Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, and Cisco 2921 Integrated Services Routers (ISRs)

Transcription

1 Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) Haae vesions: 1905[1][2], 1921[1][2], 1941[1][2], 2901[1][3], 2911[1][4], 2921[1][5], FIPS Kit (CISCO-FIPS- KIT=), Revision -B0[1], ISR: FIPS-SHIELD-1900=[2], FIPS- SHIELD-2901=[3], FIPS-SHIELD-2911=[4] an FIPS- SHIELD-2921=[5] Fimae vesions: 15.1(2)T2A an 15.1(2)T3 FIPS Non-Popietay Secuity Policy Oveall Level 2 (Sections 3 an 10 Level 3) Valiation Vesion 0.12 July 2011

2 Intouction... 3 Refeences... 3 FIPS Submission Package... 3 Moule Desciption... 4 Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs)... 4 Moule Valiation Level... 4 Cyptogaphic Bounay... 6 Cyptogaphic Moule Pots an Intefaces... 6 Roles, Sevices, an Authentication Use Sevices Cyptogaphic Office Sevices Unauthenticate Use Sevices Cyptogaphic Key/CSP Management Cyptogaphic Algoithms Appove Cyptogaphic Algoithms Non-Appove Algoithms Self-Tests Physical Secuity Moule Opacity an Tampe Evience Secue Opeation Initial Setup System Initialization an Configuation IPSec Requiements an Cyptogaphic Algoithms Potocols Remote Access Wieless Sevices Cisco Unifie Boe Element (CUBE) TLS Configuation Relate Documentation Obtaining Documentation Cisco.com Pouct Documentation DVD Oeing Documentation Documentation Feeback Cisco Pouct Secuity Ovevie Repoting Secuity Poblems in Cisco Poucts Obtaining Technical Assistance Cisco Technical Suppot & Documentation Website Submitting a Sevice Request Definitions of Sevice Request Seveity Obtaining Aitional Publications an Infomation Definition List

3 Intouction This is a non-popietay Cyptogaphic Moule Secuity Policy fo the Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) fom Cisco Systems, Inc. (Haae Vesions: 1905[1][2], 1921[1][2], 1941[1][2], 2901[1][3], 2911[1][4], 2921[1][5], FIPS Kit (CISCO-FIPS-KIT=), Revision -B0[1], ISR: FIPS-SHIELD-1900=[2], FIPS-SHIELD-2901=[3], FIPS-SHIELD- 2911=[4] an FIPS-SHIELD-2921=[5]; Fimae Vesions: IOS 15.1(2)T2A an 15.1(2)T3), efee to in this ocument as the moules, outes, o by thei specific moel name. This secuity policy escibes ho moules meet the secuity equiements of FIPS an ho to un the moules in a FIPS moe of opeation. FIPS (Feeal Infomation Pocessing Stanas Publication Secuity Requiements fo Cyptogaphic Moules) etails the U.S. Govenment equiements fo cyptogaphic moules. Moe infomation about the FIPS stana an valiation pogam is available on the NIST ebsite at Refeences This ocument eals only ith opeations an capabilities of the moule in the technical tems of a FIPS cyptogaphic moule secuity policy. Moe infomation is available on the moule fom the folloing souces: The Cisco Systems ebsite ( contains infomation on the full line of poucts fom Cisco Systems. The NIST Cyptogaphic Moule Valiation Pogam ebsite ( contains contact infomation fo anses to technical o sales-elate questions fo the moule. FIPS Submission Package The secuity policy ocument is one ocument in a FIPS Submission Package. In aition to this ocument, the submission package inclues: Veno Evience Finite State Machine Othe suppoting ocumentation as aitional efeences With the exception of this non-popietay secuity policy, the FIPS valiation ocumentation is popietay to Cisco Systems, Inc. an is eleasable only une appopiate non-isclosue ageements. Fo access to these ocuments, please contact Cisco Systems, Inc. See Obtaining Technical Assistance section fo moe infomation. 3

4 Moule Desciption Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) The Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) ae outing platfoms that povies VPN functionality, as ell as, SIP Gateay Signaling Ove TLS Tanspot. The Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) povie connectivity an secuity sevices in a single, secue evice. These outes offe boaban spees an simplifie management to small businesses, an entepise small banch an teleokes. In suppot of the outing capabilities, the Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) povie IPSec, GetVPN (GDOI), an SSL v3.1 connection capabilities fo VPN enable clients connecting though the Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs). The teste platfoms consist of the folloing components: Cisco 1905 ISR Cisco 1921 ISR Cisco 1941 ISR Cisco 2901 ISR Cisco 2911 ISR Cisco 2921 ISR Moule Valiation Level Moel Fimae Cisco 1905 ISR 15.1(2)T2A an 15.1(2)T3 Cisco 1921 ISR 15.1(2)T2A an 15.1(2)T3 Cisco 1941 ISR 15.1(2)T2A an 15.1(2)T3 Cisco 2901 ISR 15.1(2)T2A an 15.1(2)T3 Cisco 2911 ISR 15.1(2)T2A an 15.1(2)T3 Cisco 2921 ISR 15.1(2)T2A an 15.1(2)T3 Table 1: Moule Haae Configuations The folloing table lists the level of valiation fo each aea in the FIPS PUB No. Aea Title Level 1 Cyptogaphic Moule Specification 2 2 Cyptogaphic Moule Pots an Intefaces 2 3 Roles, Sevices, an Authentication 3 4 Finite State Moel 2 5 Physical Secuity 2 4

5 6 Opeational Envionment N/A 7 Cyptogaphic Key management 2 8 Electomagnetic Inteface/Electomagnetic Compatibility 2 9 Self-Tests 2 10 Design Assuance 3 11 Mitigation of Othe Attacks N/A Oveall Oveall moule valiation level 2 Table 2: Moule Valiation Level 5

6 Cyptogaphic Bounay The cyptogaphic bounay fo the Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) is efine as the moules chassis along ith the opacity shiels. Cyptogaphic Moule Pots an Intefaces Each moule povies a numbe of physical an logical intefaces to the evice, an the physical intefaces povie by the moule ae mappe to fou FIPS efine logical intefaces: ata input, ata output, contol input, an status output. The logical intefaces an thei mapping ae escibe in the folloing tables: Physical Intefaces FIPS Logical Intefaces EHWIC Slot Data Input Inteface 10/100/1000 Pots (2) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots Data Output Inteface 10/100/1000 Pots (2) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots Contol Input Inteface 10/100/1000 Pots (2) Console Pot USB Console Pot Auxiliay Pot Reset Button Seial Pot Activity LED Status Output Inteface System LED Compact Flash LED (2) RPS Boost LED Poe LED (2) Console Pot Auxiliay Pot USB Console Pot Seial Pot Poe Plug Poe inteface PoE Pot Table 3: Cisco 1905 ISR Intefaces Physical Intefaces EHWIC Slots (2) 10/100/1000 Pots (2) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (2) 10/100/1000 Pots (2) FIPS Logical Intefaces Data Input Inteface Data Output Inteface 6

7 Physical Intefaces FIPS Logical Intefaces Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (2) Contol Input Inteface 10/100/1000 Pots (2) Console Pot USB Console Pot Auxiliay Pot Reset Button Activity LED Status Output Inteface System LED Compact Flash LED (2) RPS Boost LED Poe LED (2) Console Pot Auxiliay Pot USB Console Pot Poe Plug Poe inteface PoE Pot Table 4: Cisco 1921 ISR Intefaces Physical Intefaces FIPS Logical Intefaces EHWIC Slots (2) Data Input Inteface GigE Pots (2) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (2) Data Output Inteface GigE Pots (2) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (2) Contol Input Inteface GigE Pots (2) Console Pot USB Console Pot Auxiliay Pot Activity LED Status Output Inteface System LED GigE Link LED (1 pe GigE pot) GigE Spee LED (1 pe GigE pot) Compact Flash LED (2) WLAN LED RPS Boost LED Poe LED (2) GigE pots (2) Console Pot Auxiliay Pot USB Console Pot Poe Plug Poe inteface PoE Pot Table 5: Cisco 1941 ISR Intefaces Physical Intefaces FIPS Logical Intefaces 7

8 Physical Intefaces FIPS Logical Intefaces EHWIC Slots (4) Data Input Inteface GigE Pots (2) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (4) Data Output Inteface GigE Pots (2) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (4) Contol Input Inteface GigE Pots (2) Console Pot USB Console Pot Auxiliay Pot Activity LED Status Output Inteface System LED GigE Link LED (1 pe GigE pot) GigE Spee LED (1 pe GigE pot) Compact Flash LED (2) RPS Boost LED Poe LED (2) GigE pots (2) Console Pot Auxiliay Pot USB Console Pot Poe Plug Poe inteface PoE Pot Table 6: Cisco 2901 ISR Intefaces Physical Intefaces EHWIC Slots (4) SM Slot (1) GigE Pots (3) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (4) SM Slot (1) GigE Pots (3) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (4) SM Slot (1) GigE Pots (3) Console Pot USB Console Pot Auxiliay Pot Activity LED System LED GigE Link LED (1 pe GigE pot) GigE Spee LED (1 pe GigE pot) SM LED FIPS Logical Intefaces Data Input Inteface Data Output Inteface Contol Input Inteface Status Output Inteface 8

9 Physical Intefaces FIPS Logical Intefaces Compact Flash LED (2) RPS Boost LED Poe LED (2) GigE pots (3) Console Pot Auxiliay Pot USB Console Pot Poe Plug Poe inteface PoE Pot Table 7: Cisco 2911 ISR Intefaces Physical Intefaces FIPS Logical Intefaces EHWIC Slots (4) Data Input Inteface SM Slot (1) GigE Pots (3) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (4) Data Output Inteface SM Slot (1) GigE Pots (3) Console Pot USB Console Pot Auxiliay Pot EHWIC Slots (4) Contol Input Inteface SM Slot (1) GigE Pots (3) Console Pot USB Console Pot Auxiliay Pot Activity LED Status Output Inteface System LED GigE Link LED (1 pe GigE pot) GigE Spee LED (1 pe GigE pot) SM LED Compact Flash LED (2) RPS Boost LED Poe LED (2) GigE pots (3) Console Pot Auxiliay Pot USB Console Pot Poe Plug Poe inteface PoE Pot Table 8: Cisco 2921 ISR Intefaces NOTE: The 1941 ISR moule inclues thee Antenna Connectos. These connectos ae isable by coveing ith Tampe Evient Labels (TELs) hile opeating in FIPS-moe. NOTE: Each moule inclues to USB pots an to compact flash slots. These pots an slots ae isable by coveing ith TELs hile opeating in FIPS-moe. 9

10 Roles, Sevices, an Authentication Authentication is ientity-base. Each use is authenticate upon initial access to the moule. Thee ae to oles in the oute that opeatos may assume: the Cypto Office ole an the Use ole. The aministato of the oute assumes the Cypto Office ole in oe to configue an maintain the oute using Cypto Office sevices, hile the Uses execise only the basic Use sevices. The moule suppots RADIUS an TACACS+ fo authentication. A complete esciption of all the management an configuation capabilities of the moules can be foun in the IOS vesion 12.4T Configuation Guie Manual an in the online help fo the moules. The Use an Cypto Office passos an all shae secets must each be at least eight (8) chaactes long, incluing at least one lette an at least one numbe chaacte, in length (enfoce poceually). The maximum length of passos is 25 chaactes. See the Secue Opeation section fo moe infomation. If six (6) integes, one (1) special chaacte an one (1) alphabet ae use ithout epetition fo an eight (8) igit PIN, the pobability of anomly guessing the coect sequence is one (1) in 832,000,000. In oe to successfully guess the sequence in one minute oul equie the ability to make ove 13,000,000 guesses pe secon, hich fa excees the opeational capabilities of the moule. Incluing the est of the alphanumeic chaactes astically eceases the os of guessing the coect sequence. Aitionally, hen using RSA base authentication, RSA key pai has moulus size of 1024 bit to 2048 bit, thus poviing beteen 80 bits an 112 bits of stength. Assuming the lo en of that ange, an attacke oul have a 1 in 2 80 chance of anomly obtaining the key, hich is much stonge than the one in a million chance equie by FIPS To excee a one in 100,000 pobability of a successful anom key guess in one minute, an attacke oul have to be capable of appoximately 1.8x10 21 attempts pe minute, hich fa excees the opeational capabilities of the moules to suppot. Use Sevices A Use entes the system by accessing the console/auxiliay pot ith a teminal pogam o SSH v2 session to a LAN pot. The moule pompts the Use fo thei usename/passo combination. If the usename/passo combination is coect, the Use is alloe enty to the moule management functionality. The sevices available to the Use ole consist of the folloing: Status Functions - Vie state of intefaces an potocols, fimae vesion Netok Functions - Connect to othe netok evices an initiate iagnostic netok sevices (i.e., ping, mtace). Teminal Functions - Ajust the teminal session (e.g., lock the teminal, ajust flo contol) Diectoy Sevices - Display iectoy of files kept in memoy Pefom Self-Tests Pefom the FIPS 140 stat-up tests on eman 10

11 VPN functions - Negotiation an encypte ata tanspot via VPN Cyptogaphic Office Sevices A Cypto Office entes the system by accessing the console/auxiliay pot ith a teminal pogam o SSH v2 session to a LAN pot. The Cypto Office authenticates as a Use an then authenticates as the Cypto Office ole. Duing initial configuation of the oute, the Cypto Office passo (the enable passo) is efine. A Cypto Office may assign pemission to access the Cypto Office ole to aitional accounts, theeby ceating aitional Cypto Offices. The Cypto Office ole is esponsible fo the configuation an maintenance of the oute. The Cypto Office sevices consist of the folloing: Configue the moule - Define netok intefaces an settings, ceate comman aliases, set the potocols the oute ill suppot, enable intefaces an netok sevices, set system ate an time, an loa authentication infomation. Define Rules an Filtes - Ceate packet Filtes that ae applie to Use ata steams on each inteface. Each Filte consists of a set of Rules, hich efine a set of packets to pemit o eny base chaacteistics such as potocol ID, aesses, pots, TCP connection establishment, o packet iection. Status Functions - Vie the moule configuation, outing tables, active sessions, use get commans to vie SNMP MIB statistics, health, tempeatue, memoy status, voltage, packet statistics, evie accounting logs, an vie physical inteface status. Manage the moule - Log off uses, shuton o eloa the oute, manually back up oute configuations, vie complete configuations, manage use ights, initiate poe-on self tests on eman an estoe oute configuations. Set Encyption/Bypass - Set up the configuation tables fo IP tunneling. Set keys an algoithms to be use fo each IP ange o allo plaintext packets to be set fom specifie IP aess. Pefom Self-Tests Pefom the FIPS 140 stat-up tests on eman The Cypto Office also has access to all Use sevices. Unauthenticate Use Sevices The sevices fo someone ithout an authoize ole ae to vie the status output fom the moule s LED, pefom bypass sevices an cycle poe. 11

12 Cyptogaphic Key/CSP Management The moule secuely aministes both cyptogaphic keys an othe citical secuity paametes such as passos. The tampe evience seals povie physical potection fo all keys. All keys ae also potecte by the passo-potection on the Cypto Office ole login, an can be zeoize by the Cypto Office. All zeoization consists of oveiting the memoy that stoe the key. Keys ae exchange an entee electonically o via Intenet Key Exchange (IKE)/Goup Domain of Intepetation (GDOI). The moule oes not output keys o key components in plaintext fom. The moule suppots the folloing citical secuity paametes (CSPs): ID Algoithm Size Desciption Stoage Zeoization Metho RNG See X bits This is the see fo X9.31 RNG. This CSP is stoe in DRAM an upate peioically afte the geneation of 400 bytes afte this it is eseee ith oute-eive entopy; hence, it is zeoize peioically. Also, the opeato can tun off the oute to zeoize this CSP. DRAM (plaintext) RNG See Key X bits This is the see key fo the RNG. DRAM (plaintext) Diffie Hellman pivate exponent Diffie Hellman Shae Secet DH bits DH bits/2048- bits The pivate exponent use in Diffie-Hellman (DH) exchange. Zeoize afte DH shae secet has been geneate. Shae secet geneate by the Diffie-Hellman Key exchange Skeyi Keye SHA bits Value eive fom the shae secet ithin IKE exchange. Zeoize hen IKE session is teminate. skeyi_ Keye SHA bits The IKE key eivation key fo non ISAKMP secuity associations. IKE session encypt key IKE session authentication key Tiple-DES/AES 168- bits/256- bits The IKE session encypt key. DRAM (plaintext) DRAM (plaintext) DRAM (plaintext) DRAM (plaintext) DRAM (plaintext) SHA-1 HMAC 160-bits The IKE session authentication key. DRAM (plaintext) ISAKMP peshae Secet At least eight chaacte s IKE RSA Authentication pivate Key RSA bits The key use to geneate IKE skeyi uing peshae-key authentication. no cypto isakmp key comman zeoizes it. This key can have to foms base on hethe the key is elate to the hostname o the IP aess. RSA pivate key fo IKE authentication. Geneate o entee like any RSA key, set as IKE RSA Authentication Key ith the cypto keying o ca tust- NVRAM (plaintext o encypte) NVRAM (plaintext) Automatically evey 400 bytes, o tun off the oute. Tun off the oute Automatically afte shae secet geneate. Automatically afte session is teminate Automatically afte IKE session teminate. Automatically afte IKE session teminate. Automatically afte IKE session teminate. Automatically afte IKE session teminate. # no cypto isakmp key # cypto key zeoize sa" 12

13 IPSec encyption key IPSec authentication key GDOI Key encyption Key (KEK) GDOI Taffic Encyption Key (TEK) GDOI TEK Integity key TLS Seve RSA pivate key TLS pe-maste secet SSL Taffic Keys Configuation encyption key SSH RSA pivate key SSH session key Use passo Enable passo Tiple-DES/AES 168- bits/256- bits point comman. The IPSec encyption key. Zeoize hen IPSec session is teminate. SHA-1 HMAC 160-bits The IPSec authentication key. The zeoization is the same as above. AES (128, 192 an 256 bits) 168- bits/256- bits Tiple-DES/AES 168- bits/256- bits This key is ceate using the GROUPKEY- PULL egistation potocol ith GDOI. It is use potect GDOI ekeying ata. This key is ceate using the GROUPKEY- PULL egistation potocol an upate using the GROUPKEY-PUSH egistation potocol ith GDOI. It is use to encypt ata taffic beteen Get VPN pees HMAC SHA bits This key is ceate using the GROUPKEY- PULL egistation potocol an upate using the GROUPKEY-PUSH egistation potocol ith GDOI. It is use to ensue ata taffic integity beteen Get VPN pees. RSA 1024/153 6/2048 Ientity cetificates fo moule itself an also use in TLS negotiations. This CSP is use fo both SSL VPN an SIP Gateay Signaling Ove TLS Tanspot. Shae Secet 384-bits Shae secet ceate using asymmetic cyptogaphy fom hich ne HTTPS session keys can be ceate. This CSP is use fo both SSL VPN an SIP Gateay Signaling Ove TLS Tanspot. Tiple-DES/AES HMAC SHA-1 keys 160- bits/168- bits/256- bits Geneate using the TLS potocol (X9.31RNG + HMAC-SHA1 + eithe Diffie- Hellman o RSA). This CSP is use fo both SSL VPN an SIP Gateay Signaling Ove TLS Tanspot. AES 256-bits The key use to encypt values of the configuation file. This key is zeoize hen the no key config-key is issue. Note that this comman oes not ecypt the configuation file, so zeoize ith cae. DH 168- bits/256- bits Tiple-DES/AES HMAC SHA-1 keys Shae Secet Shae Secet 160- bits/168- bits/256- bits At least eight chaacte s At least eight Shae secet geneate by the Diffie- Hellman Key exchange This is the SSH session key. It is zeoize hen the SSH session is teminate. The passo of the Use ole. This passo is zeoize by oveiting it ith a ne passo. The plaintext passo of the CO ole. This passo is zeoize by oveiting it ith a DRAM (plaintext) DRAM (plaintext) DRAM (plaintext) DRAM (plaintext) DRAM (plaintext) NVRAM (plaintext o encypte) DRAM (plaintext) DRAM (plaintext) NVRAM (plaintext o encypte) DRAM (plaintext) DRAM (plaintext) NVRAM (plaintext o encypte) NVRAM (plaintext o Automatically hen IPSec session teminate. Automatically hen IPSec session teminate. Automatically hen session teminate. Automatically hen session teminate. Automatically hen session teminate. Automatically hen session teminate. Automatically hen session teminate. Automatically hen session teminate. # no key configkey Automatically afte session is teminate Automatically hen SSH session teminate Oveite ith ne passo Oveite ith ne passo 13

14 chaacte s ne passo. encypte) Enable secet Shae Secet At least eight chaacte s The ciphetext passo of the CO ole. Hoeve, the algoithm use to encypt this passo is not FIPS appove. Theefoe, this passo is consiee plaintext fo FIPS puposes. This passo is zeoize by oveiting it ith a ne passo. NVRAM (plaintext o encypte) Oveite ith ne passo RADIUS secet Shae Secet At least eight chaacte s The RADIUS shae secet. This shae secet is zeoize by executing the no aius-seve key comman. NVRAM (plaintext o encypte), DRAM (plaintext) # no aius-seve key TACACS+ secet Shae Secet At least eight chaacte s The TACACS+ shae secet. This shae secet is zeoize by executing the no tacacs-seve key comman. NVRAM (plaintext o encypte), DRAM (plaintext) # no tacacs-seve key Table 9: CSP Table The sevices accessing the CSPs, the type of access an hich ole accesses the CSPs ae liste belo. Role/Sevice Use Role Status Function Netok Function Teminal Function Diectoy Sevices Pefom Selftests VPN Function CO Role Configue the moule Define Rules CSP RNG See RNG See Key Diffie Hellman pivate exponent Diffie Hellman Shae Secet Skeyi skeyi_ IKE session encypt key IKE session authentication key ISAKMP peshae IKE RSA Authentication pivate Key IPSec encyption key IPSec authentication key GDOI Key encyption Key (KEK) GDOI Taffic Encyption Key (TEK) GDOI TEK Integity Key Configuation encyption key TLS Seve RSA Pivate Key TLS pe-maste Secet SSL Taffic Key SSH RSA Pivate Key SSH session key Use passo Enable passo Enable secet RADIUS secet TACACS+ secet 14

15 15 an Filtes Status Functions Manage the moule Set Encyption/ Bypass Pefom Selftests = ea = ite = elete Table 10: Role CSP Access

16 Cyptogaphic Algoithms Appove Cyptogaphic Algoithms The Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) suppot many iffeent cyptogaphic algoithms. Hoeve, only FIPS appove algoithms may be use hile in the FIPS moe of opeation. The folloing table ientifies the appove algoithms inclue in the Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) fo use in the FIPS moe of opeation. Algoithm IOS Cet. # OCTEON Plus CN5200 Seies Die Acceleato Cet. # AES #1527 #1115 SHS (SHA-1, SHA256 an SHA 512) #1359 #1038 HMAC SHA-1 #891 #627 RNG (ANSI X9.31) #823 N/A Tiple-DES #1010 #812 RSA #743 N/A Table 11: FIPS-Appove Algoithms fo use in FIPS Moe Non-Appove Algoithms The Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) cyptogaphic moule implements the folloing non- Appove algoithms: MD5 DES, HMAC-MD5 RC4 The moules suppot the folloing key establishment schemes: Diffie-Hellman (key establishment methoology povies beteen 80 an 112 bits of encyption stength) RSA key tanspot (key establishment methoology povies beteen 80 an 112 bits of encyption stength) Intenet Key Exchange Key Establishment (IKEv1/IKEv2) Goup Domain of Intepetation (GDOI) 16

17 Self-Tests The moules inclue an aay of self-tests that ae un uing statup an peioically uing opeations to pevent any secue ata fom being elease an to insue all components ae functioning coectly. The moules implement the folloing poe-on self-tests: IOS Knon Anse Tests: AES KAT, SHS KAT, HMAC KAT, Tiple-DES KAT, RNG KAT, RSA KAT OCTEON Plus CN5200 Seies Die Acceleato Knon Anse Tests: AES KAT, HMAC KAT, Tiple-DES KAT Fimae Integity Test (32-bit CRC) The moules pefom all poe-on self-tests automatically at boot. All poe-on selftests must be passe befoe any opeato can pefom cyptogaphic sevices. The poeon self-tests ae pefome afte the cyptogaphic systems ae initialize but pio any othe opeations; this pevents the moule fom passing any ata uing a poe-on selftest failue. In aition, the moules also povie the folloing conitional self-tests: CRNG test fo the FIPS-appove RNG CRNG tests fo the non-appove RNG RSA PWCT Bypass Test 17

18 Physical Secuity This moule is a multi-chip stanalone cyptogaphic moule. The FIPS level 2 physical secuity equiements fo the moules ae met by the use of opacity shiels coveing the font panels of moules to povie the equie opacity an tampe evient seals to povie the equie tampe evience. The tampe evient labels an opacity shiels shall be installe fo the moule to opeate in a FIPS Appove moe of opeation. The folloing sections illustate the physical secuity povie by the moule. Moule Opacity an Tampe Evience All Citical Secuity Paametes ae stoe an potecte ithin each moule's tampe evient enclosue. The Cypto Office is esponsible fo popely placing all tampe evient labels. The secuity labels ecommene fo FIPS compliance ae povie in the FIPS Kit (Pat Numbe CISCO-FIPS-KIT=), Revision -B0. The FIPS kit inclues 15 of the seals, as ell as a ocument etailing the numbe of seals equie pe platfom an placement infomation. Please be aae that the exta tampe evient labels/seals shall be secuely stoe by the Cypto Office. These secuity labels ae vey fagile an cannot be emove ithout clea signs of amage to the labels. The outes also equie that a special opacity shiel be installe ove the sie ai vents in oe to opeate in FIPS-appove moe. The shiel eceases the suface aea of the vent holes, eucing visibility ithin the cyptogaphic bounay to FIPS-appove specifications. These ae obtaine by oeing the appopiate FIPS shiel, as follos: Cisco 1905 ISR: FIPS-SHIELD-1900= Cisco 1921 ISR: FIPS-SHIELD-1900= Cisco 1941 ISR: FIPS-SHIELD-1900= Cisco 2921 ISR: FIPS-SHIELD-2921= Cisco 2911 ISR: FIPS-SHIELD-2911= Cisco 2901 ISR: FIPS-SHIELD-2901= Once the moule has been configue to meet oveall FIPS Level 2 equiements, the moule cannot be accesse ithout signs of tampeing. The Cypto Office shoul inspect the tampe evient labels peioically to veify they ae intact an the seial numbes on the applie tampe evient labels match the ecos in the secuity log. The Tampe evient labels shall be applie as shon in the pictues belo, fo the moule to opeate in FIPS moe. Moule Cisco 1905 ISR 10 Cisco 1921 ISR 10 Numbe of Tampe Seals 18

19 Cisco 1941 ISR 13 Cisco 2901 ISR 13 Cisco 2911 ISR 23 (to FIPS Kits (CISCO-FIPS-KIT=) equie) Cisco 2921 ISR 31 (thee FIPS Kits (CISCO-FIPS-KIT=) equie) Install the opacity plates an apply seialize tampe-evience labels as specifie in the pictues belo: Figue 1: Cisco 1905 ISR Font Figue 2: Cisco 1905 ISR Back 19

20 Figue 3: Cisco 1905 ISR Top Figue 4: Cisco 1905 ISR Bottom 20

21 Figue 5: Cisco 1905 ISR Right Sie Figue 6: Cisco 1905 ISR Left Sie Figue 7: Cisco 1921 ISR Font 21

22 Figue 8: Cisco 1921 ISR Back Figue 9: Cisco 1921 ISR Top 22

23 Figue 10: Cisco 1921 ISR Bottom Figue 11: Cisco 1921 ISR Right Sie 23

24 Figue 12: Cisco 1921 ISR Left Sie Figue 13: Cisco 1941 ISR Font 24

25 Figue 14: Cisco 1941 ISR Back Figue 15: Cisco 1941 ISR Top 25

26 Figue 16: Cisco 1941 ISR Bottom Figue 17: Cisco 1941 ISR Right Sie 26

27 Figue 18: Cisco 1941 ISR Left Sie Figue 19: Cisco 2901 ISR Font 27

28 Figue 20: Cisco 2901 ISR Back Figue 21: Cisco 2901 ISR Top 28

29 Figue 22: Cisco 2901 ISR Bottom Figue 23: Cisco 2901 ISR Right Sie 29

30 Figue 24: Cisco 2901 ISR Left Sie Figue 25: Cisco 2911 ISR Font Figue 26: Cisco 2911 ISR Back 30

31 Figue 27: Cisco 2911 ISR Top Figue 28: Cisco 2911 ISR Bottom 31

32 Figue 29: Cisco 2911 ISR Right Sie Figue 30: Cisco 2911 ISR Left Sie 32

33 Figue 31: Cisco 2921 ISR Font Figue 32: Cisco 2921 ISR Back Figue 33: Cisco 2921 ISR Top 33

34 Figue 34: Cisco 2921 ISR Bottom Figue 35: Cisco 2921 ISR Right Sie 34

35 Figue 36: Cisco 2921 ISR Left Sie 35

36 Secue Opeation The Cisco 1905, Cisco 1921, Cisco 1941, Cisco 2901, Cisco 2911, an Cisco 2921 Integate Sevices Routes (ISRs) meet all the oveall Level 2 equiements fo FIPS Follo the setting instuctions povie belo to place the moule in FIPSappove moe. Opeating this oute ithout maintaining the folloing settings ill emove the moule fom the FIPS appove moe of opeation. Initial Setup 1. The Cypto Office must install the FIPS opacity shiels as escibe in this ocument. 2. The Cypto Office must apply tampe evience labels as escibe in this ocument. 3. The Cypto Office must isable IOS Passo Recovey by executing the folloing commans: configue teminal no sevice passo-ecovey en sho vesion NOTE: Once Passo Recovey is isable, aministative access to the moule ithout the passo ill not be possible. System Initialization an Configuation 1. The value of the boot fiel must be 0x0102. This setting isables beak fom the console to the ROM monito an automatically boots. Fom the configue teminal comman line, the Cypto Office entes the folloing syntax: config-egiste 0x The Cypto Office must ceate the enable passo fo the Cypto Office ole. Poceually, the passo must be at least 8 chaactes, incluing at least one lette an at least one numbe, an is entee hen the Cypto Office fist engages the enable comman. The Cypto Office entes the folloing syntax at the # pompt: enable secet [PASSWORD] 3. The Cypto Office must alays assign passos (of at least 8 chaactes, incluing at least one lette an at least one numbe) to uses. Ientification an authentication on the console/auxiliay pot is equie 36

37 fo Uses. Fom the configue teminal comman line, the Cypto Office entes the folloing syntax: line con 0 passo [PASSWORD] login local 4. The Cypto Office may configue the moule to use RADIUS o TACACS+ fo authentication. Configuing the moule to use RADIUS o TACACS+ fo authentication is optional. If the moule is configue to use RADIUS o TACACS+, the Cypto-Office must efine RADIUS o TACACS+ shae secet keys that ae at least 8 chaactes long, incluing at least one lette an at least one numbe. 5. Fimae upate is not alloe in FIPS moe. IPSec Requiements an Cyptogaphic Algoithms 1. The only types of IPSec key management that ae alloe in FIPS moe is Intenet Key Exchange (IKE) an Goup Domain of Intepetation (GDOI). 2. Although the IOS implementation of IKE allos a numbe of algoithms, only the folloing algoithms ae alloe in a FIPS configuation: ah-sha-hmac esp-sha-hmac esp-3es esp-aes esp-aes-192 esp-aes The folloing algoithms shall not be use: MD-5 fo signing MD-5 HMAC DES Potocols 1. SNMP v3 ove a secue IPSec tunnel may be employe fo authenticate, secue SNMP gets an sets. Since SNMP v2c uses community stings fo authentication, only gets ae alloe une SNMP v2c. 37

38 Remote Access 1. SSH access to the moule is alloe in FIPS appove moe of opeation, using SSH v2 an a FIPS appove algoithm. 2. Telnet access to the moule is only alloe via a secue IPSec tunnel beteen the emote system an the moule. The Cypto office must configue the moule so that any emote connections via telnet ae secue though IPSec, using FIPS-appove algoithms. Note that all uses must still authenticate afte emote access is gante. 3. HTTPS/TLS management is not alloe in FIPS moe Wieless Sevices 1. Wieless communication ith the moule is alloe not in FIPS appove moe of opeation. 2. Be efault, the aio intefaces fo the moule ae isable. These intefaces shoul not be enable. Cisco Unifie Boe Element (CUBE) TLS Configuation 1. When configuing CUBE TLS connections, the folloing configuation comman option must be execute to limit the TLS session options to FIPS-appove algoithms. cypto signaling [stict-ciphe] 38

39 Relate Documentation This ocument eals only ith opeations an capabilities of the secuity appliances in the technical tems of a FIPS cyptogaphic evice secuity policy. Moe infomation is available on the secuity appliances fom the souces liste in this section an fom the folloing souce: The NIST Cyptogaphic Moule Valiation Pogam ebsite ( contains contact infomation fo anses to technical o sales-elate questions fo the secuity appliances. Obtaining Documentation Cisco ocumentation an aitional liteatue ae available on Cisco.com. Cisco also povies seveal ays to obtain technical assistance an othe technical esouces. These sections explain ho to obtain technical infomation fom Cisco Systems. Cisco.com You can access the most cuent Cisco ocumentation at this URL: You can access the Cisco ebsite at this URL: You can access intenational Cisco ebsites at this URL: Pouct Documentation DVD Cisco ocumentation an aitional liteatue ae available in the Pouct Documentation DVD package, hich may have shippe ith you pouct. The Pouct Documentation DVD is upate egulaly an may be moe cuent than pinte ocumentation. The Pouct Documentation DVD is a compehensive libay of technical pouct ocumentation on potable meia. The DVD enables you to access multiple vesions of haae an softae installation, configuation, an comman guies fo Cisco poucts an to vie technical ocumentation in HTML. With the DVD, you have access to the same ocumentation that is foun on the Cisco ebsite ithout being connecte to the Intenet. Cetain poucts also have.pf vesions of the ocumentation available. The Pouct Documentation DVD is available as a single unit o as a subsciption. Registee Cisco.com uses (Cisco iect customes) can oe a Pouct Documentation DVD (pouct numbe DOC-DOCDVD=) fom Cisco Maketplace at this URL: 39

40 Oeing Documentation Beginning June 30, 2005, egistee Cisco.com uses may oe Cisco ocumentation at the Pouct Documentation Stoe in the Cisco Maketplace at this URL: Nonegistee Cisco.com uses can oe technical ocumentation fom 8:00 a.m. to 5:00 p.m. (0800 to 1700) PDT by calling in the Unite States an Canaa, o elsehee by calling You can also oe ocumentation by at tech-oc-stoe-mkpl@extenal.cisco.com o by fax at in the Unite States an Canaa, o elsehee at Documentation Feeback You can ate an povie feeback about Cisco technical ocuments by completing the online feeback fom that appeas ith the technical ocuments on Cisco.com. You can sen comments about Cisco ocumentation to bug-oc@cisco.com. You can submit comments by using the esponse ca (if pesent) behin the font cove of you ocument o by iting to the folloing aess: Cisco Systems Attn: Custome Document Oeing 170 West Tasman Dive San Jose, CA We appeciate you comments. Cisco Pouct Secuity Ovevie Cisco povies a fee online Secuity Vulneability Policy potal at this URL: Fom this site, you can pefom these tasks: Repot secuity vulneabilities in Cisco poucts. Obtain assistance ith secuity incients that involve Cisco poucts. Registe to eceive secuity infomation fom Cisco. A cuent list of secuity avisoies an notices fo Cisco poucts is available at this URL: If you pefe to see avisoies an notices as they ae upate in eal time, you can access a Pouct Secuity Incient Response Team Really Simple Synication (PSIRT RSS) fee fom this URL: 40

41 Repoting Secuity Poblems in Cisco Poucts Cisco is committe to eliveing secue poucts. We test ou poucts intenally befoe e elease them, an e stive to coect all vulneabilities quickly. If you think that you might have ientifie a vulneability in a Cisco pouct, contact PSIRT: Emegencies secuity-alet@cisco.com An emegency is eithe a conition in hich a system is une active attack o a conition fo hich a sevee an ugent secuity vulneability shoul be epote. All othe conitions ae consiee nonemegencies. Nonemegencies psit@cisco.com In an emegency, you can also each PSIRT by telephone: Tip We encouage you to use Petty Goo Pivacy (PGP) o a compatible pouct to encypt any sensitive infomation that you sen to Cisco. PSIRT can ok fom encypte infomation that is compatible ith PGP vesions 2.x though 8.x. Neve use a evoke o an expie encyption key. The coect public key to use in you coesponence ith PSIRT is the one linke in the Contact Summay section of the Secuity Vulneability Policy page at this URL: The link on this page has the cuent PGP key ID in use. Obtaining Technical Assistance Cisco Technical Suppot povies 24-hou-a-ay aa-inning technical assistance. The Cisco Technical Suppot & Documentation ebsite on Cisco.com featues extensive online suppot esouces. In aition, if you have a vali Cisco sevice contact, Cisco Technical Assistance Cente (TAC) enginees povie telephone suppot. If you o not have a vali Cisco sevice contact, contact you eselle. Cisco Technical Suppot & Documentation Website The Cisco Technical Suppot & Documentation ebsite povies online ocuments an tools fo toubleshooting an esolving technical issues ith Cisco poucts an technologies. The ebsite is available 24 hous a ay, at this URL: Access to all tools on the Cisco Technical Suppot & Documentation ebsite equies a Cisco.com use ID an passo. If you have a vali sevice contact but o not have a use ID o passo, you can egiste at this URL: Note 41

42 Use the Cisco Pouct Ientification (CPI) tool to locate you pouct seial numbe befoe submitting a eb o phone equest fo sevice. You can access the CPI tool fom the Cisco Technical Suppot & Documentation ebsite by clicking the Tools & Resouces link une Documentation & Tools. Choose Cisco Pouct Ientification Tool fom the Alphabetical Inex op-on list, o click the Cisco Pouct Ientification Tool link une Alets & RMAs. The CPI tool offes thee seach options: by pouct ID o moel name; by tee vie; o fo cetain poucts, by copying an pasting sho comman output. Seach esults sho an illustation of you pouct ith the seial numbe label location highlighte. Locate the seial numbe label on you pouct an eco the infomation befoe placing a sevice call. Submitting a Sevice Request Using the online TAC Sevice Request Tool is the fastest ay to open S3 an S4 sevice equests. (S3 an S4 sevice equests ae those in hich you netok is minimally impaie o fo hich you equie pouct infomation.) Afte you escibe you situation, the TAC Sevice Request Tool povies ecommene solutions. If you issue is not esolve using the ecommene esouces, you sevice equest is assigne to a Cisco enginee. The TAC Sevice Request Tool is locate at this URL: Fo S1 o S2 sevice equests o if you o not have Intenet access, contact the Cisco TAC by telephone. (S1 o S2 sevice equests ae those in hich you pouction netok is on o seveely egae.) Cisco enginees ae assigne immeiately to S1 an S2 sevice equests to help keep you business opeations unning smoothly. To open a sevice equest by telephone, use one of the folloing numbes: Asia-Pacific: (Austalia: )EMEA: USA: Fo a complete list of Cisco TAC contacts, go to this URL: Definitions of Sevice Request Seveity To ensue that all sevice equests ae epote in a stana fomat, Cisco has establishe seveity efinitions. Seveity 1 (S1) You netok is on, o thee is a citical impact to you business opeations. You an Cisco ill commit all necessay esouces aoun the clock to esolve the situation. Seveity 2 (S2) Opeation of an existing netok is seveely egae, o significant aspects of you business opeation ae negatively affecte by inaequate pefomance of Cisco poucts. You an Cisco ill commit full-time esouces uing nomal business hous to esolve the situation. Seveity 3 (S3) Opeational pefomance of you netok is impaie, but most business opeations emain functional. You an Cisco ill commit esouces uing nomal business hous to estoe sevice to satisfactoy levels. 42

43 Seveity 4 (S4) You equie infomation o assistance ith Cisco pouct capabilities, installation, o configuation. Thee is little o no effect on you business opeations. Obtaining Aitional Publications an Infomation Infomation about Cisco poucts, technologies, an netok solutions is available fom vaious online an pinte souces. Cisco Maketplace povies a vaiety of Cisco books, efeence guies, ocumentation, an logo mechanise. Visit Cisco Maketplace, the company stoe, at this URL: Cisco Pess publishes a ie ange of geneal netoking, taining an cetification titles. Both ne an expeience uses ill benefit fom these publications. Fo cuent Cisco Pess titles an othe infomation, go to Cisco Pess at this URL: Packet magazine is the Cisco Systems technical use magazine fo maximizing Intenet an netoking investments. Each quate, Packet elives coveage of the latest inusty tens, technology beakthoughs, an Cisco poucts an solutions, as ell as netok eployment an toubleshooting tips, configuation examples, custome case stuies, cetification an taining infomation, an links to scoes of in-epth online esouces. You can access Packet magazine at this URL: iq Magazine is the quately publication fom Cisco Systems esigne to help going companies lean ho they can use technology to incease evenue, steamline thei business, an expan sevices. The publication ientifies the challenges facing these companies an the technologies to help solve them, using eal-ol case stuies an business stategies to help eaes make soun technology investment ecisions. You can access iq Magazine at this URL: o vie the igital eition at this URL: Intenet Potocol Jounal is a quately jounal publishe by Cisco Systems fo engineeing pofessionals involve in esigning, eveloping, an opeating public an pivate intenets an intanets. You can access the Intenet Potocol Jounal at this URL: Netoking poucts offee by Cisco Systems, as ell as custome suppot sevices, can be obtaine at this URL: 43

44 Netoking Pofessionals Connection is an inteactive ebsite fo netoking pofessionals to shae questions, suggestions, an infomation about netoking poucts an technologies ith Cisco expets an othe netoking pofessionals. Join a iscussion at this URL: Wol-class netoking taining is available fom Cisco. You can vie cuent offeings at this URL: Definition List AES Avance Encyption Stana CMVP Cyptogaphic Moule Valiation Pogam CSEC Communications Secuity Establishment Canaa CSP Citical Secuity Paamete FIPS Feeal Infomation Pocessing Stana HMAC Hash Message Authentication Coe HTTP Hype Text Tansfe Potocol KAT Knon Anse Test LED Light Emitting Dioe MAC Message Authentication Coe NIST National Institute of Stanas an Technology NVRAM Non-Volatile Ranom Access Memoy RAM Ranom Access Memoy RNG Ranom Numbe Geneato RSA Rivest Shami an Aleman metho fo asymmetic encyption SHA Secue Hash Algoithm TDES Tiple Data Encyption Stana 44