The Cisco ASA remote access VPN server must be configured to generate unique session identifiers using a FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239977	CASA-VN-000610	SV-239977r666337_rule	CCI-001188	medium
Description
Both IPsec and TLS gateways use the RNG to strengthen the security of the protocols. Using a weak RNG will weaken the protocol and make it more vulnerable. Use of a FIPS validated RNG that is not DRGB mitigates to a CAT III.
STIG			Date
Cisco ASA VPN Security Technical Implementation Guide			2024-08-22

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-09.2Unique System-Generated Session Identifiers

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (23) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(4)Automated Audit Actions

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-3Access Enforcement

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-4Information Flow Enforcement

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-6(9)Log Use of Privileged Functions

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-12Audit Record Generation

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-3Content of Audit Records

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(1)Automated Access Enforcement and Audit Records

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(8)Access to Accounts — Replay Resistant

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+13 more (top 10 by confidence shown)

CCI1 mapping

CCI-001188

1.00

DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)

Details

Check Text (C-239977r666337_chk)

Review the ASA configuration to verify that FIPS mode has been enabled as shown in the example below. ASA Version x.x ! hostname ASA1 fips enable If the ASA is not configured to be enabled in FIPS mode, this is a finding.

Fix Text (F-43169r666336_fix)

Configure the ASA to have FIPS-mode enabled as shown in the example below. ASA1(config)# fips enable ASA1(config)# end Note: FIPS mode change will not take effect until the configuration is saved and the device rebooted.