The TOE is Juniper Networks, Inc. Junos OS 20.3R3 for NFX350 Network Services Platform. The NFX350 is a network device that integrates routing, switching, and security functions on a single platform.
\r\nThe NFX350 supports the definition of, and enforces, information flow policies among network nodes, also providing for stateful inspection of every packet that traverses the network and central management to manage the network security policy. All information flow from one network node to another passes through an instance of the TOE. Information flow is controlled on the basis of network node addresses, protocol, type of access requested, and services requested. In support of the information flow security functions, the TOE ensures that security-relevant activity is audited, that their own functions are protected from potential attacks, and provides the security tools to manage all of the security functions. The TOE provides multi-site virtual private network (VPN) gateway functionality, and also implements Intrusion Prevention System functionality, capable of monitoring information flows to detect potential attacks based on pre-defined attack signature and anomaly characteristics in the traffic.
\r\nThe deployment of the Junos OS 20.3R3 for NFX350 TOE includes a hypervisor, which runs a virtual machine (VM) on an NFX350 series hardware model:
\r\n· NFX350-S1
\r\n· NFX350-S2
\r\n· NFX350-S3
","evaluation_configuration":"The TOE includes a Linux Operating System (OS), Junos Control Plane (JCP), a Juniper Device Manager (JDM) and an Open vSwitch (OVS) bridge. NFX350 supports the installation of 3rd party VMs and containers, but installation of 3rd party VMs and containers is not allowed in the evaluated configuration. Figure 1 below shows the general architecture for the NFX350.
\r\nNFX350 is running on Wind River Linux 8 as its host OS. The host OS functions as a hypervisor and runs natively on an Intel Xeon D processor.
\r\nJunos Control Plane (JCP) is the Junos VM running on the host OS. JCP is used to configure the network ports of the NFX350 device, and JCP runs by default as vjunos0 on NFX350. The JCP functions as the single point of management for all the components. The JCP supports:
\r\n· Layer 2 to Layer 3 routing services
\r\n· Layer 3 to Layer 4 security services
\r\n· Layer 4 to Layer 7 advanced security services
\r\nIn addition, the JCP enables virtualized network functions (VNF) lifecycle management. VNF is a virtualized implementation of a network device and its functions. In the NFX350 NextGen architecture, Linux functions as the hypervisor, and it creates and runs the VNFs. The VNFs include functions such as firewalls, routers, and WAN accelerators.
\r\nThe JCP VM is the single administration point for the NFX350 platform. It is the front-end for all functionality provided by the NFX350 software. Logging in via console of SSH take the user to a CLI prompt on the JCP VM. This CLI is the single point of configuration for all NFX350 services.
\r\n1.1.2.1 L2 Data Plane
\r\nL2 data plane manages the Layer 2 traffic. The L2 data plane forwards the LAN traffic to the OVS bridge. The L2 data plane is mapped to the virtual FPC0 on the JCP.
\r\n1.1.2.2 L3 Data Plane
\r\nL3 data plane provides data path functions for the Layer 3 to Layer 7 services. The L3 data plane is mapped to the virtual FPC1 on the JCP.
\r\nJDM is an application container that manages VNFs and provides infrastructure services. The JDM functions in the background. JDM is a low-footprint Linux container that provides these functions:
\r\n· Virtual Machine (VM) lifecycle management
\r\n· Device management and isolation of host OS from user installations
\r\n· NIC, single-root I/O virtualization (SR-IOV), and virtual input/output (VirtIO) interface provisioning
\r\n· Inventory and resource management
\r\n· Internal network and image management
\r\n· Service chaining—provides building blocks such as virtual interfaces and bridges for users to implement service chaining polices
\r\n· Virtual console access to VNFs including vSRX and vjunos
\r\nThe OVS bridge is a VLAN-aware system bridge that acts as the network functions virtualization backplane to which the VNFs, FPC1, and FPC0 connect.
","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Junos OS 20.3R3 NFX350 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered configured as identified in the Common Criteria Configuration Guide for NFX350 Network Services Platform, satisfies all of the security functional requirements stated in the Security Target (ST) for Junos OS 20.3R3 NFX350. The project underwent CCEVS Validator review. The evaluation was completed in June 2022. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The logical boundary of the TOE includes the following security functionality:
\r\nTable 1– TOE Logical Boundary Security Functionality
\r\n| \r\n | \r\n \r\n | \r\n
| \r\n Protected Communications \r\n | \r\n\r\n The TOE provides an SSH server to support protected communications for administrators to establish secure sessions and to connect to external syslog servers. \r\nThe TOE also supports IPsec connections to provide multi-site virtual private network (VPN) gateway functionality and also as a tunnel for remote administrate SSH connections. The TOE requires that applications exchanging information with it are successfully authenticated prior to any exchange (i.e. applications connecting over SSH and IPsec). \r\nTelnet, File Transfer Protocol (FTP), and Secure Socket Layer (SSL) are out of scope. \r\nThe TOE includes cryptographic modules that provide the underlying cryptographic services, including key management and protection of stored keys, algorithms, random bit generation and crypto-administration. The cryptographic modules provide confidentiality and integrity services for authentication and for protecting communications with adjacent systems. \r\n | \r\n
| \r\n Administrator Authentication \r\n | \r\n\r\n Administrative users must provide unique identification and authentication data before any administrative access to the system is granted. Authentication data entered and stored on the TOE is protected. The TOE can be configured to terminate interactive user sessions and to present an access banner with warning messages prior to authentication. \r\n | \r\n
| \r\n Correct Operation \r\n | \r\n\r\n The TOE provides for both cryptographic and non-cryptographic self-tests and is capable of automated recovery from failure states. \r\n | \r\n
| \r\n Trusted Update \r\n | \r\n\r\n The administrator can initiate update of the TOE software. The integrity of any software updates is verified prior to installation of the updated software. \r\n | \r\n
| \r\n Audit \r\n | \r\n\r\n TOE auditable events are stored in the syslog files in the VM filesystem and can be sent to an external log server (via Netconf over SSH). Auditable events include start-up and shutdown of the audit functions, authentication events, service requests, IPS events, as well as the events listed in Table 12 and Table 13 of the ST. Audit records include the date and time, event category, event type, username, and the outcome of the event (success or failure). Local (VM) syslog storage limits are configurable and are monitored. In the event of storage limits being reached the oldest logs will be overwritten. \r\n | \r\n
| \r\n Management \r\n | \r\n\r\n The TOE provides a Security Administrator role that is responsible for: \r\n· the configuration and maintenance of cryptographic elements related to the establishment of secure connections to and from the evaluated product \r\n· the regular review of all audit data; \r\n· initiation of trusted update function; \r\n· administration of VPN, IPS and Firewall functionality; \r\n· all administrative tasks (e.g., creating the security policy). \r\nThe devices are managed through a Command Line Interface (CLI). The CLI is accessible through local (serial) console connection or remote administrative (SSH) session. \r\nThe Security Administrator role includes the capability to manage all NFX350 services. Access to manage the device’s FreeBSD host can only be gained through the JCP. \r\n | \r\n
| \r\n Packet Filtering/Stateful Traffic Filtering \r\n | \r\n\r\n The TOE provides stateful network traffic filtering based on examination of network packets and the application of information flow rules. \r\n | \r\n
| \r\n Intrusion Prevention \r\n | \r\n\r\n The TOE can be configured to analyze IP-based network traffic forwarded to the TOE’s interfaces and detect violations of administratively-defined IPS policies. The TOE is capable of initiating a proactive response to terminate/interrupt an active potential threat, and to initiate a response in real time that would cause interruption of the suspicious traffic flow. \r\n | \r\n
| \r\n User Data Protection/Information Flow Control \r\n | \r\n\r\n The TOE is designed to forward network packets (i.e., information flows) from source network entities to destination network entities based on available routing informationusing Virtual Routers. This information is either provided directly by TOE users or indirectly from other network entities (outside the TOE) configured by the TOE users. The TOE has the capability to regulate the information flow across its interfaces; traffic filters can be set in accordance with the presumed identity of the source, the identity of the destination, the transport layer protocol, the source service identifier, and the destination service identifier (TCP or UDP port number). \r\n | \r\n