NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems

Short Name: mod_cpp_fw_v1.3

Technology Type: Firewall

CC Version: 3.1

Date: 2019.10.23

Preceded By: cpp_fw_v2.0e

Sunset Date: 2020.09.27

Conformance Claim: None

Protection Profile 

Supporting Docs 

PP-Configuration for NDcPP-FW_v1.3 

PP-Configuration for NDcPP-FW-VPNGW_V.1.0  

PP OVERVIEW

This PP-Module defines requirements for the evaluation of Stateful Traffic Filter Firewalls in addition to the requirements of the Base-PP which specifies requirements on network devices in general. A Stateful Traffic Filter Firewall shall be regarded as a specific type of network device which provides the security functions of residual information protection and stateful traffic filtering, in addition to those that are expected of all generic network devices. Occurrences of the term 'Network Device' in the Base-PP shall be read as 'Stateful Traffic Filter Firewall' when used in conjunction with this PP-Module, as a TOE that conforms to this PP-Module will also conform to the Base-PP. Such products are generally boundary protection devices, such as dedicated firewalls, routers, or perhaps even switches designed to control the flow of information between attached networks. While in some cases, firewalls implementing security features serve to segregate two distinct networks – a trusted or protected enclave and an untrusted internal or external network such as the Internet – that is only one of many possible applications. It is common for firewalls to have multiple physical network connections enabling a wide range of possible configurations and network information flow policies.

Assigned to the following Validated Products

• VID11152 – Junos OS 20.1R2 for NFX250
• Junos OS 20.4R1 for SRX345, SRX345-DUAL-AC and SRX380 in Cluster Mode

Active Related Technical Decision

• 0545 – NIT Technical Decision for Conflicting FW rules cannot be configured (extension of RfI#201837)
  • References:  FWMOD SD v1.3, FWMOD SD v1.4e, FFW_RUL_EXT.1.8

Archived Related Technical Decisions

• 0565 – NiT Technical Decision for Firewall IPv4 & IPv6 testing by default
• 0534 – NIT Technical Decision for Firewall IPv4 & IPv6 testing by default