Validated Product - Juniper Networks Security AppliancesCertificate Date: 23 December 2005 Validation Report Number: CCEVS-VR-05-0138 Product Type: Firewall Conformance Claim: EAL4 PP Identifier: US Government Traffic-Filter Firewall Protection Profile for Low-Risk Environments, Version 1.1 (Archived) PRODUCT DESCRIPTIONThe TOE, which consists of one or more of the following appliances, is identified as Juniper Networks Security Appliances. Each TOE appliance runs ScreenOS 5.0.0r9 and consists of one or more of the following:
The Juniper Networks evaluated products identified above are integrated security appliances that control traffic flow through a network and operate as the central security hub in a network configuration. The appliances integrate stateful packet inspection firewall, virtual private networking (VPN), and traffic management features. All have hardware-accelerated IPSec encryption and very low latency, allowing them to fit into any network. Installing and managing the appliances is accomplished using a command line interface (CLI). Each evaluated model consists of hardware and firmware, and each runs ScreenOS 5.0.0r9 in firmware, a Juniper Networks proprietary operating system. The model differences have no affect on the security functions claimed in the Security Target The TOE generates audit records corresponding to traffic flow, administrator actions, and identification and authentication. The TOE provides interfaces that allow the administrator to review the audit records, including the ability to search and sort the audit records. Additionally, the TOE provides the ability to protect the audit records and limit the loss of records due to storage exhaustion. The TOE enforces an information flow policy that is enforced upon all packets attempting to traverse a Juniper Networks appliance. The policy is configurable by the administrator and is based on the presumed IP source address, destination IP address, protocol, source and destination interface, and service. The TOE has a packet buffer for temporary storage of packet information. All temporary storage is accounted for in that the size of the temporary storage relative to every packet is known, thus ensuring that the TOE does not reuse any previous packet information. Additionally, the TOE provides encryption/decryption capabilities for VPN sessions. Administrators are the only users of the TOE and are forced to be identified and authenticated by the TOE before they are allowed to invoke any administrator commands. Although the TOE includes the console port, the actual console used is not part of the TOE, but is part of the environment. The Security Target includes an assumption that a VT-100 terminal, or any device that can emulate a VT-100 terminal, is required for use as a locally-connected console. Security management is provided through the administrator interface. This interface allows an administrator (when properly identified and authenticated) to configure the Juniper Networks appliance. The security management functions are not available to non-administrator users. The security functions of the TOE are protected in two ways. First, untrusted users do not have a direct interface to these functions; they are limited to sending packets to the device. Second, the administrative interface is a separate interface that is not connected to the network and, therefore, not susceptible to many of the general threats on the network such as packet sniffing or attempts to log into a public administrative interface. The administrative interface allows an administrator (when properly identified and authenticated) to configure the Juniper Networks appliance. The security management functions are not available to non-administrator users. Additionally, the TOE includes a system clock that can only be set and modified by the administrator, providing reliable timestamps for audit information. SECURITY EVALUATION SUMMARYThe evaluation was carried out in accordance with established practices of the Common Criteria Evaluation and Validation Scheme (CCEVS). ENVIRONMENTAL STRENGTHSThe Juniper Networks Security Appliances are commercial network products that provide identification and authentication, information flow control, security management, Protection of the TSF, and audit security functions. The Juniper Networks Security Appliances provide a level of protection that is appropriate for IT environments that require that information flows be controlled and restricted among network nodes where the Juniper Networks Security Appliances components can be appropriately protected from physical attacks.
Vendor: Juniper Networks, Inc. Contact: Mike Kouri Phone: 408-936-8206 CC Testing Lab: SAIC Common Criteria Testing Laboratory |
![[X]](/assets/images/button_close.gif){kind=small}
![[PDF]](http://www.niap-ccevs.org/assets/images/icon_pdf.gif){kind=icon}
