NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems

Short Name: cpp_nd_v2.1

Technology Type: Network Device

CC Version: 3.1

Date: 2019.03.11

Preceded By: cpp_nd_v2.0e

Succeeded By: cpp_nd_v2.2e

Sunset Date: 2020.09.27

Conformance Claim: None

Protection Profile 

Supporting Docs 

Control Mapping 

PP OVERVIEW

This is a Collaborative Protection Profile (cPP) whose Target of Evaluation (TOE) is a network device. It provides a minimal set of security requirements expected by all network devices that target the mitigation of a set of defined threats. This baseline set of requirements will be built upon by future cPPs to provide an overall set of security solutions for networks up to carrier and enterprise scale. A network device in the context of this cPP is a device composed of both hardware and software that is connected to the network and has an infrastructure role within the network. The TOE may be standalone or distributed, where a distributed TOE is one that requires multiple distinct components to operate as a logical whole in order to fulfil the requirements of this cPP.

Assigned to the following Validated Products

• VID11023 – SonicWall Secure Mobile Access (SMA) v12.1
• VID11044 – Cisco Wireless LAN IOS-XE 16.12
• VID11045 – Cisco Wireless LAN 8.10
• VID11051 – WatchGuard Fireware OS v12.6.2 on Firebox NGFWs
• VID11059 – Cisco Stealthwatch Enterprise 7.1
• VID11063 – Palo Alto Networks PA-220 Series, PA-800 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, PA-7000 Series, and VM Series Next-Generation Firewall with PAN-OS 9.0
• VID11069 – Alcatel-Lucent Enterprise OmniSwitch series 6465, 6560, 6860, 6865, 6900, 9900 with AOS 8.6.R11
• VID11070 – Palo Alto Networks M-100, M-200, M-500, and M-600 Hardware, and Virtual Appliances all running Panorama 9.0
• VID11074 – Aruba ClearPass Policy Manager 6.9
• VID11076 – FlashArray//X running Purity//FA 5.3
• VID11079 – McAfee Network Security Platform (NSM Linux Appliance v10.1.19.17 and NS Sensor Appliances v10.1.17.15)
• VID11080 – 3eTI CyberFence 3e-636 Series Network Security Devices
• VID11081 – Palo Alto Networks WF-500 with WildFire 9.0
• VID11088 – CommScope Technologies LLC, Ruckus FastIron ICX 7450 Series Router 8.0.70 with IPsec VPN
• VID11089 – CommScope Technologies LLC, Ruckus FastIron ICX Series Switch/Router 8.0.70
• VID11090 – Cisco Adaptive Security Appliances (ASA) 9.12 running on Firepower 2100 Series Appliances
• VID11091 – Cisco ASA 9.12 running on Firepower 4100 and 9300 Security Appliances
• VID11092 – Cisco Unified Communications Manager (CUCM) 12.5
• VID11093 – Cisco Network Convergence System (NCS) 1000 Series
• VID11094 – Cisco Unified Communications Manager and the IM and Presence Service v12.5
• VID11099 – Aruba, a Hewlett Packard Enterprise Company 2930F, 2930M, 3810M, and 5400R Switch Series running ArubaOS version 16.08
• VID11102 – Cisco Adaptive Security Appliances (ASA) 5500, Industrial Security Appliances (ISA) 3000 and Adaptive Security Appliances Virtual (ASAv) Version 9.12
• VID11104 – RedSeal Server v9.4
• VID11110 – Aruba Mobility Controller with ArubaOS 8.6
• VID11111 – Aruba Mobility Controller with ArubaOS 8.6 - WLAN
• VID11118 – Extreme Networks, Inc. SLX Product Series operating with Version 20.1.1aa
• VID11123 – PacStar 451/453/455 Series with Cisco ASAv 9.12
• VID11152 – Junos OS 20.1R2 for NFX250
• VID11153 – mTera Universal Transport Platform version MT5.1.2
• Aruba Mobility Master with ArubaOS 8.2
• Ixia, A Keysight Business Vision Series Network Packet Broker v5.3.0
• Dell EMC Networking SmartFabric OS10 v10.5.1
• Netscout nGeniusPULSE Server v3.2
• F5 BIG-IP 14.1.2 NDcPP
• Juniper Junos OS 20.2R1 for SRX345, SRX345-DUAL-AC, SRX380 and SRX1500
• Juniper Junos OS 19.3R1 for MX10003 and EX9253
• Junos OS 20.3R1 for ACX5448-M
• Junos OS 20.2R1-S1 for QFX5120-48T, QFX5120-48Y, QFX5120-32C, QFX5210-64C, EX4650-48Y and QFX5200-48Y
• Cisco Email Security Appliance with AsyncOS 13.0
• Junos OS 20.4R1 for SRX345, SRX345-DUAL-AC and SRX380 in Cluster Mode

Active Related Technical Decisions

• 0572 – NiT Technical Decision for Restricting FTP_ITC.1 to only IP address identifiers
• 0571 – NiT Technical Decision for Guidance on how to handle FIA_AFL.1
• 0570 – NiT Technical Decision for Clarification about FIA_AFL.1
• 0547 – NIT Technical Decision for Clarification on developer disclosure of AVA_VAN
• 0538 – NIT Technical Decision for Outdated link to allowed-with list
• 0536 – NIT Technical Decision for Update Verification Inconsistency
• 0528 – NIT Technical Decision for Missing EAs for FCS_NTP_EXT.1.4

Archived Related Technical Decisions

• 0535 – NIT Technical Decision for Clarification about digital signature algorithms for FTP_TUD.1
• 0533 – NIT Technical Decision for FTP_ITC.1 with signed downloads
• 0532 – NIT Technical Decision for Use of seeds with higher entropy
• 0531 – NIT Technical Decision for Challenge-Response for Authentication
• 0530 – NIT Technical Decision for FCS_TLSC_EXT.1.1 5e test clarification
• 0529 – NIT Technical Decision for OCSP and Authority Information Access extension
• 0484 – NIT Technical Decision for Interactive sessions in FTA_SSL_EXT.1 & FTA_SSL.3
• 0483 – NIT Technical Decision for Applicability of FPT_APW_EXT.1
• 0482 – NIT Technical Decision for Identification of usage of cryptographic schemes
• 0481 – NIT Technical Decision for FCS_(D)TLSC_EXT.X.2 IP addresses in reference identifiers
• 0480 – NIT Technical Decision for Granularity of audit events
• 0478 – NIT Technical Decision for Application Notes for FIA_X509_EXT.1 iterations
• 0477 – NIT Technical Decision for Clarifying FPT_TUD_EXT.1 Trusted Update
• 0475 – NIT Technical Decision for Separate traffic consideration for SSH rekey
• 0453 – NIT Technical Decision for Clarify authentication methods SSH clients can use to authenticate SSH se
• 0452 – NIT Technical Decision for FCS_(D)TLSC_EXT.X.2 IP addresses in reference identifiers
• 0451 – NIT Technical Decision for ITT Comm UUID Reference Identifier
• 0450 – NIT Technical Decision for RSA-based ciphers and the Server Key Exchange message
• 0449 – NIT Technical Decision for Identification of usage of cryptographic schemes
• 0448 – NIT Technical Decision for Documenting Diffie-Hellman 14 groups
• 0447 – NIT Technical Decision for Using 'diffie-hellman-group-exchange-sha256' in FCS_SSHC/S_EXT.1.7
• 0425 – NIT Technical Decision for Cut-and-paste Error for Guidance AA
• 0424 – NIT Technical Decision for NDcPP v2.1 Clarification - FCS_SSHC/S_EXT1.5
• 0423 – NIT Technical Decision for Clarification about application of RfI#201726rev2
• 0412 – NIT Technical Decision for FCS_SSHS_EXT.1.5 SFR and AA discrepancy
• 0411 – NIT Technical Decision for FCS_SSHC_EXT.1.5, Test 1 - Server and client side seem to be confused
• 0410 – NIT technical decision for Redundant assurance activities associated with FAU_GEN.1
• 0409 – NIT decision for Applicability of FIA_AFL.1 to key-based SSH authentication
• 0408 – NIT Technical Decision for local vs. remote administrator accounts
• 0407 – NIT Technical Decision for handling Certification of Cloud Deployments
• 0402 – NIT Technical Decision for RSA-based FCS_CKM.2 Selection
• 0401 – NIT Technical Decision for Reliance on external servers to meet SFRs
• 0400 – NIT Technical Decision for FCS_CKM.2 and elliptic curve-based key establishment
• 0399 – NIT Technical Decision for Manual installation of CRL (FIA_X509_EXT.2)
• 0398 – NIT Technical Decision for FCS_SSH*EXT.1.1 RFCs for AES-CTR
• 0397 – NIT Technical Decision for Fixing AES-CTR Mode Tests
• 0396 – NIT Technical Decision for FCS_TLSC_EXT.1.1, Test 2
• 0395 – NIT Technical Decision for Different Handling of TLS1.1 and TLS1.2