The Cisco ASA remote access VPN server must be configured to use TLS 1.2 or higher to protect the confidentiality of remote access connections.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239975	CASA-VN-000550	SV-239975r666331_rule		High

Description

Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.

STIG	Date
Cisco ASA VPN Security Technical Implementation Guide	2024-08-22

Details

Check Text (C-43208r666329_chk)

Verify the TLS ASA is configured to use TLS 1.2 or higher as shown in the example below.

ssl server-version tlsv1.2 dtlsv1.2

Note: ASA supports TLS version 1.2 starting from software version 9.3.1 for secure message transmission for Clientless SSL VPN and AnyConnect VPN.

If the ASA is not configured to use TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission, this is a finding.

Fix Text (F-43167r666330_fix)

Configure the ASA to use TLS 1.2 or higher as shown in the example below.

ASA1(config)# ssl server-version tlsv1.2 dtlsv1.2