The Target of Evaluation (TOE) is Juniper Networks, Inc. Junos OS 18.1R3 executing on MX-Series 3D Universal Edge Routers and EX9200 Ethernet Switch. The supported chassis are:
\r\n· MX240
\r\n· MX480
\r\n· MX960
\r\n· MX2008
\r\n· MX2010
\r\n· MX2020
\r\n· EX9204
\r\n· EX9208
\r\n· EX9214
\r\nThe supported Routing Engines employed by the MX-Series Router and EX9200-Series switches are:
\r\n· MX-Series Routers
\r\no RE1800 generation Routing Engines:
\r\n§ RE-S-1800x4-YYG for MX240, MX480 and MX960
\r\n§ RE-MX2000-1800X4 and REMX2K-1800-32G-S for MX2010 and MX2020
\r\no Next Generation Routing Engines (RE-NG):
\r\n§ RE-S-X6-64G for MX240, MX480 and MX960
\r\n§ REMX2K-X8-64G for MX2008, MX2010 and MX2020
\r\n· EX9200-Series Ethernet Switches
\r\no EX9200-RE (RE1800)
\r\no EX9200-RE2 (RE-NG)
\r\nEach of the MX-Series/EX9200 appliances is a secure network device that protects itself largely by offering only a minimal logical interface to the network and attached nodes. All MX-Series/EX9200-Series appliances are powered by the Junos OS software, Junos OS 18.1R3, which is a special purpose OS that provides no general-purpose computing capability. Junos OS provides both management and control functions as well as all IP routing.
\r\nThe MX-Series/EX9200-Series appliances primarily support the definition of, and enforce, information flow policies among network nodes. All information flow from one network node to another passes through an instance of the TOE. Information flow is controlled on the basis of network node addresses and protocol. In support of the information flow security functions, the TOE ensures that security-relevant activity is audited and provides the security tools to manage all of the security functions.
","evaluation_configuration":"","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Junos OS 18.1R3 for MX240, MX480, MX960, MX2008, MX2010, MX2020, EX9204, EX9208 and EX9214 is evaluated as described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. Acumen Security determined that the evaluation is a Collaborative Protection Profile for Network Devices, Version 2.0 + Errata 20180314 (NDcPPv2.0e). The product, when delivered configured as identified in the Operational User Guidance and Preparative Procedures, satisfies all of the security functional requirements stated in the Security Target. The project underwent CCEVS Validator review. The evaluation was completed in February 2019. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nThe logical boundary of the TOE includes those security functions implemented exclusively by the TOE.
\r\nProtected Communications
\r\nThe TOE provides an SSH server to support protected communications for administrators to establish secure sessions and to connect to external syslog servers. The TOE requires that applications exchanging information with it are successfully authenticated prior to any exchange (i.e. applications connecting over SSH). The TOE includes cryptographic modules that provide the underlying cryptographic services, including key management and protection of stored keys, algorithms, random bit generation and crypto-administration. The cryptographic modules provide confidentiality and integrity services for authentication and for protecting communications with connecting applications.
\r\n\r\n
Administrator Authentication
\r\nAdministrative users must provide unique identification and authentication data before any administrative access to the system is granted. Authentication data entered and stored on the TOE is protected. The TOE can be configured to terminate interactive user sessions and to present an access banner with warning messages prior to authentication.
\r\n\r\n
Correct Operation
\r\nThe TOE provides for both cryptographic and non-cryptographic self-tests and is capable of automated recovery from failure states.
\r\n\r\n
Trusted Update
\r\nThe administrator can initiate update of the TOE firmware. The integrity of any firmware updates is verified prior to installation of the updated firmware.
\r\n\r\n
Audit
\r\nJunos auditable events are stored in the syslog files on the appliance and can be sent to an external log server (via Netconf over SSH). Auditable events include start-up and shutdown of the audit functions, authentication events, as well as other events listed in the Security Target. Audit records include the date and time, event category, event type, username, and the outcome of the event (success or failure). Local syslog storage limits are configurable and are monitored. In the event of storage limits being reached the oldest logs will be overwritten.
\r\n\r\n
Management
\r\nThe TOE provides a Security Administrator role that is responsible for:
\r\n• the configuration and maintenance of cryptographic elements related to the establishment of secure connections to and from the evaluated product
\r\n• the regular review of all audit data;
\r\n• initiation of trusted update function;
\r\n• all administrative tasks (e.g., creating the security policy).
\r\nThe devices are managed through a Command Line Interface (CLI). The CLI is accessible through local (serial) console connection or remote administrative (SSH) session.
","features":[]}