NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems

Short Name: cpp_nd_v2.1

Technology Type: Network Device

CC Version: 3.1

Date: 2019.03.11

Preceded By: cpp_nd_v2.0e

Succeeded By: cpp_nd_v2.2e

Sunset Date: 2020.09.27

Conformance Claim: None

Protection Profile 

Supporting Docs 

Control Mapping 

PP OVERVIEW

This is a Collaborative Protection Profile (cPP) whose Target of Evaluation (TOE) is a network device. It provides a minimal set of security requirements expected by all network devices that target the mitigation of a set of defined threats. This baseline set of requirements will be built upon by future cPPs to provide an overall set of security solutions for networks up to carrier and enterprise scale. A network device in the context of this cPP is a device composed of both hardware and software that is connected to the network and has an infrastructure role within the network. The TOE may be standalone or distributed, where a distributed TOE is one that requires multiple distinct components to operate as a logical whole in order to fulfil the requirements of this cPP.

Assigned to the following Validated Products

• VID10977 – BlackBerry SecuGATE version 4.0
• VID10978 – Cisco Identity Services Engine (ISE) V2.6
• VID10980 – Palo Alto Networks M-100, M-200, M-500, and M-600 Hardware, and Virtual Appliances all running Panorama 8.1.10
• VID10988 – Junos OS 18.3R1-S1 for MX240, MX480, MX960, MX2010, MX2020, EX9204, EX9208 and EX9214 with MPC7E-10G/Ex9200-40XS
• VID10996 – Apriva MESA VPN
• VID10998 – NetIron Family MLXE and CER devices with Multi-Service Iron Ware R06.3.00aa
• VID10999 – Junos OS 18.3R1-S2 for MX80, MX104, MX240, MX480, and MX960 with MICMACSEC-20G
• VID11009 – MMA10G-IPX Series v3.2
• VID11020 – Pulse Policy Secure v.9.1
• VID11021 – Pulse Connect Secure v9.1
• VID11022 – MAGNUM-HW-C-CC
• VID11023 – SonicWall Secure Mobile Access (SMA) v12.1
• VID11025 – Junos OS 19.1R2 for EX2300, EX2300-C and EX3400
• VID11027 – IBM QRadar Security Intelligence Platform, version 7.3.2
• VID11029 – Cisco Catalyst 9600 Series Switches running IOS-XE 16.12
• VID11030 – Cisco Catalyst 9200 Series Switches running IOS-XE 16.12
• VID11031 – Cisco Embedded Services 3300 Series Switches (ESS3300)
• VID11032 – Palo Alto Networks WF-500 with WildFire 8.1.11
• VID11033 – Cisco IR1101 Integrated Services Router
• VID11037 – Junos OS 19.1R2 for MX104 with Multiservices MIC MS-MIC-16G
• VID11038 – Ruckus SmartZone WLAN Controllers and Access Points, R5.1.1.3
• VID11044 – Cisco Wireless LAN IOS-XE 16.12
• VID11045 – Cisco Wireless LAN 8.10
• VID11049 – Dell EMC Networking Platforms running Dell EMC Networking OS 9.14
• VID11051 – WatchGuard Fireware OS v12.6.2 on Firebox NGFWs
• VID11052 – Aruba Remote Access Point Series with Aruba Mobility Controllers, running AOS 8.2
• VID11055 – MMA10G EXE Series
• VID11058 – Cisco Catalyst 9300/9400 Series Switches running IOS-XE 16.12
• VID11059 – Cisco Stealthwatch Enterprise 7.1
• VID11063 – Palo Alto Networks PA-220 Series, PA-800 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, PA-7000 Series, and VM Series Next-Generation Firewall with PAN-OS 9.0
• VID11070 – Palo Alto Networks M-100, M-200, M-500, and M-600 Hardware, and Virtual Appliances all running Panorama 9.0
• VID11073 – Extreme Networks, Inc. NetIron Family Devices with Multi-Service IronWare R06.3.0aa
• VID11074 – Aruba ClearPass Policy Manager 6.9
• VID11076 – FlashArray//X running Purity//FA 5.3
• VID11079 – McAfee Network Security Platform (NSM Linux Appliance v10.1.19.17 and NS Sensor Appliances v10.1.17.15)
• VID11080 – 3eTI CyberFence 3e-636 Series Network Security Devices
• VID11081 – Palo Alto Networks WF-500 with WildFire 9.0
• VID11088 – CommScope Technologies LLC, Ruckus FastIron ICX 7450 Series Router 8.0.70 with IPsec VPN
• VID11089 – CommScope Technologies LLC, Ruckus FastIron ICX Series Switch/Router 8.0.70
• VID11090 – Cisco Adaptive Security Appliances (ASA) 9.12 running on Firepower 2100 Series Appliances
• VID11091 – Cisco ASA 9.12 running on Firepower 4100 and 9300 Security Appliances
• VID11092 – Cisco Unified Communications Manager (CUCM) 12.5
• VID11093 – Cisco Network Convergence System (NCS) 1000 Series
• VID11094 – Cisco Unified Communications Manager and the IM and Presence Service v12.5
• VID11099 – Aruba, a Hewlett Packard Enterprise Company 2930F, 2930M, 3810M, and 5400R Switch Series running ArubaOS version 16.08
• VID11102 – Cisco Adaptive Security Appliances (ASA) 5500, Industrial Security Appliances (ISA) 3000 and Adaptive Security Appliances Virtual (ASAv) Version 9.12
• VID11110 – Aruba Mobility Controller with ArubaOS 8.6
• VID11111 – Aruba Mobility Controller with ArubaOS 8.6 - WLAN
• VID11118 – Extreme Networks, Inc. SLX Product Series operating with Version 20.1.1aa
• Juniper Junos OS 19.2R1 for MX204 AND EX9251
• F5 BIG-IP 14.1.0 for LTM+APM
• Arista Networks Switches EOS 4.22.1FX-CC
• Junos OS 19.2R1 for SRX300, SRX320, SRX340, SRX345, SRX345-DUAL-AC and SRX550M Series
• Junos OS 19.2R1 for SRX1500, SRX4100, SRX4200 and SRX4600 Series
• Cisco ASR 900 Series and NCS4200 Series running IOS-XE 16.9
• Aruba Mobility Master with ArubaOS 8.2
• Junos OS 19.3R1 for QFX5120, QFX5210 and EX4650
• Junos OS 19.2R1-S2 for SRX5400, SRX5600 and SRX5800 Series
• Junos OS 19.4R1 for EX4300-48MP
• Ixia, A Keysight Business Vision Series Network Packet Broker v5.3.0
• Dell EMC Networking SmartFabric OS10 v10.5.1
• Netscout nGeniusPULSE Server v3.2
• F5 BIG-IP 14.1.2 NDcPP
• Juniper Junos OS 20.2R1 for SRX345, SRX345-DUAL-AC, SRX380 and SRX1500
• Juniper Junos OS 19.3R1 for MX10003 and EX9253
• Junos OS 20.3R1 for ACX5448-M
• Junos OS 20.2R1-S1 for QFX5120-48T, QFX5120-48Y, QFX5120-32C, QFX5210-64C, EX4650-48Y and QFX5200-48Y

Active Related Technical Decisions

• 0572 – NiT Technical Decision for Restricting FTP_ITC.1 to only IP address identifiers
• 0571 – NiT Technical Decision for Guidance on how to handle FIA_AFL.1
• 0570 – NiT Technical Decision for Clarification about FIA_AFL.1
• 0547 – NIT Technical Decision for Clarification on developer disclosure of AVA_VAN
• 0538 – NIT Technical Decision for Outdated link to allowed-with list
• 0536 – NIT Technical Decision for Update Verification Inconsistency
• 0535 – NIT Technical Decision for Clarification about digital signature algorithms for FTP_TUD.1
• 0533 – NIT Technical Decision for FTP_ITC.1 with signed downloads
• 0532 – NIT Technical Decision for Use of seeds with higher entropy
• 0531 – NIT Technical Decision for Challenge-Response for Authentication
• 0530 – NIT Technical Decision for FCS_TLSC_EXT.1.1 5e test clarification
• 0529 – NIT Technical Decision for OCSP and Authority Information Access extension
• 0528 – NIT Technical Decision for Missing EAs for FCS_NTP_EXT.1.4
• 0484 – NIT Technical Decision for Interactive sessions in FTA_SSL_EXT.1 & FTA_SSL.3
• 0483 – NIT Technical Decision for Applicability of FPT_APW_EXT.1
• 0482 – NIT Technical Decision for Identification of usage of cryptographic schemes
• 0481 – NIT Technical Decision for FCS_(D)TLSC_EXT.X.2 IP addresses in reference identifiers
• 0480 – NIT Technical Decision for Granularity of audit events
• 0478 – NIT Technical Decision for Application Notes for FIA_X509_EXT.1 iterations
• 0477 – NIT Technical Decision for Clarifying FPT_TUD_EXT.1 Trusted Update
• 0475 – NIT Technical Decision for Separate traffic consideration for SSH rekey
• 0453 – NIT Technical Decision for Clarify authentication methods SSH clients can use to authenticate SSH se
• 0451 – NIT Technical Decision for ITT Comm UUID Reference Identifier
• 0450 – NIT Technical Decision for RSA-based ciphers and the Server Key Exchange message
• 0447 – NIT Technical Decision for Using 'diffie-hellman-group-exchange-sha256' in FCS_SSHC/S_EXT.1.7
• 0425 – NIT Technical Decision for Cut-and-paste Error for Guidance AA
• 0424 – NIT Technical Decision for NDcPP v2.1 Clarification - FCS_SSHC/S_EXT1.5
• 0423 – NIT Technical Decision for Clarification about application of RfI#201726rev2
• 0412 – NIT Technical Decision for FCS_SSHS_EXT.1.5 SFR and AA discrepancy
• 0411 – NIT Technical Decision for FCS_SSHC_EXT.1.5, Test 1 - Server and client side seem to be confused
• 0410 – NIT technical decision for Redundant assurance activities associated with FAU_GEN.1
• 0409 – NIT decision for Applicability of FIA_AFL.1 to key-based SSH authentication
• 0408 – NIT Technical Decision for local vs. remote administrator accounts
• 0407 – NIT Technical Decision for handling Certification of Cloud Deployments
• 0402 – NIT Technical Decision for RSA-based FCS_CKM.2 Selection
• 0401 – NIT Technical Decision for Reliance on external servers to meet SFRs
• 0400 – NIT Technical Decision for FCS_CKM.2 and elliptic curve-based key establishment
• 0399 – NIT Technical Decision for Manual installation of CRL (FIA_X509_EXT.2)
• 0398 – NIT Technical Decision for FCS_SSH*EXT.1.1 RFCs for AES-CTR
• 0397 – NIT Technical Decision for Fixing AES-CTR Mode Tests
• 0396 – NIT Technical Decision for FCS_TLSC_EXT.1.1, Test 2
• 0395 – NIT Technical Decision for Different Handling of TLS1.1 and TLS1.2

Archived Related Technical Decisions

• 0452 – NIT Technical Decision for FCS_(D)TLSC_EXT.X.2 IP addresses in reference identifiers
• 0449 – NIT Technical Decision for Identification of usage of cryptographic schemes
• 0448 – NIT Technical Decision for Documenting Diffie-Hellman 14 groups