! PermitANY — Cisco ASA Security Hardening
! CIS-aligned hardening template for Cisco ASA: disable unused services, enforce strong SSH/TLS, enable threat detection, configure logging, and lock down management access.
! Generated: 2026-09-21
! These are EXAMPLE values. Replace with your actual config before deploying.
!
hostname ASA-EDGE-01
!
! ── Disable unused and insecure services ─────────────
no snmp-server enable traps


snmp-server community R3@dOnly! RO
snmp-server host management 10.0.0.100 community R3@dOnly!

!
no service pad
no boot network
!
! ── Disable HTTP/ASDM unless explicitly required ─────

no http server enable

!
! ── SSH hardening ────────────────────────────────────
ssh version 2
ssh 192.168.1.0 255.255.255.0 management
ssh timeout 10
ssh key-exchange group dh-group14-sha1
ssh cipher encryption high
ssh cipher integrity high
!
! ── TLS hardening ────────────────────────────────────
ssl cipher tlsv1.2 high
ssl server-version tlsv1.2
ssl client-version tlsv1.2
!
! ── AAA ──────────────────────────────────────────────
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL
aaa accounting command LOCAL
!
! ── Exec timeout and banners ─────────────────────────
console timeout 5
exec-timeout 10
banner login WARNING: Unauthorized access is prohibited. All sessions are monitored and logged.
banner motd WARNING: Authorized personnel only.
!
! ── Threat detection ─────────────────────────────────
threat-detection basic-threat
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
threat-detection scanning-threat shun
!
! ── Logging ──────────────────────────────────────────
logging enable
logging timestamp
logging host management 10.0.0.200
logging trap informational
logging buffered warnings
logging console critical
!
! ── Disable Telnet ───────────────────────────────────
no telnet timeout 1
!
! ── ICMP hardening ───────────────────────────────────
icmp deny any outside
icmp permit 192.168.1.0 255.255.255.0 management
!
! ── Service password encryption ──────────────────────
service password-encryption
!