[Solved]Task Assess Security Posture Cisco Asa 5520 Firewall Configuration Security Requirements S Q37221183

Your task is to assess the security posture of a Cisco ASA 5520firewall configuration against the security requirements in a STIGviewer. The config file you should use for this assignment can beseen below.   Determine whether this firewallconfiguration is compliant or not compliant (i.e. pass or fail) foreach of these 10 requirements. Also indicate your rationale why youbelieve each is compliant or not compliant:

1) V-15432
2) V-28784
3) V-3085
4) V-3000
5) V-3967
6) V-3014
7) V-14717
8) V-15294
9) V-23747
10) V-14671

: Saved

:

ASA Version 8.2(1)

!

hostname edgeasa

domain-name usf.edu

enable password yXcNfJE4yYvA2tFR encrypted

passwd yXcNfJE4yYvA2tFR encrypted

names

!

interface GigabitEthernet0/0

speed 1000

nameif inside

security-level 100

ip address 10.10.10.75 255.255.0.0

!

interface GigabitEthernet0/1

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

speed 100

duplex full

nameif management

security-level 100

ip address 19.42.11.11 255.255.255.0

management-only

!

interface GigabitEthernet1/0

speed 1000

nameif outside

security-level 0

ip address 192.168.7.80 255.255.255.0

!

interface GigabitEthernet1/1

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/3

shutdown

no nameif

no security-level

no ip address

!

banner motd

banner motd This is a firewall config from a Cisco ASA 5520config file

banner motd meant for educational purposes only – USF CNT3403

banner asdm

banner asdm This is a firewall config from a Cisco ASA 5520config file

banner asdm meant for educational purposes only – USF CNT3403

ftp mode passive

domain-lookup inside

dns server-group DefaultDNS

domain-name usf.edu

access-list permit_in extended deny ip any host100.100.100.2

access-list permit_in extended deny udp any any eq 3544

access-list permit_in extended permit tcp host 20.20.20.5host

100.100.100.9 eq www

access-list permit_in extended permit tcp host 20.20.20.6host

100.100.100.9 eq www

access-list permit_in extended permit tcp host 20.20.20.5host

100.100.100.10 eq https

access-list permit_in extended permit tcp host 20.20.20.6host

100.100.100.10 eq https

access-list permit_in extended deny ip 30.30.30.32255.255.255.240 any

access-list permit_in extended permit tcp any host100.100.100.25 eq smtp

access-list permit_in extended permit tcp any host100.100.100.26 eq smtp

access-list permit_in extended permit tcp host 40.40.40.20host

100.100.100.201 eq https

access-list permit_in extended permit tcp host 40.40.40.21host

100.100.100.201 eq https

access-list permit_in extended permit ip host 50.50.50.15host

100.100.100.249

access-list permit_in extended permit tcp 60.60.60.0255.255.255.0 host

100.100.100.130 range ftp-data ftp

access-list permit_in extended permit tcp 70.70.70.0255.255.255.0

150.150.150.0 255.255.255.0 eq ssh

access-list permit_in extended permit tcp 70.70.70.0255.255.255.0

150.150.150.0 255.255.255.0 range ftp-data ftp

access-list permit_in extended permit tcp 80.80.80.0255.255.255.0 host

100.100.100.130 eq https

access-list permit_in extended permit tcp 90.90.90.0255.255.255.0 host

100.100.100.130 range ftp-data ftp

access-list permit_in extended permit tcp 90.90.90.0255.255.255.0 host

100.100.100.130 eq https

access-list permit_in extended permit tcp host 95.95.95.50host

100.100.100.249 range 44441 44443

access-list permit_in extended permit tcp host 95.95.95.51host

100.100.100.249 eq https

access-list permit_in extended permit tcp host 95.95.95.51host

100.100.100.249 eq 44441

access-list permit_in extended permit tcp any host100.100.100.253 eq

https

pager lines 24

logging enable

logging timestamp

logging buffer-size 65536

logging console critical

logging monitor informational

logging trap errors

logging asdm warnings

logging host inside 10.10.10.60

logging host inside 10.10.10.61

mtu inside 1500

mtu management 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp deny any inside

icmp deny any management

icmp deny any outside

asdm image disk0:/asdm-621.bin

asdm history enable

arp timeout 14400

nat-control

global (outside) 1 interface

nat (inside) 1 access-list permit_in

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface ssh 10.10.10.60 sshnetmask

255.255.255.255

static (inside,outside) tcp interface https 10.10.10.60 httpsnetmask

255.255.255.255

access-group permit_in in interface inside

access-group permit_in in interface outside

route outside 0.0.0.0 0.0.0.0 192.168.7.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00mgcp-pat

0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00sip-disconnect

0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server default protocol tacacs+

aaa-server default (inside) host 180.180.180.10

timeout 5

key *****

aaa-server default (inside) host 180.180.180.11

timeout 5

key *****

aaa authentication serial console LOCAL

aaa authentication telnet console LOCAL

aaa authentication enable console default

aaa authentication ssh console default

aaa authorization command default LOCAL

aaa accounting command privilege 15 default

aaa accounting enable console default

http server enable

http server idle-timeout 5

http server session-timeout 7

http 19.42.11.0 255.255.255.0 management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdowncoldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh scopy enable

ssh timeout 5

ssh version 2

console timeout 10

threat-detection basic-threat

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp authenticate

ntp server 10.10.10.60

ntp server 10.10.10.61

webvpn

username usfadmin password SXXjXB5AFPjkywIj encrypted

username superadmin password abc123 encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect http

inspect snmp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:efa9838bfaf8618d690ebe9780f3cd16

: end

Expert Answer

---

Answer to Your task is to assess the security posture of a Cisco ASA 5520 firewall configuration against the security requirements… . . .