Compliant Product - Cisco Nexus 3000 and 9000 Series Switches running NX-OS 9.3
Certificate Date: 2021.11.12CC Certificate Security Target Validation Report
Validation Report Number: CCEVS-VR-VID11173-2021
Product Type: Network Switch
Conformance Claim: Protection Profile Compliant
PP Identifier: collaborative Protection Profile for Network Devices Version 2.2e
CC Testing Lab: Gossamer Security Solutions
The TOE is comprised of both software and hardware. The hardware is comprised of the following model series: 3100. 3100v, 3100z, 3200, 3400, 3500, 3600, 9200, 9300 and 9500. The software is comprised of the NX-OS soft-ware image Release 9.3.
The Cisco Nexus 3000 and 9000 Series Switches that comprise the TOE have common hardware characteristics. These characteristics affect only non-TSF relevant functions of the switches (such as throughput and amount of storage) and therefore support security equivalency of the switches in terms of hardware. All security functionality is enforced on the Nexus 3000 and Nexus 9000 Series switches.
Cisco NX-OS is a Cisco-developed highly configurable proprietary operating system that provides for efficient and effective routing and switching. Although NX-OS performs many networking functions, this TOE only addresses the functions that provide for the security of the TOE.
The TOE is comprised of both software and hardware. The hardware is comprised of the following model series: 3100. 3100v, 3100z, 3200, 3400, 3500, 3600, 9200, 9300 and 9500. The software is comprised of the NX-OS software image Release 9.3
Security Evaluation Summary
The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Cisco Nexus 3000 and 9000 Series Switches CC Configuration Guide, Version 1.0, September 7, 2021 satisfies all of the security functional requirements stated in the Cisco Nexus 3000 and 9000 Series Switches running on NX-OS 9.3 Security Target, Version 1.0, October 22, 2021. The project underwent CCEVS Validator review. The evaluation was completed in November 2021. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11173-2021) prepared by CCEVS.
The logical boundaries of the TOE are realized in the security functions that it implements. Each of these security functions is summarized below.
The TOE provides extensive capabilities to generate audit data targeted at detecting such activity.The TOE generates an audit record for each auditable event.Each security relevant audit event has the date, timestamp, event description, and subject identity.The administrator configures auditable events, performs back-up operations and manages audit data storage.The TOE provides circular audit trail.Audit logs are transmitted to an external audit server over a trusted channel protected with TLS.
The TOE provides cryptography in support of other TOE security functionality. All the algorithms claimed have CAVP certificates (Operational Environment –Intel Xeon processor). The TOE leverages the Cisco FIPS Object Module (FOM) 6.2 certificate and has been validated for conformance to the requirements of FIPS140-2 140-2 Level 1.
The TOE provides cryptography in support of remote administrative management via SSHv2 and secure the session between the TOE and remote syslog server using TLS.
Identification and Authentication:
The TOE provides authentication services for administrative users wishing to connect to the TOEs secure CLI administrator interface. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. The TOE can be configured to require a minimum password length of 15 characters as well as mandatory password complexity rules.
After a configurable number of incorrect login attempts, the TOE will lockout the account until a configured amount of time for lockout expires.
The TOE provides administrator authentication against a local user database. Password-based authentication can be performed on the serial console or SSH interfaces. The SSHv2 interface also supports authentication using SSH keys.
The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for TLS connections.
The TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure SSHv2 session or via a local console connection. The TOE provides the ability to securely manage all TOE administrative users; all identification and authentication; all audit functionality of the TOE; all TOE cryptographic functionality; the timestamps maintained by the TOE; and updates to the TOE. The TOE supports privileged administrator. Only the privileged administrator can perform the above security relevant management functions.
Administrators can create configurable login banners to be displayed at time of login and can also define an inactivity timeout for each admin interface to terminate sessions after a set period of inactivity.
Protection of the TSF:
The TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. Additionally, Cisco NX-OS is not a general-purpose operating system and access to Cisco NX-OS memory space is restricted to only Cisco NX-OS functions.
The TOE internally maintains the date and time. This date and time are used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE’s clock manually. Finally, the TOE performs testing to verify correct operation of the router itself and that of the cryptographic module.
The TOE is able to verify any software updates prior to the software updates being installed on the TOE to avoid the installation of unauthorized software.
The TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session. The administrator can also terminate their own session by exiting out of the CLI.
The TOE can also display an Authorized Administrator specified banner on the CLI management interface prior to allowing any administrative access to the TOE.
The TOE establishes a trusted path between the appliance and the CLI using SSHv2 and the syslog server using TLS.
Cisco Systems, Inc.
919 392 4335