|Finding ID||Version||Rule ID||IA Controls||Severity|
|Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.|
|Cisco ASA VPN Security Technical Implementation Guide||2021-08-16|
|Check Text ( C-43208r666329_chk )|
| Verify the TLS ASA is configured to use TLS 1.2 or higher as shown in the example below. |
ssl server-version tlsv1.2 dtlsv1.2
Note: ASA supports TLS version 1.2 starting from software version 9.3.1 for secure message transmission for Clientless SSL VPN and AnyConnect VPN.
If the ASA is not configured to use TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission, this is a finding.
|Fix Text (F-43167r666330_fix)|
| Configure the ASA to use TLS 1.2 or higher as shown in the example below. |
ASA1(config)# ssl server-version tlsv1.2 dtlsv1.2