields: CCIs 4Check text 1

Updated in V2R1 (4)

V-239860CAT IIThe Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.CCIs

CCIs

CCI-001095CCI-001095,CCI-004866

V-239860 in V2R1

V-239865CAT IIThe Cisco ASA must be configured to filter inbound traffic on all external interfaces.CCIs

CCIs

CCI-002403CCI-002403,CCI-004891

V-239865 in V2R1

V-239866CAT IIThe Cisco ASA must be configured to filter outbound traffic on all internal interfaces.CCIs

CCIs

CCI-002403CCI-002403,CCI-004891

V-239866 in V2R1

V-239868CAT IIThe Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel.Check text, CCIs

Check text

Step 1: Verify that an IPsec crypto map has been configured and bound to the outside interface as shown in the example below. crypto ipsec ikev1 transform-set IPSEC_TRANSFORM esp-aes-192 esp-sha-hmac crypto map IPSEC_CRYPTO_MAP 1 match address MANAGEMENT_TRAFFIC crypto map IPSEC_CRYPTO_MAP 1 set peer 10.3.1.1 crypto map IPSEC_CRYPTO_MAP 1 set ikev1 transform-set IPSEC_TRANSFORM crypto map IPSEC_CRYPTO_MAP 1 set security-association lifetime seconds 3600 crypto map IPSEC_CRYPTO_MAP interface OUTSIDE Step 2: Verify the there is a tunnel group configured for the peer defined in the crypto map as shown in the example below. tunnel-group 10.3.1.1 type ipsec-l2l tunnel-group 10.3.1.1 ipsec-attributes ikev1 pre-shared-key ***** Step 3: Verify that an ISAKMP policy for IKE connections has been configured and bound to the outside interface as shown in the example. crypto isakmp identity address crypto ikev1 enable OUTSIDE crypto ikev1 policy 10 authentication pre-share encryption aes-256 hash sha group 5 lifetime 3600 Step 4: Verify that the ACL referenced in the IPsec crypto map includes all applicable management traffic. access-list MANAGEMENT_TRAFFIC extended permit udp any eq snmp 10.2.2.0 255.255.255.0 access-list MANAGEMENT_TRAFFIC extended permit udp any eq 10.2.2.0 255.255.255.0 snmptrap access-list MANAGEMENT_TRAFFIC extended permit udp any eq syslog 10.2.2.0 255.255.255.0 access-list MANAGEMENT_TRAFFIC extended permit tcp any eq ssh 10.2.2.0 255.255.255.0 Note: Exception would be allowed for management traffic to and from managed perimeter devices. If the ASA is not configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel, this is a finding.

CCIs

CCI-002403CCI-002403,CCI-004931

V-239868 in V2R1

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R1 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.