CIS Cisco ASA Benchmark

This recommendation verifies that ASA firmware is running the latest stable version on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Verify ASA software version
show version | include Version
show version | include up

! Upgrade ASA to latest stable firmware
! Download from Cisco Software Center
copy tftp://10.0.0.100/asa9-xx-x-smp-k8.bin disk0:/
boot system disk0:/asa9-xx-x-smp-k8.bin
write memory
reload

This recommendation verifies that password encryption is enabled with master passphrase on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Check if password encryption is enabled
show running-config | include password
show running-config | include enable

! Enable password encryption
password encryption aes
enable password <STRONG_PASS> level 15 encrypted
! Ensure master passphrase is set:
key config-key password-encryption <MASTER_KEY>
write memory

This recommendation verifies that AAA authentication is configured for all management access on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Verify AAA authentication
show running-config | include aaa
show aaa-server summary

! Configure AAA authentication
aaa-server RADIUS_SVR protocol radius
aaa-server RADIUS_SVR (mgmt) host 10.0.0.50
 key <SECRET>
aaa authentication ssh console RADIUS_SVR LOCAL
aaa authentication http console RADIUS_SVR LOCAL
aaa authentication enable console RADIUS_SVR LOCAL

This recommendation ensures that local user accounts use minimum required privilege on the Cisco ASA adaptive security appliance. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Cisco ASA adaptive security appliance may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

! Check local user privileges
show running-config | include username
show running-config | include privilege

! Configure local users with minimum privilege
username admin password <STRONG_PASS> encrypted privilege 15
username monitor password <STRONG_PASS> encrypted privilege 5
! Remove default users:
no username cisco

This setting ensures that management access is restricted by source IP on the Cisco ASA adaptive security appliance. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Cisco ASA adaptive security appliance is essential for defense in depth.

! Verify management interface ACL
show running-config | include ssh\|http
show running-config access-list MGMT_ACL

! Restrict management access
ssh 10.0.1.0 255.255.255.0 mgmt
ssh timeout 5
ssh version 2
http 10.0.1.0 255.255.255.0 mgmt
! Deny all other management access:
no ssh 0.0.0.0 0.0.0.0 outside

This recommendation ensures that TLSv1.2 or higher is enforced for management on the Cisco ASA adaptive security appliance. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Cisco ASA adaptive security appliance may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

! Check SSL/TLS settings for management
show running-config ssl
show ssl ciphers

! Harden SSL/TLS for management
ssl server-version tlsv1.2
ssl client-version tlsv1.2
ssl cipher tlsv1.2 custom "AES256-SHA256:AES128-SHA256"
ssl trust-point MGMT_CERT mgmt

This recommendation verifies that comprehensive syslog logging is configured on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Verify logging configuration
show running-config | include logging
show logging

! Configure comprehensive logging
logging enable
logging timestamp
logging buffer-size 1048576
logging buffered informational
logging trap informational
logging host mgmt 10.0.0.60
logging facility 20

This recommendation verifies that NTP is configured with authentication on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Check NTP configuration
show running-config | include ntp
show ntp status

! Configure NTP with authentication
ntp authenticate
ntp authentication-key 1 md5 <NTP_KEY>
ntp trusted-key 1
ntp server 10.0.0.10 key 1 source mgmt prefer

This recommendation verifies that explicit deny-all with logging is configured on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Review access-list configurations
show running-config access-list
show access-list | include hitcnt

! Apply explicit deny-all and log
access-list OUTSIDE_IN extended deny ip any any log
access-group OUTSIDE_IN in interface outside
! Remove overly permissive rules:
no access-list OUTSIDE_IN extended permit ip any any

This recommendation verifies that threat detection and scanning detection are enabled on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Check threat detection settings
show running-config | include threat-detection
show threat-detection statistics

! Enable threat detection
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address 10.0.0.0 255.0.0.0
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

This recommendation verifies that VPN uses IKEv2 with strong cryptographic parameters on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Check VPN configuration
show running-config crypto
show vpn-sessiondb summary

! Harden VPN configuration
crypto ikev2 policy 10
 encryption aes-256
 integrity sha256
 group 14
 prf sha256
 lifetime seconds 86400
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-256

This recommendation verifies that insecure management protocols are disabled on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Check for insecure protocols
show running-config | include telnet\|snmp\|http server

! Disable insecure management protocols
no telnet 0.0.0.0 0.0.0.0 inside
no telnet 0.0.0.0 0.0.0.0 outside
snmp-server host mgmt 10.0.0.60 community <COMMUNITY> version 3
no snmp-server community public

This recommendation verifies that configuration backups are performed regularly on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Verify configuration backups
show running-config | include backup
dir disk0:

! Create and export configuration backup
copy running-config disk0:/backup-$(date).cfg
copy running-config tftp://10.0.0.100/asa-backup.cfg
write memory

This recommendation verifies that login banners are configured on the Cisco ASA adaptive security appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cisco ASA adaptive security appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

! Check banner configuration
show running-config | include banner

! Configure login banners
banner login WARNING: Authorized access only. All activity is monitored.
banner motd WARNING: Unauthorized access is prohibited and will be prosecuted.
banner asdm WARNING: Authorized administrators only.