CASA-ND-001310 - The Cisco ASA must be configured to use at least two authentication servers to authenticate users prior to granting administrative access - radius group

Information

Centralized management of authentication settings increases the security of remote and non-local access methods. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's network devices can be more readily analyzed for trends and anomalies. The alternative method of defining administrator accounts on each device exposes the device configuration to remote access authentication attacks and system administrators with multiple authenticators for each network device.

Solution

Configure the Cisco ASA to use at least two authentication servers as shown in the following example.

Step 1: Define the authentication group and protocol.

ASA(config)# aaa-server RADIUS_GROUP protocol radius

Step 2: Define the authentication servers.

ASA(config)# aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.10
ASA(config-aaa-server-host)# key bobby
ASA(config-aaa-server-host)# exit
ASA(config)# aaa-server RADIUS_GROUP (NDM_INTERFACE) host 10.1.48.11
ASA(config-aaa-server-host)# key bobby2
ASA(config-aaa-server-host)# exit

Step 3: Use the AAA server for login authentication for both in-band and console access methods.

ASA(config)# aaa authentication serial console RADIUS_GROUP LOCAL
ASA(config)# aaa authentication ssh console RADIUS_GROUP LOCAL
ASA(config)# end

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_ASA_Y24M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6(1), CAT|I, CCI|CCI-000370, Rule-ID|SV-239940r961863_rule, STIG-ID|CASA-ND-001310, Vuln-ID|V-239940

Plugin: Cisco

Control ID: 12eb8c2e665ad2a76f21913302b45a88be7914a4c555627e391827a7aef18750