OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco ASA must be configured to use a Diffie-Hellman (DH) Group of 16 or greater for Internet Key Exchange (IKE) Phase 1.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-239957CASA-VN-000210SV-239957r916149_ruleCCI-000068high
Description
Use of an approved DH algorithm ensures the IKE (Phase 1) proposal uses FIPS-validated key management techniques and processes in the production, storage, and control of private/secret cryptographic keys. The security of the DH key exchange is based on the difficulty of solving the discrete logarithm from which the key was derived. Hence, the larger the modulus, the more secure the generated key is considered to be.
STIGDate
Cisco ASA VPN Security Technical Implementation Guide2024-08-22

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-14.2Protection of Confidentiality / Integrity Using Encryption
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (33) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
CM-6Configuration Settings
1.00
CM-6(1)Automated Management, Application, and Verification
1.00
CM-7Least Functionality
1.00
CM-7(1)Periodic Review
1.00
IA-2(8)Access to Accounts — Replay Resistant
1.00
IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant
1.00
IA-3Device Identification and Authentication
1.00

+23 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.13
1.00
CCI1 mapping
CCI-000068
1.00

Details

Check Text (C-239957r916149_chk)

Review the ASA configuration to determine if DH Group of 16 or greater has been specified for IKE Phase 1 as shown in the example below. crypto ikev2 policy 1 encryption aes-256 … group 24 If DH Group of 16 or greater has not been specified for IKE Phase 1, this is a finding.

Fix Text (F-43149r916130_fix)

Configure the ASA to use a DH Group of 16 or greater as shown in the example below. ASA1(config)# crypto ikev2 policy 1 ASA1(config-ikev2-policy)# group 24