NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems

Short Name: cpp_fw_v2.0e

Technology Type: Firewall

CC Version: 3.1

Date: 14 March 2018

Transition End Date: 14 March 2018

Preceded By: cpp_fw_v2.0

Conformance Claim: None

Protection Profile 

Supporting Docs 

PP OVERVIEW

This collaborative Protection Profile (cPP) defines requirements for the evaluation of Stateful Traffic Filter Firewalls. Such products are generally boundary protection devices, such as dedicated firewalls, routers, or perhaps even switches designed to control the flow of information between attached networks. While in some cases, firewalls implementing security features serve to segregate two distinct networks – a trusted or protected enclave and an untrusted internal or external network such as the Internet – that is only one of many possible applications. It is common for firewalls to have multiple physical network connections enabling a wide range of possible configurations and network information flow policies.

The TOE may be standalone or distributed, where a distributed TOE is one that requires multiple distinct components to operate as a logical whole in order to fulfil the requirements of this cPP (a more extensive description of distributed Stateful Traffic Filter Firewall TOEs is given in section 3). 

A Virtual Stateful Traffic Filter Firewall (vTFFW) is a software implementation of firewall functionality that runs inside a virtual machine. This cPP expressly excludes evaluation of vTFFWs unless the product is able to meet all the requirements and assumptions of a physical TFFW as required in this cPP.

This means: 

• The virtualisation layer (or hypervisor or Virtual Machine Manager (VMM)) is considered part of the TFFW's software stack, and thus is part of the TOE and must satisfy the relevant SFRs (e.g. by treating hypervisor Administrators as Security Administrators)2. vTFFWs that can run on multiple VMMs must be tested on each claimed VMM unless the vendor can successfully argue equivalence. 

• The physical hardware is likewise included in the TOE (as in the example included above). vTFFWs must be tested for each claimed hardware platform unless the vendor can successfully argue equivalence.

• There is only one vTFFW instance for each physical hardware platform.

• There are no other guest VMs on the physical platform providing non-stateful traffic filtering firewall functionality.

Assigned to the following Validated Products

• VID10881 – Cisco Adaptive Security Appliances and ASA Virtual Version 9.8
• VID10882 – Cisco Next-Generation Firewalls (NGFW) running ASA version 9.8 and FX-OS version 2.2 on the 4k and 9k families
• VID10883 – Cisco Next-Generation Firewalls (NGFW) running ASA version 9.8 and FX-OS version 2.2 on the 2k family
• VID10887 – Junos OS 17.4R2 for vSRX
• VID10889 – Cisco FTD (NGFW) 6.2 on Firepower 4100 and 9300 Series with FireSIGHT (FMC) and FMCv
• VID10890 – Cisco FTD (NGFW) 6.2 on ASA 5500-X and FTDv with FireSIGHT (FMC) and FMCv
• VID10891 – Cisco FTD (NGFW) 6.2 on Firepower 2100 Series with FireSIGHT (FMC) and FMCv

Related Technical Decisions

• 0343 – NIT Technical Decision for Updating FCS_IPSEC_EXT.1.14 Tests
• 0340 – NIT Technical Decision for Handling of the basicConstraints extension in CA and leaf certificates
• 0339 – NIT Technical Decision for Making password-based authentication optional in FCS_SSHS_EXT.1.2
• 0337 – NIT Technical Decision for Selections in FCS_SSH*_EXT.1.6
• 0335 – NIT Technical Decision for FCS_DTLS Mandatory Cipher Suites
• 0333 – NIT Technical Decision for Applicability of FIA_X509_EXT.3
• 0321 – Protection of NTP communications
• 0291 – NIT technical decision for DH14 and FCS_CKM.1
• 0260 – NIT Technical Decision for Typo in FCS_SSHS_EXT.1.4
• 0259 – NIT Technical Decision for Support for X509 ssh rsa authentication IAW RFC 6187