The Cisco Catalyst 9800 Series Wireless Controllers and Access Points 17.12 Target of Evaluation (TOE) provides wireless clients access to resources on an organization's network.
\r\nThe TOE is comprised of two distinct components:
\r\nRefer to Tables 3 and 4 in the ST for a description of the hardware and software components that comprise the physical boundary of the TOE.
\r\nThe TOE uses IEEE 802.1X to ensure Supplicants are authenticated prior to allowing wireless client traffic onto the organization’s wired network. Encryption keys for wireless sessions are derived using AES-CCMP for encryption and message integrity with cryptographic key size of 128 bits in accordance with the IEEE 802.11-2020 standard. AES-CCMP-128 bit encryption as specified in 802.11-2020 is more commonly known by its Wi-Fi Alliance certification name, WPA3-Enterprise.
\r\nAdditionally, the TOE derives wireless encryption keys using AES-CCMP with cryptographic key size of 256 bits and AES-GCMP, with cryptographic key size of 128 and 256 bits in accordance with the IEEE 802.11ax-2021 specification.
\r\nThe WLC is responsible for all management of the APs. Once an AP has registered with the WLC, an internal channel is formed for the purposes of centralized management and configuration of the APs. No local administration is available directly on the APs. The internal channel also protects the distribution of IEEE keys between the WLC and AP.
\r\nFor connections to the Syslog audit server, the WLC authenticates those devices with X.509v3 certificates and protects communication channels with the IPsec protocol. For RADIUS, the WLC protects communication to the RADIUS authentication server with RADsec. Secure remote administration is protected with HTTPS and SSH which is implemented with authentication failure handling.
","evaluation_configuration":"The Cisco Catalyst 9800 Series Wireless Controllers and Access Points 17.12 TOE is distributed. Deployment of the TOE in its evaluated configuration consists of one Wireless LAN Controller (WLC) model and at least one Access Point (AP) model specified in table 3 in the ST. Extra instances of a WLC or AP TOE component are permitted in the evaluated configuration. The evaluated configuration of Cisco Catalyst 9800-CL (vSphere) follows vND evaluated configuration Case 1 in [NDcPP] where a virtual Network Device (vND) runs inside a virtual machine (VM) on purpose-built hardware.
\r\nThe TOE physical boundary is the WLC and AP components as denoted by hashed red lines in figure 1 below.
\r\n\r\nThe WLC can be administered interactively using a local console connection (CLI), or remotely over HTTPS (GUI) or SSH (CLI). Once the APs have registered with a Controller and ‘joined’ to form the TOE, the APs are entirely managed via the WLC. The TOE does not permit direct local administration of the APs thus fulfilling distributed TOE use case 1 in section 3.1 of [NDcPP].
\r\nThe operational environment of the TOE will include at least one RADIUS server for authentication of wireless clients. The RADIUS Authentication Server and wireless client (Supplicant) must authenticate each other with EAP-TLS which requires use of X.509 certificates provided by the CA server. The operational environment requires a CA server to provide the TOE, Authentication Server, and Wireless clients with valid X.509 certificates. The environment will also include an audit (syslog) server and a Management Workstation.
\r\nThe TOE supports two modes of operation, Local mode and Flex Connect mode. In Local mode, the Access Point processes layer 2 wireless frames which are tunneled to the Controller over an internal channel protected with DTLS. In Local mode the WLC is the single point of ingress and egress for both management (TSF data) and user data traffic. When user data traffic reaches the WLC, it is mapped to a corresponding interface (VLAN) or interface group (VLAN pool) defined as part of the WLAN configuration settings on the WLC.
\r\nFlex Connect mode is similar to Local mode in that the AP handles functions from the 802.11 specification. The difference with Flex Connect is it allows an option for user data to be distributed at the egress (wired) port of the AP as IEEE 802.3 Ethernet traffic. This mode allows authenticated wireless clients access to resources local to the AP which is particularly useful in small remote and branch offices across WAN links where only a handful of access points are needed. In Flex Connect mode, the WLC is the point of ingress and egress for management traffic (TSF data) only.
\r\nRegardless of either mode it may operate in, the AP is always centrally managed by the WLC and management traffic (TSF data) is secured in an internal channel protected with DTLS. Wireless clients are authenticated by a centralized authentication server when the TOE operates in either Local or Flex Connect mode.
","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the product meets the security requirements contained in the Security Target. The criteria against which the Cisco Catalyst 9800 Series Wireless Controllers and Access Points 17.12 was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 5. The product, when configured as identified in the Cisco Catalyst 9800 Series Wireless Controllers and Access Points 17.12 CC Configuration Guide, Version 0.9, satisfies all of the security functional requirements stated in the Cisco Catalyst 9800 Series Wireless Controllers and Access Points 17.12 Security Target, Version 1.2. The project underwent CCEVS Validator review. The evaluation was completed in April 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11456-2025) prepared by CCEVS.Â
","environmental_strengths":"The TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below.
\r\nThese features are described in more detail in the subsections below.
\r\n\r\nAuditing allows Security Administrators to discover intentional and unintentional issues with the TOE’s configuration and/or operation. Auditing of administrative activities provides information that may be used to hasten corrective action should the system be configured incorrectly. Security audit data can also provide an indication of failure of critical portions of the TOE (e.g. a communication channel failure or anomalous activity (e.g. establishment of an administrative session at a suspicious time, repeated failures to establish sessions or authenticate to the TOE) of a suspicious nature.
\r\nThe TOE provides extensive capabilities to generate audit data targeted at detecting such activity. The TOE generates an audit record for each auditable event. Each security relevant audit event has the date, timestamp, event description, and subject identity. The AP transmits its audit messages to the WLC where they are stored along with the WLC's own audit messages in a circular audit trail configurable by the Security Administrator. All audit logs are transmitted to an external audit server over a trusted channel protected with IPsec.
\r\n\r\nThe TOE provides a secure internal channel, under control of the Security Administrator, for Access Points to register and join the WLC to form a distributed TOE.
\r\n\r\nThe TOE provides cryptographic functions in order to implement HTTPS, DTLS, SSH, IPsec, WPA2, and IEEE 802.11ax-2021 protocols. The cryptographic algorithm implementation has been validated for CAVP conformance. This includes key generation and random bit generation, key establishment methods, key destruction, and the various types of cryptographic operations to provide AES encryption/decryption, signature verification, hash generation, and keyed hash generation. All cryptography is implemented using the IOS Common Cryptographic Module (IC2M) Rel5a and CiscoSSL FOM 7.3 cryptographic modules. IC2M Rel5a applies to the WLC and CiscoSSL FOM 7.3 applies to the WLC and the AP. SSH and IPsec protocols are implemented using the IOS Common Cryptographic Module (IC2M) and TLS and DTLS protocols are implemented using the CiscoSSL FOM cryptographic modules. Refer to Table 22 in the ST for identification of the relevant CAVP certificates.
\r\nIn addition, the IEEE 802.11 implementation has been validated by the Wi-Fi Alliance for WPA2 certification. Refer to Table 23 in the ST for identification of the relevant Wi-Fi Alliance certificates.
\r\nIdentification and Authentication
\r\nThe TOE facilitates authentication of wireless clients by performing the role of Authenticator in an 802.1X authentication exchange.
\r\nDuring the 802.1X authentication exchange, the wireless client software responsible for authentication (hereinafter referred to as a Supplicant) is relayed through the WLC. The 802.1X frames carry EAP authentication packets which are passed through to the RADIUS Authentication Server. The TOE creates a virtual port for each wireless client that is attempting access and blocks access until the RADIUS server returns an authentication success message and 802.11 wireless encryption keys are derived and installed on both the Supplicant and AP. After that point 802.11 wireless data frames from the wireless client are allowed to pass as 802.3 Ethernet frames on the network.
\r\nThe TOE provides two types of authentication to provide a trusted means for Security Administrators and remote endpoints to interact with a WLAN Access System: X.509v3 certificate-based authentication for remote devices and password-based authentication for Security Administrators. Device-level authentication allows the TOE to establish a secure communication channel with remote endpoints.
\r\nSecurity Administrators have the ability to compose strong passwords (between 8 and 16 characters) which are stored in an obscured form. Additionally, the TOE detects and tracks successive unsuccessful remote authentication attempts and will prevent the offending account from making further attempts until a Security Administrator time period has elapsed or until the Administrator manually unblocks the account.
\r\n\r\nThe TOE provides secure remote administrative interface and local interface to perform security management functions. This includes ability to configure cryptographic functionality; an access banner containing an advisory notice and consent warning message; a session inactivity timer before session termination as well as an ability to update TOE software.
\r\nThe APs are managed via the WLC. Direct local administration of the APs is not supported.
\r\nThe TOE provides a Security Administrator role and only the Security Administrator can perform the above security management functions. The TOE prevents attempts to perform remote administration from a wireless client.
\r\n\r\nThe TOE protects critical security data including keys and passwords against tampering by untrusted subjects. The TOE provides reliable timestamps to support monitoring local and remote interactive administrative sessions for inactivity, validating X.509 certificates (to determine if a certificate has expired), denying session establishment of wireless clients (based on time), and to support accurate audit records.
\r\nThe TOE provides self-tests to ensure it is operating correctly, including the ability to detect software integrity failures. Additionally, the TOE provides an ability to perform software updates and to verify those software updates are from Cisco Systems, Inc.
\r\n\r\nThe TOE monitors both local and remote admin sessions for inactivity and terminates when a threshold time period is reached. Once a session has been terminated the TOE requires the user to re-authenticate.
\r\nThe TOE is capable of denying wireless client session establishment based on time, day, and WLAN SSID.
\r\nThe TOE also displays a Security Administrator specified advisory notice and consent warning message prior to initiating identification and authentication for each administrative user.
\r\n\r\nThe TOE provides encryption (protection from disclosure and detection of modification) for communication channels/paths between itself and remote endpoints and TOE administrators. Specifically, the TOE allows a trusted path to be established to itself from the remote authorized administrator over SSH and TLS/HTTPS. The TOE also initiates an outbound IPsec trusted channel to transmit audit messages to a remote syslog server.
\r\nIn addition, the TOE provides two-way authentication of each endpoint in a cryptographically secure manner, meaning that even if there was a malicious attacker between the two endpoints, any attempt to represent themselves to either endpoint of the communications path as the other communicating party would be detected.
","features":[{"id":347,"feature_name":"Asymmetric Key Generation"},{"id":339,"feature_name":"Auditing"},{"id":372,"feature_name":"Certificate Authentication"},{"id":355,"feature_name":"Certificate Validation"},{"id":352,"feature_name":"Cryptographic Hashing"},{"id":348,"feature_name":"Cryptographic Key Establishment"},{"id":351,"feature_name":"Cryptographic Signature Verification"},{"id":343,"feature_name":"DRBG"},{"id":361,"feature_name":"DTLS 1.2"},{"id":385,"feature_name":"DTLS Client"},{"id":356,"feature_name":"DTLS Server with Mutual Authentication"},{"id":377,"feature_name":"EAP-TLS"},{"id":367,"feature_name":"HTTPS Client"},{"id":1547,"feature_name":"HTTPS Server without Mutual Authentication"},{"id":370,"feature_name":"IKEv2"},{"id":369,"feature_name":"IPsec"},{"id":341,"feature_name":"Key Destruction"},{"id":354,"feature_name":"Keyed-hash message authentication"},{"id":378,"feature_name":"RadSec"},{"id":366,"feature_name":"SSH Server"},{"id":363,"feature_name":"TLS 1.2"},{"id":365,"feature_name":"TLS Client"},{"id":362,"feature_name":"TLS Server without Mutual Authentication"},{"id":345,"feature_name":"Virtual Network Device"},{"id":379,"feature_name":"Wi-Fi 6"},{"id":376,"feature_name":"WLAN Access System"},{"id":381,"feature_name":"WPA2"},{"id":380,"feature_name":"WPA3"}]}