The TOE is classified as a Wireless LAN Access System which also provides VPN Gateway functionality. The TOE employs Mesh networking, which allows multiple TOEs to network within the operational environment. Only WLAN functionality is evaluated in the Security Target (ST). All VPN functionality was evaluated in a separate Security Target.
\r\nThe TOE brings secure wireless communications to environmentally challenging situations, including, outdoor locations, and across long distances through a self-forming, self-healing mesh network. Delivered in a form factor that is rugged, weatherized, and easy to set-up and operate, the TOE functions as both a wireless access point and bridge, and VPN gateway, with up to four powerful radios for maximum range and performance.
\r\n","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target, based on the Security Functional Requirements of the Wireless LAN Access System Protection Profile, Version 1.0, December 2011. This evaluation reused testing evidence from VID 10667, Fortress Mesh Point ES210, ES520, ES820, ES2440. That validation covered the same product, but was evaluated against the Network Device Protection Profile with the VPN EP. Testing evidence was reused for those SFRs where the requirement and the assurance activity was the same. The two validations shared configuration guidance, ensuring the products were in the same configuration. The original VID10667 validation was against a slightly earlier version of the firmware. The CCTL submitted a maintenance action against VID10667 to bring it to the same firmware as this validation. The ACMR, indicating that the change was minor and providing details on the regression testing performed, is being issued concurrent with this VR. This is acceptable because the evaluations covered the same products, which use the same firmware, and were in the same configuration.
\r\nThe criteria for which the TOE was evaluated against are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1. The methodology used by the evaluation team to conduct the evaluation is contained in the Common Methodology for Information Technology Security Evaluation, Version 3.1.
\r\nInfoGard Laboratories, Inc. determined that the TOE, configured as specified in the operational guidance, satisfies all of the security functional requirements stated in the Security Target.
","environmental_strengths":"\r\n\r\nThe evaluation of the TOE provides assurance that the Security Functional Requirements (SFR) of the Wireless LAN Access System Protection Profile, Version 1.0 have been met.
\r\nThe TOE consists of the following Security Functions:
\r\n· Security Audit (FAU)
\r\n· Cryptographic Support (FCS)
\r\n· User Data Protection (FDP)
\r\n· Identification and Authentication (FIA)
\r\n· Security Management (FMT)
\r\n· Protection of the TSF (FPT)
\r\n· TOE Access (FTA)
\r\n· Trusted Path/Channels (FTP)
\r\nThe TOE provides cryptographic functions to protect information, including mechanisms to encrypt, decrypt, hash, digitally sign, and perform cryptographic key agreement. The evaluated configuration uses a subset of the cryptographic implementations listed in Section 9 of the ST for all cryptographic purposes. The FIPS-Approved cryptographic algorithms used by the TOE, and specified by the SFRs, are listed in Table 15 of the ST. The following protocols are implemented by the TOE and use FIPS-Approved cryptographic algorithms:
\r\nThe TSF zeroizes all plaintext secret and private cryptographic keys and CSPs once they are no longer required.
\r\nThe TOE requires the system administrators be authenticated before access to the TOE is granted; administrators may login to the TOE by providing a user name and password via a local RJ45 using a serial RS-232 connection, and via SSH, HTTPS, or X.509 for TLS. Administrators may connect to the TOE remotely via the LAN, WAN, or 802.11a/b/g/n interfaces.
\r\nThe TOE displays a configurable access banner and requires an administrator to authenticate using a username and password. An external RADIUS server can be configured for authentication through an IPsec tunnel. Authentication can take place, by user name and password (and hexadecimal device ID if applicable). For IPsec, the TOE also supports X.509 certificates. EAP-TLS is used for WPA2 wireless authentication via x.509 certificates.
\r\nThe TOE displays the access banner before establishing an administrative session. The TOE terminates an interactive session after an Authorized Administrator-configurable time interval of session inactivity. A wireless client session is defined as being allowed access to a particular port on the application layer. The TOE is able to deny establishment of a wireless client session based mac address.
\r\n