The Cisco ASA remote access VPN server must be configured to use TLS 1.2 or higher to protect the confidentiality of remote access connections.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-239975	SRG-NET-000062-VPN-000200	CASA-VN-000550	SV-239975r666331_rule	2024-08-22	2

Description
Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.

ℹ️ Check
Verify the TLS ASA is configured to use TLS 1.2 or higher as shown in the example below. ssl server-version tlsv1.2 dtlsv1.2 Note: ASA supports TLS version 1.2 starting from software version 9.3.1 for secure message transmission for Clientless SSL VPN and AnyConnect VPN. If the ASA is not configured to use TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission, this is a finding.

ℹ️ Check

Verify the TLS ASA is configured to use TLS 1.2 or higher as shown in the example below. ssl server-version tlsv1.2 dtlsv1.2 Note: ASA supports TLS version 1.2 starting from software version 9.3.1 for secure message transmission for Clientless SSL VPN and AnyConnect VPN. If the ASA is not configured to use TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission, this is a finding.

✔️ Fix
Configure the ASA to use TLS 1.2 or higher as shown in the example below. ASA1(config)# ssl server-version tlsv1.2 dtlsv1.2