OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco ASA remote access VPN server must be configured to use a separate authentication server than that used for administrative access.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-239965CASA-VN-000390SV-239965r666301_ruleCCI-000187medium
Description
The VPN interacts directly with public networks and devices and should not contain user authentication information for all users. AAA network security services provide the primary framework through which a network administrator can set up access control and authorization on network points of entry or network access servers. It is not advisable to configure access control on the VPN gateway or remote access server. Separation of services provides added assurance to the network if the access control server is compromised.
STIGDate
Cisco ASA VPN Security Technical Implementation Guide2024-08-22

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (69) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00

+59 more (top 10 by confidence shown)

CCI1 mapping
CCI-000187
1.00

Details

Check Text (C-239965r666301_chk)

In the example below, radius server at 10.1.1.2 is used for administrative access authentication while the LDAP server will be used for granting remote access to the network. aaa-server LDAP protocol ldap aaa-server LDAP (INSIDE) host 10.1.1.1 … … … aaa-server RADIUS_GROUP protocol radius aaa-server RADIUS_GROUP (INSIDE) host 10.1.1.2 key ***** … … … aaa authentication serial console RADIUS_GROUP LOCAL aaa authentication ssh console RADIUS_GROUP LOCAL If the ASA is not configured to use a separate authentication server than that used for administrative access, this is a finding.

Fix Text (F-43157r666300_fix)

Configure the ASA to use a separate authentication server as shown in the example below. ASA2(config)# aaa-server LDAP protocol ldap ASA2(config)# aaa-server LDAP (INSIDE) host 10.1.1.1