The Target of Evaluation (TOE) is Aruba Mobility Controller with ArubaOS 8.10. The TOE is a multi-purpose network device that includes WLAN access system, stateful traffic filter firewall and VPN gateway capabilities. The Aruba Mobility Controller platform serves as a gateway between wired and wireless networks and provides command and control over Aruba Access Points (APs) within an Aruba dependent wireless network.
\r\nThe Aruba Mobility Controllers (MCs) and Aruba Virtual Mobility Controllers (VMCs) are wireless switch hardware and virtual appliances that provide a wide range of security services and features including wireless and wired network mobility, security, centralized management, auditing, authentication, secure remote access, self-verification of integrity and operation, stateful traffic filtering and VPN gateway functionality.
\r\nThe ArubaOS is a suite of mobility applications that runs on all Aruba controllers and allows administrators to configure and manage the wireless and mobile user environment. The TOE is generally deployed in a configuration consisting of one or more Aruba mobility controllers (MC and/or VMC) and multiple Aruba wireless APs.
\r\nThe TOE performs stateful packet filtering on network packets processed by the TOE. Filtering rules may be applied to appliance Ethernet interfaces and to user roles (for wireless clients as described above) to allow fine grained control over network traffic.
\r\nAs a VPN gateway – a device at the edge of a private network that terminates an IPsec tunnel – the TOE provides device authentication, confidentiality, and integrity of information traversing a public or untrusted network. The TOE provides packet filtering and secure IPsec tunneling. This functionality may be used with VPN clients or with other VPN gateways (i.e. site-to-site VPN).
\r\n\r\n
In an encrypted WLAN, a wireless client first associates to the Mobility Controller through an AP and then authenticates (IEEE 802.11i[1]) using credentials to obtain access to the network. The authenticated wireless client is then assigned a role based on the configuration in the Mobility Controller or the authentication server. The role, in turn, maps a set of firewall policies to the client’s session such that all wireless client traffic passes through a logical firewall component before traffic is forwarded outside of the Mobility Controller. The client’s role can also be used to determine VLAN membership.
\r\n[1] Implements 802.1X for wireless access points to address the security vulnerabilities found in WEP.
\r\nThe evaluated configuration consists of the Aruba Mobility Controller with ArubaOS version 8.10 and the following required software licenses:
\r\n· Policy Enforcement Firewall
\r\n· RFprotect
\r\n· Advanced Cryptography
\r\n\r\n
The TOE includes the following hardware and virtual appliance models:
\r\nMobility Controller Hardware Appliances
\r\n| \r\n Product Model \r\n | \r\n\r\n CPU \r\n | \r\n
| \r\n Aruba 9004 Mobility Controller \r\n | \r\n\r\n Intel Atom C3508 (Denverton) \r\n | \r\n
| \r\n Aruba 9012 Mobility Controller \r\n | \r\n\r\n Intel Atom C3508 (Denverton) \r\n | \r\n
| \r\n Aruba 9240 Mobility Controller \r\n | \r\n\r\n Intel Atom C3508 (Denverton) \r\n | \r\n
| \r\n Aruba 7005 Mobility Controller \r\n | \r\n\r\n Broadcom XLP208 (MIPS64) \r\n | \r\n
| \r\n Aruba 7008 Mobility Controller \r\n | \r\n\r\n Broadcom XLP208 (MIPS64) \r\n | \r\n
| \r\n Aruba 7010 Mobility Controller \r\n | \r\n\r\n Broadcom XLP208 (MIPS64) \r\n | \r\n
| \r\n Aruba 7024 Mobility Controller \r\n | \r\n\r\n Broadcom XLP208 (MIPS64) \r\n | \r\n
| \r\n Aruba 7030 Mobility Controller \r\n | \r\n\r\n Broadcom XLP208 (MIPS64) \r\n | \r\n
| \r\n Aruba 7205 Mobility Controller \r\n | \r\n\r\n Broadcom XLP316 (MIPS64) \r\n | \r\n
| \r\n Aruba 7210 Mobility Controller \r\n | \r\n\r\n Broadcom XLP416 (MIPS64) \r\n | \r\n
| \r\n Aruba 7220 Mobility Controller \r\n | \r\n\r\n Broadcom XLP432 (MIPS64) \r\n | \r\n
| \r\n Aruba 7240 Mobility Controller \r\n | \r\n\r\n Broadcom XLP432 (MIPS64) \r\n | \r\n
| \r\n Aruba 7240XM Mobility Controller \r\n | \r\n\r\n Broadcom XLP432 (MIPS64) \r\n | \r\n
| \r\n Aruba 7280 Mobility Controller \r\n | \r\n\r\n Broadcom XLP780 (MIPS64) \r\n | \r\n
Table 1 Mobility Controller Hardware Appliances
\r\n\r\n
The table below shows the different model series based on maximum number of APs and users supported.
\r\n| \r\n Product \r\n | \r\n\r\n Max. # of APs \r\n | \r\n\r\n Max. # of Users \r\n | \r\n\r\n Typical Deployment \r\n | \r\n
| \r\n Aruba 7000 Series \r\n | \r\n\r\n 64 \r\n | \r\n\r\n 4,096 \r\n | \r\n\r\n Branch Office/ Small Campus \r\n | \r\n
| \r\n Aruba 7200 Series \r\n | \r\n\r\n 2,048 \r\n | \r\n\r\n 32,768 \r\n | \r\n\r\n Headquarters / Large Campus \r\n | \r\n
| \r\n Aruba 9000 Series \r\n | \r\n\r\n 32 \r\n | \r\n\r\n 2,048 \r\n | \r\n\r\n Branch Office / Small Campus \r\n | \r\n
Table 2 Mobility Controller Deployments
\r\n\r\n
Mobility Controller Virtual Appliances
\r\n\r\n
The table below shows the different virtual models based on maximum number of APs and clients supported.
\r\n| \r\n Aruba Mobility Controller Virtual Appliance \r\n | \r\n\r\n MC-VA-50 \r\n | \r\n\r\n MC-VA-250 \r\n | \r\n\r\n MC-VA-1K \r\n | \r\n
| \r\n Maximum AP Count \r\n | \r\n\r\n 50 APs \r\n | \r\n\r\n 250 APs \r\n | \r\n\r\n 1,000 APs \r\n | \r\n
| \r\n Maximum Client Count \r\n | \r\n\r\n 800 \r\n | \r\n\r\n 4,000 \r\n | \r\n\r\n 16,000 \r\n | \r\n
Table 3 MC Virtual Appliance Models and Capacities
\r\n\r\n\r\n
The Mobility Controller Virtual Appliances are deployed on ESXi version 7. The following virtual machine platforms are included in the evaluated configuration:
\r\n| \r\n Name \r\n | \r\n\r\n CPU \r\n | \r\n\r\n Memory \r\n | \r\n
| \r\n HPE EdgeLine EL8000 \r\n | \r\n\r\n Intel Xeon Gold 6212U (Cascade Lake) \r\n | \r\n\r\n 128GB \r\n | \r\n
| \r\n Pacstar 451/3 \r\n | \r\n\r\n Intel Xeon E-2254ML (Coffee Lake) \r\n | \r\n\r\n 32GB \r\n | \r\n
| \r\n Pacstar 451/3 \r\n | \r\n\r\n Intel Xeon E3 1515 (Skylake) \r\n | \r\n\r\n 32GB \r\n | \r\n
| \r\n GTS NXGEN-L11/12 \r\n | \r\n\r\n Intel Core i7 (Coffee Lake) \r\n | \r\n\r\n 16GB \r\n | \r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Aruba Common Criteria Configuration Guidance Aruba OS 8.10 Supplemental Guidance, Version 2.0, April 2023 document, satisfies all of the security functional requirements stated in the Aruba Mobility Controller with ArubaOS 8.10 Security Target, Version 0.5, May 19, 2023. The project underwent CCEVS Validator review. The evaluation was completed in May 2023. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11333-2023) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Aruba Mobility Controller with ArubaOS 8.10 are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Security audit:
\r\nThe TOE is designed to be able to generate logs for a wide range of security relevant events including start-up and shutdown of the TOE, all administrator actions, and all events identified in Table 8 Auditable Events of the Security Target. The TOE can be configured to store the logs locally so they can be accessed by an administrator or alternately to send the logs to a designated syslog server in the operational environment.
\r\nCryptographic support:
\r\nThe TOE includes cryptographic modules that provide key management, random bit generation, encryption/decryption, digital signature and secure hashing and key-hashing features in support of higher-level cryptographic protocols including IPsec, SSH, and TLS/HTTPS.
\r\nUser data protection:
\r\nThe TOE ensures that any data packets passing through do not inadvertently contain any residual information that might be disclosed inappropriately.
\r\nFirewall:
\r\nThe TOE performs stateful packet filtering. Filtering rules may be applied to appliance Ethernet interfaces or to user-roles (wireless clients connecting through APs are placed into user-roles). Stateful packet filter policies are applied to user-roles to allow fine grained control over wireless traffic.
\r\nIdentification and authentication:
\r\nThe TOE requires administrators to be identified and authenticated before they can access any TOE security functions. The TOE supports role-based authentication, so user accounts are assigned predefined roles which restrict them based on their assigned role. The TOE maintains these administrator and user attributes which can be defined locally with user names and passwords or can be defined in the context of local RADIUS or TACACS+ services. Authentication can be either locally or remotely through an external authentication server, or internally. Wireless clients are identified and authenticated by different authentication mechanisms such as 802.1X, etc. After an administrator-specified number of failed attempts, the user account is locked out. The TOE’s password mechanism provides configuration for a minimum password length. The TOE also protects, stores and allows authorized administrators to load X.509.v3 certificates for use to support authentication for IPsec connections.
\r\nSecurity management:
\r\nThe TOE provides the administrator role the capability to configure and manage all TOE security functions including cryptographic operations, user accounts, passwords, advisory banner, session inactivity and TOE updates. The management functions are restricted to the administrator role. The role must have the appropriate access privileges or access will be denied. The TOE’s cryptographic functions ensure that only secure values are accepted for security attributes.
\r\nPacket filtering:
\r\nThe TOE may be used as a VPN gateway – a device at the edge of a private network that terminates an IPsec tunnel, which provides device authentication, confidentiality, and integrity of information traversing a public or untrusted network. The TOE provides packet filtering and secure IPsec tunneling. The tunnels can be established between two trusted VPN peers as well as between remote VPN clients and the TOE. An administrator can configure security policies that determine whether to block, allow, or log a session based on traffic attributes such as the source and destination security zone, the source and destination IP address, the application, user, and the service.
\r\nProtection of the TSF:
\r\nThe TOE has its own internal hardware clock that provides reliable time stamps used for auditing. The internal clock may be synchronized with a time signal obtained from an external trusted NTP server. The TOE stores passwords on flash using a SHA1 hash and does not provide any interfaces that allow passwords or keys to be read.
\r\nThe TOE runs self-tests during power up and periodically during operation to ensure the correct operation of the cryptographic functions and TSF hardware. There is an option for the administrator to verify the integrity of stored TSF executable code.
\r\nThe TOE includes mechanisms so that the administrator can determine the TOE version and update the TOE securely using digital signatures.
\r\nTOE access:
\r\nThe TOE allows administrators to configure a period of inactivity for administrator sessions. Once that time period has been reached while the session has no activity, the session is terminated. All users may also terminate their own sessions at any time. A warning banner is displayed at the management interfaces (Web GUI and CLI) to advise users on appropriate use and penalty for misuse of system.
\r\nIn order to limit access to the administrative functions, the TOE can be configured to deny remote VPN clients based on the time/date, IP address (location), as well as information retained in a blacklist. The TOE assigns a private IP address (internal to the trusted network for which the TOE is the headend) to a VPN client upon successful establishment of a session.
\r\nTrusted path/channels:
\r\nThe TOE uses IPsec to provide an encrypted channel between itself and third-party trusted IT entities in the operating environment including external syslog server, external authentication server, NTP server and VPN Gateway/Client.
\r\nThe TOE also provides a protected communication path between itself and wireless users. The TOE protects communication with wireless clients using WPA3 and WPA2 with 802.1x EAP-TLS.
\r\nThe TOE secures remote communication with administrators by implementing TLS/HTTPS for remote Web UI access and SSHv2 for CLI access. In each case, both the integrity and disclosure protection is ensured via the secure protocol. If the negotiation of a secure session fails or if the user cannot be authenticated for remote administration, the attempted session will not be established.
","features":[]}