CC Certificate 

Security Target 

Validation Report 

Assurance Activity 

Administrative Guide 

Cisco Aggregation Services Router 1000 Series (ASR1K)

The TOE consists of one or more physical device as specified in section 1.7 below and includes Cisco IOS-XE version 17.3 software.  The ASR1K hardware models included in this evaluation are the ASR1001-X, ASR1001-HX, ASR1002-HX, ASR1006-X, ASR1009-X, and ASR1013 with supporting MACsec hardware ASR1000-MIP100, EPA-18X1GE, EPA-10X10GE, EPA-1X100GE, EPA-CPAK-2X40GE, EPA-1X100GE QSFP+, EPA-2X40GE QSFP+, and EPA-1X40GE QSFP+. Table 1  adds additional details on the physical characteristics of the models. The TOE has two or more network interfaces and is connected to at least one internal and one external network.  The Cisco IOS-XE configuration determines how packets are handled to and from the TOE’s network interfaces.  The router configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination.

Cisco Integrated Services Router 4000 Series (ISR4K)

The TOE consists of one or more physical device as specified in section 1.7 below and includes Cisco IOS-XE version 17.3 software.  The hardware models included in the evaluation are the ISR4321, ISR4331, ISR4351, ISR4431, ISR4451-X, ISR4461 with MACsec network interface modules (NIM): NIM-1GE-CU-SFP and NIM-2GE-CU-SFP. Table 1 adds additional details on the physical characteristics of the two models. The TOE has two or more network interfaces and is connected to at least one internal and one external network.  The Cisco IOS-XE configuration determines how packets are handled to and from the TOE’s network interfaces.  The router configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination.

Cisco Catalyst 8300 Series Edge Routers (Cat8300)

The TOE consists of one or more physical device as specified in section 1.7 below and includes Cisco IOS-XE version 17.3 software.  The Cat8300 hardware models included in this evaluation are the CAT8300-1N1S-6T (1-RU), CAT8300-1N1S-4T2X (1-RU),  CAT8300-2N2S-6T (2-RU),  CAT8300-2N2S-4T2X (2-RU). Table 4 adds additional details on the physical characteristics of the models.

The TOE has two or more network interfaces and is connected to at least one internal and one external network.  The Cisco IOS-XE configuration determines how packets are handled to and from the TOE’s network interfaces.  The router configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination.

Cisco Catalyst 8500 Series Edge Routers (Cat8500)

The TOE consists of one physical device as specified in section 1.7 below and includes Cisco IOS-XE version 17.3 software. The hardware models included in the evaluation are the C8500-12X4QC, C8500-12X. Table 4 adds additional details on the physical characteristics of the two models. The TOE has two or more network interfaces and is connected to at least one internal and one external network.  The Cisco IOS-XE configuration determines how packets are handled to and from the TOE’s network interfaces.  The router configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination.

The following figure provides a visual depiction of an example ASR1K, ISR4K, Cat8300, and Cat8500 TOE deployment:

Figure 1  TOE Example Deployment for ASR1K, ISR4K, Cat8300, Cat8500

The Figure 1 includes the following:

·       Examples of TOE models

·       The following are considered to be in the IT Environment:

- VPN Peer

- MACSec Peer

- Management Workstation

- Radius AAA (Authentication) Server

- Audit (Syslog) Server

- Local Console

- Certificate Authorty (CA)

NOTE: While the previous figure includes several non-TOE IT environment devices, the TOE is only the ASR1K, ISR4K, Cat8300 and Cat8500 devices. Only one TOE device is required for deployment of the TOE in the evaluated configuration.

The TOE is comprised of the following physical specifications as described in Table 4 below:

Table 1   Hardware Models and Specifications