The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239857	CASA-FW-000090	SV-239857r665857_rule		Medium

Description
It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. In accordance with DoD policy, the traffic log must be sent to a central audit server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system should either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the central audit server, action should be taken to synchronize the local log data with the central audit server. If the central audit server uses User Datagram Protocol (UDP) communications instead of a connection oriented protocol such as TCP, a method for detecting a lost connection must be implemented.

Description

It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. In accordance with DoD policy, the traffic log must be sent to a central audit server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system should either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the central audit server, action should be taken to synchronize the local log data with the central audit server. If the central audit server uses User Datagram Protocol (UDP) communications instead of a connection oriented protocol such as TCP, a method for detecting a lost connection must be implemented.

STIG	Date
Cisco ASA Firewall Security Technical Implementation Guide	2021-03-15

Details

Check Text ( C-43090r665855_chk )
Review the ASA configuration and verify that logging to the buffer is enabled and that the queue size has been increased as shown in the example below. logging enable logging buffered informational logging queue 8192 logging host NDM_INTERFACE 10.1.22.2 6/1514 Note: Configuring a value of 0 for the queue size will set it to maximum size for the specific platform. If the ASA is not configured to queue log records locally In the event that the central audit server is down or not reachable, this is a finding.

Check Text ( C-43090r665855_chk )

Review the ASA configuration and verify that logging to the buffer is enabled and that the queue size has been increased as shown in the example below.

logging enable
logging buffered informational
logging queue 8192
logging host NDM_INTERFACE 10.1.22.2 6/1514

Note: Configuring a value of 0 for the queue size will set it to maximum size for the specific platform.

If the ASA is not configured to queue log records locally In the event that the central audit server is down or not reachable, this is a finding.

Fix Text (F-43049r665856_fix)
To continue to allow new connections and queue log records in the event the syslog server is not reachable, configure logging buffered and increase the queue size as shown in the example below. ASA(config)# logging buffered informational ASA(config)# logging queue 8192