The Target of Evaluation (TOE) is the EX4300, an infrastructure networking device (switch), operating on Junos OS 14.1X53-D30. The EX-series switches provide high-performance, carrier-class networking solutions, supporting a variety of high-speed Ethernet interfaces for medium to large networks.
","evaluation_configuration":"\r\n\r\nThe EX4300 is offered in three form factors:
\r\n· 24 port 10/100/1000BASE-T (with and without Power over Ethernet, PoE), with 0-4x10GbE uplinks and 4x40GbE uplinks
\r\n· 48 10/100/1000BASE-T ports (with and without Power over Ethernet, PoE), with 0-4x10GbE uplinks and 4x40GbE uplinks
\r\n· 32 port 100/1000BASE-X, with 4-12x10GbE uplinks and 2-4x40GbE uplinks
\r\nThe TOE is comprised of the Junos OS 14.1X53-D30 firmware running on the appliance chassis listed immediately above.
","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the EX4300 meets the security requirements contained in the Security Target, based on the Security Functional Requirements of the Network Devices Protection Profile, Version 1.1.
\r\nThe criteria for which the Juniper EX4300 switch was evaluated against, are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1. The methodology used by the evaluation team to conduct the evaluation is contained in the Common Methodology for Information Technology Security Evaluation, Version 3.1.
\r\nInfoGard Laboratories, Inc. determined that the TOE, configured as specified in the operational guidance, satisfies all of the security functional requirements stated in the Security Target.
","environmental_strengths":"\r\n\r\nThe evaluation of the Juniper Networks EX-Series, EX4300 switch, provides assurance that the Security Functional Requirements (SFR) of the Network Devices Protection Profile, Version 1.1, has been met. A summary of the SFRs are as follows:
\r\nJunos auditable events are stored in the syslog files, and can be sent to an external log server (via Netconf over SSH). Auditable events include start-up and shutdown of the audit functions, authentication events, service requests, as well as the events listed in the table in Section 8 of the Security Target. Audit records include the date and time, event category, event type, username, and the outcome of the event (success or failure). Local syslog storage limits are configurable and are monitored. In the event of storage limits being reached the oldest logs will be overwritten.
\r\nThe TOE includes a baseline cryptographic module that provides confidentiality and integrity services for authentication and for protecting communications with adjacent systems.
\r\nThe TOE is designed to process network packets and forward them as appropriate. The packet handling is implemented in such a manner as to prevent the leakage of user data from one packet into other packet(s) that was not intended by the originator.
\r\nThe TOE requires users to provide unique identification and authentication data before any administrative access to the system is granted. .The devices also require that applications exchanging information with them successfully authenticate prior to any exchange. This covers all services used to exchange information, including Secure Shell (SSH).
\r\nTelnet, File Transfer Protocol (FTP), and Secure Socket Layer (SSL) are out of scope and are not used in the evaluated configuration.
\r\nThe TOE provides an Authorized Administrator role that is responsible for:
\r\nThe TOE is managed through a Command Line Interface (CLI). The CLI is accessible through a remote administrative session, as well as a local console session.
\r\nThe TOE provides protection mechanisms for its security functions. One of the protection mechanisms is to protect TSF data (e.g. cryptographic keys, administrator passwords). Another protection mechanism is to ensure the integrity of any software/firmware updates which can be verified utilizing a digital signature prior to installation on the TOE. The TOE provides for both cryptographic and non-cryptographic self-tests, and is capable of automated recovery from failure states. The TOE maintains a real-time clock to provide reliable timestamp for its own use.
\r\nThe TOE can be configured to terminate interactive user sessions after a user defined time-out variable is set. In addition, the TOE is able to present an access banner with warning messages prior to authentication. The TOE also allows the user to manually terminate an interactive session.
\r\nThe TOE creates trusted channels between itself and remote trusted authorized IT product (e.g. syslog server) entities that protect the confidentiality and integrity of communications. The TOE creates trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.
","features":[]}