NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems
|
|
|
Archived U.S. Government Approved Protection Profile - collaborative Protection Profile for Stateful Traffic Filter Firewalls Version 2.0 + Errata 20180314
Short Name:
cpp_fw_v2.0e
Technology Type:
Firewall
CC Version:
3.1
Date:
2018.03.14
Transition End Date:
2018.03.14
Preceded By:
cpp_fw_v2.0
Succeeded By:
mod_cpp_fw_v1.3
Sunset Date:
2019.12.31
Conformance Claim:
None
Protection Profile
Supporting Docs
Control Mapping
Configuration Annex
PP OVERVIEW
This collaborative Protection Profile (cPP) defines requirements for the evaluation of Stateful Traffic Filter Firewalls. Such products are generally boundary protection devices, such as dedicated firewalls, routers, or perhaps even switches designed to control the flow of information between attached networks. While in some cases, firewalls implementing security features serve to segregate two distinct networks – a trusted or protected enclave and an untrusted internal or external network such as the Internet – that is only one of many possible applications. It is common for firewalls to have multiple physical network connections enabling a wide range of possible configurations and network information flow policies.
The TOE may be standalone or distributed, where a distributed TOE is one that requires multiple distinct components to operate as a logical whole in order to fulfil the requirements of this cPP (a more extensive description of distributed Stateful Traffic Filter Firewall TOEs is given in section 3).
A Virtual Stateful Traffic Filter Firewall (vTFFW) is a software implementation of firewall functionality that runs inside a virtual machine. This cPP expressly excludes evaluation of vTFFWs unless the product is able to meet all the requirements and assumptions of a physical TFFW as required in this cPP.
This means:
• The virtualisation layer (or hypervisor or Virtual Machine Manager (VMM)) is considered part of the TFFW's software stack, and thus is part of the TOE and must satisfy the relevant SFRs (e.g. by treating hypervisor Administrators as Security Administrators)2. vTFFWs that can run on multiple VMMs must be tested on each claimed VMM unless the vendor can successfully argue equivalence.
• The physical hardware is likewise included in the TOE (as in the example included above). vTFFWs must be tested for each claimed hardware platform unless the vendor can successfully argue equivalence.
• There is only one vTFFW instance for each physical hardware platform.
• There are no other guest VMs on the physical platform providing non-stateful traffic filtering firewall functionality.
Assigned to the following Validated Products
-
VID10890 – Cisco FTD (NGFW) 6.2 on ASA 5500-X and FTDv with FireSIGHT (FMC) and FMCv
-
VID10914 – SonicWall SonicOS Enhanced V6.5.2 with VPN and IPS on TZ, SOHOW, NSA, and SM Appliances
-
VID10917 – Cisco ASA with FirePOWER Services, ASA 9.8 and ASDM 7.8 with FirePOWER Services 6.2
-
VID10971 – SilentEdge Enterprise Server and GoSilent Client
-
VID10975 – Aruba Mobility Controller Series with ArubaOS 8.2
-
VID10990 – Check Point Software Technologies Ltd. Security Gateway Appliances R80.30
-
VID10995 – Forcepoint NGFW 6.5
-
VID11010 – Junos OS 19.2R1 for NFX150
-
VID11017 – Rugged Crystal Firewall RCS5516FW 9.8
-
VID11028 – SonicWall SonicOS Enhanced V6.5.4 with VPN and IPS on TZ and SOHO Appliances
-
VID11035 – Junos OS 19.2R1-S3 for vSRX
-
F5 BIG-IP 13.1.1 for LTM+AFM
-
F5 BIG-IP 14.1.0 for LTM+AFM
-
Junos OS 19.2R1 for SRX300, SRX320, SRX340, SRX345, SRX345-DUAL-AC and SRX550M Series
-
Junos OS 19.2R1 for SRX1500, SRX4100, SRX4200 and SRX4600 Series
-
Junos OS 19.2R1-S2 for SRX5400, SRX5600 and SRX5800 Series
-
Fortinet FortiGate 6000 Series w/ FortiOS 5.6
-
F5 BIG-IP 14.1.2 FWcPP
Active Related Technical Decisions
Archived Related Technical Decisions
|