The NiT has issued a technical decision for Firewall IPv4 & IPv6 testing by default.

This TD supersedes TD0534.

In general, both IPv4 and IPv6 must be tested for all FFW_RUL_EXT.1 evaluation activities. In particular where handling of IPv4 and IPv6 is implemented separately in the TOE, both protocols need to be tested to ensure correct TOE behavior. There is no expectation, though, to test pure IPv4 features with IPv6 (or vice versa, if applicable). In particular, the following changes shall be applied:

1.) Between the headlines "FFW_RUL_EXT.1 Stateful Traffic Filtering" and "TSS" the following paragraph shall be added. 

The following table provides an overview about execution of test cases regarding IPv4 and IPv6.

2.)  At the beginning of the Test section for FFW_RUL_EXT.1.5 (before the test definition) the following sentence shall be added:

"Tests 

The following tests shall be run using IPv4 and IPv6. 

Test 1: The evaluator shall configure the TOE to permit and log TCP traffic. The evaluator shall initiate a TCP session. ..."

3.) At the beginning of the Test section for FFW_RUL_EXT.1.6 (before the test definition) the following sentence shall be added:

"Tests 

Both IPv4 and IPv6 shall be tested for items a), b), d), and e) of the SFR element. Both IPv4 and IPv6 shall be tested for item i) unless the rule definition is specific to IPv4 or IPv6. Note: c), f), g), and h) are specific to IPv4 or IPv6 and shall be tested accordingly.  

Test 1: The evaluator shall test each of the conditions for automatic packet rejection in turn. ..." 

4.) At the beginning of the Test section for FFW_RUL_EXT.1.7 (before the test definition) the following sentence shall be added: 

"Tests 

The following tests shall be run using IPv4 and IPv6. 

Test 1: The evaluator shall configure the TOE to drop and log network traffic where the source address of the packet matches that of the TOE network interface upon which the traffic was received. ..."

5.)  At the beginning of the Test section for FFW_RUL_EXT.1.10 (before the test definition) the following sentence shall be added: 

"Tests 

The following tests shall be run using IPv4 and IPv6. 

Test 1: The evaluator shall define a TCP half-open connection limit on the TOE. The evaluator shall generate TCP SYN requests to pass through the TOE to the target system using a randomised source IP address and common destination IP address. ..."

For further information, please see the NiT interpretation at: https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/NITDecisionRfI201927rev2.pdf

See issue description.