PRODUCT DESCRIPTION

The evaluated product is a deployment of one or more distributed firewall/VPN appliances with centralized management servers. The hardware appliances, marketed by Alcatel-Lucent as the “Brick” family of appliances, are bridging devices with traffic-filter firewall functionality, application filters, and IPSec VPN functionality for both LAN-to-LAN tunnels and termination of remote-client tunnels.

The Firewall Appliance (FA) controls the flow of IP packets based on security policy rules. These policy rules are created by the Administrator using the Security Management Server (SMS) Navigator, SMS CLI or SMS Remote Navigator. When firewall updates are made via the Navigator interface, the SMS compiles and pushes the ruleset to each FA to which the updates are relevant. The FA passively listens on all its ports in promiscuous mode, and can operate in either bridge or router mode. The following application filters are available in the evaluated configuration: FTP, HTTP, H.323 VoIP, H.323 RAS, DHCP Relay, TFTP, Oracle SQL*Net, Microsoft NetBIOS, SUN RPC, DNS, SMTP, and SIP services. The VPN functionality provides the ability to require IPSec VPN tunneling for site-to-site and remote-access information flows.

The Security Management Server software package runs on either Microsoft Windows or Sun Solaris (the operating systems are outside the TOE boundary). An Administrator can log into the SMS software package remotely using the SMS Remote Navigator client, which is installed on a Windows host.

The SMS software package supports the management of the other ALVF security features notably, auditing features (reports, alarms and logs), secure communications and Administrator accounts. The SMS software package includes the SMS Application, the SMS Navigator, the SMS Command Line Interface, Utilities and the database. All those components are installed to each SMS server, all components except the database are present on the SCS, and the only component on the Remote Navigator is the Navigator application.

The features of the product that are excluded from use in the evaluated configuration include the proxy features of the firewall appliance including application user authentication functionality. The full list of excluded functionality is provided in the Security Target as well as in the Validation Report.

EVALUATED CONFIGURATION

The evaluated deployment consists of three distinct components, deployed in accordance with the supplemental installation guidance for the Common Criteria evaluated configuration:

• The Alcatel-Lucent VPN/Firewall Appliance (FA), which controls the flow of Internet Protocol (IP) traffic between network interfaces. The FA is also referred to as the Brick. This component includes the hardware, operating system, and firewall application code for the Brick.
• The Security Management Server (SMS) software package, enabling Administrators to manage the security of one or more Firewall Appliances (FA).   The SMS software package, installed as an SMS running on the host, are jointly called the SMS (or SMS host) as a general term for both components together as a workstation.   The SMS software package, installed as a compute server (SCS) running on the host, are jointly called the SCS host. (An SCS provides most of the same functionality as the SMS but does not have its own database. Deploying an SCS is optional.)
• The Security Management Server (SMS) Remote Navigator is a Graphical User Interface client, enabling Administrators to manage the security of one or more Firewall Appliances by remotely accessing the primary SMS software package.

SECURITY EVALUATION SUMMARY

The evaluation of the Alcatel-Lucent VPN Firewall v9.1.329 was performed by the Arca Common Criteria Testing Laboratory (CCTL) in the United States and was completed during March 2009.    The evaluation team determined the product conforms to Common Criteria Version 3.1 Revision 2, Part 2 extended and Part 3 conformant, and meets the requirements for Evaluation Assurance Level (EAL) 4 augmented by ALC_FLR.1.

For this evaluation, it was appropriate for the Security Target to claim compliance with the external standard for AES, TDES, SHA-1, HMAC-SHA-1, DSA, RSA, PRNG, and Diffie-Hellman for the definition of the encryption algorithms. There are many ways of determining compliance with a standard. Alcatel-Lucent VPN Firewall v9.1.329 has chosen to make a developer claim of compliance. This means that there has been no independent verification (by either the evaluators or a third party standards body, such as a FIPS laboratory) that the implementation of the cryptographic algorithms actually meets the claimed standards. Potential users of this product should confirm that the cryptographic capabilities are suitable to meet the user's requirements.

ENVIRONMENTAL STRENGTHS

The Alcatel-Lucent VPN Firewall is a commercial product that provides specialized Traffic Flow Control (User Data Protection), Secure Communications (VPN and secure communication channels for remote administration), and Redundancy functions as well as more standard functions of Auditing, Identification and Authentication, Security Management, and Self-Protection. To securely provide these functions, the deployed ALVF must be appropriately protected from physical attacks.

Vendor Information

Alcatel-Lucent
Sarveshwar Rao
818-878-4551
818-878-4551 (Fax)
Saveshwar.rao@alcatel-lucent.com

http://www.alcatel-lucent.com