The TOE is comprised of the SonicWall SonicOS/X v7.0.1 software running either on purpose built TZ, NSa, NSsp, series hardware appliance platforms and NSv virtual appliances running on purpose built ESXi hardware appliances.
\r\n
The appliance next generation firewall capabilities include stateful packet inspection. Stateful packet inspection maintains the state of network connections, such as Transmission Control Protocol (TCP) streams and User Datagram Protocol (UDP) communication, traveling across the firewall. The firewall distinguishes between legitimate packets and illegitimate packets for the given network deployment. Only packets adhering to the administrator-configured access rules are permitted to pass through the firewall; all others are rejected.
The appliance capabilities include deep-packet inspection (DPI) used for intrusion prevention and detection. These services employ stream-based analysis wherein traffic traversing the product is parsed and interpreted so that its content might be matched against a set of signatures to determine the acceptability of the traffic. Only traffic adhering to the administrator-configured policies is permitted to pass through the TOE.
The appliances support Virtual Private Network (VPN) functionality, which provides a secure connection between the device and the audit server. The appliances support authentication and protect data from disclosure or modification during transfer.
The appliances are managed through a web based Graphical User Interface (GUI). All management activities may be performed through the web management GUI via a hierarchy of menu buttons. Administrators may configure policies and manage network traffic, users, and system logs. The appliances also have local console access where limited administrative functionality to configure the network, perform system updates, and view logs.
The Section 1.2 and 1.3 of the ST provides an overview of the TOE architecture, including physical boundaries, security functions, and relevant TOE documentation and references.
\r\n\r\n
The TOE supports secure connectivity with several other IT environment devices as described below.
\r\nEnvironmental Components for TOE
\r\n| \r\n Component \r\n | \r\n\r\n Required \r\n | \r\n\r\n Usage/Purpose Description \r\n | \r\n
| \r\n TOE Hardware \r\n | \r\n\r\n Yes \r\n | \r\n\r\n The Sonicwall TZ, NSa, and NSsp, physical hardware models \r\n | \r\n
| \r\n TOE Virtual Hardware \r\n | \r\n\r\n Yes \r\n | \r\n\r\n Virtual hardware provided by VMware vShpere ESXi 7.0 and ESXi 8.0 on Dell PowerEdge R640. \r\n | \r\n
| \r\n Management Workstation \r\n | \r\n\r\n Yes \r\n | \r\n\r\n This includes any IT Environment Management workstation \r\n | \r\n
| \r\n Audit Server \r\n | \r\n\r\n Yes \r\n | \r\n\r\n An audit server supporting the syslog protocol with an IPsec peer supporting IKEv2 and ESP in the cryptographic protocols defined in 5.2.2.6 of this document. \r\n | \r\n
| \r\n Management Console \r\n | \r\n\r\n Yes \r\n | \r\n\r\n Any computer that provides a supported browser may be used to access the GUI \r\n | \r\n
The TOE is a software and hardware TOE. It is a combination of TZ, NSa, NSsp, and NSv hardware/software appliance and the SonicOS/X 7.0.1 software. The following table lists all the instances of the TOE that operate in the evaluated configuration. All listed TOE instances offer the same core functionality but vary in number of processors, physical size, and supported connections.
\r\nThe physical boundary of the TOE includes the Sonicwall TZ, NSa, NSsp hardware models shown in Table 3 and the virtual appliances and related hardware shown in Table 4 running Sonicwall SonicOS/X software identified in table 1. The virtual appliances are evaluated as virtual Network Devices (vND) which is case 1 of Section 1.2 of NDcPP v2.2e. The physical TOE is shipped to the customer via commercial courier. The virtual appliance’s deployment packages can be downloaded from the https://www.mysonicwall.com site.
\r\n\r\n
Physical Boundary Components for TOE hardware models
\r\n| \r\n\r\n | \r\n\r\n Appliance Model \r\n | \r\n\r\n Operational Environment \r\n | \r\n\r\n Microarchitecture \r\n | \r\n
| \r\n TZ \r\n | \r\n\r\n TZ 670 \r\n | \r\n\r\n Marvell CN9130 \r\n | \r\n\r\n Quad Core Armv8 Cortex-A72 \r\n | \r\n
| \r\n TZ 570 \r\n | \r\n\r\n Marvell CN9130 \r\n | \r\n\r\n Quad Core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n TZ 570W \r\n | \r\n\r\n Marvell CN9130 \r\n | \r\n\r\n Quad Core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n TZ 570P \r\n | \r\n\r\n Marvell CN9130 \r\n | \r\n\r\n Quad Core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n TZ 470 \r\n | \r\n\r\n Marvell 88F7040 \r\n | \r\n\r\n Quad core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n TZ 470W \r\n | \r\n\r\n Marvell 88F7040 \r\n | \r\n\r\n Quad core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n TZ 370 \r\n | \r\n\r\n Marvell 88F7040 \r\n | \r\n\r\n Quad core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n TZ 370W \r\n | \r\n\r\n Marvell 88F7040 \r\n | \r\n\r\n Quad core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n TZ 270 \r\n | \r\n\r\n Marvell 88F7040 \r\n | \r\n\r\n Quad core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n TZ 270W \r\n | \r\n\r\n Marvell 88F7040 \r\n | \r\n\r\n Quad core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n NSa \r\n | \r\n\r\n NSa 2700 \r\n | \r\n\r\n Marvell CN9130 \r\n | \r\n\r\n Quad Core Armv8 Cortex-A72 \r\n | \r\n
| \r\n NSa 3700 \r\n | \r\n\r\n Marvell CN9130 \r\n | \r\n\r\n Quad Core Armv8 Cortex-A72 \r\n | \r\n|
| \r\n NSa 4700 \r\n | \r\n\r\n Intel Xeon D-2123IT \r\n | \r\n\r\n Skylake \r\n | \r\n|
| \r\n NSa 5700 \r\n | \r\n\r\n Intel Xeon D-2123IT \r\n | \r\n\r\n Skylake \r\n | \r\n|
| \r\n NSa 6700 \r\n | \r\n\r\n Intel Xeon D-2123IT \r\n | \r\n\r\n Skylake \r\n | \r\n|
| \r\n NSsp \r\n | \r\n\r\n NSsp 10700 \r\n | \r\n\r\n Intel Xeon D-2166NT \r\n | \r\n\r\n Skylake \r\n | \r\n
| \r\n NSsp 11700 \r\n | \r\n\r\n Intel Xeon D-2166NT \r\n | \r\n\r\n Skylake \r\n | \r\n|
| \r\n NSsp 13700 \r\n | \r\n\r\n Intel Xeon D-2187NT \r\n | \r\n\r\n Skylake \r\n | \r\n
\r\n
\r\n
Physical Boundary Components for TOE Virtual Appliance
\r\n| \r\n Appliance Series \r\n | \r\n\r\n Appliance Model \r\n | \r\n\r\n Operational Environment \r\n | \r\n
| \r\n NSv \r\n | \r\n\r\n NSv 270 \r\n | \r\n\r\n ESXi 7.0 and 8.0 on Dell PowerEdge R640 (Running on Intel Xeon Silver 4208 (Cascade Lake)) \r\n | \r\n
| \r\n NSv 470 \r\n | \r\n||
| \r\n NSv 870 \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Sonicwall SonicOS/X v7.0.1 with VPN and IPS on TZ, NSa, NSsp, and NSv Appliances was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the ST. The project underwent CCEVS Validator review. The evaluation was completed in January 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by the Collaborative Protection Profile for Network Devices, hereafter referred to as NDcPP v2.2e or NDcPP, collaborative Protection Profile Module for Stateful Traffic Filter Firewall, hereafter referred to as MOD_FW v1.4e or MOD_FW, PP-Module for VPN Gateways Version 1.3 hereafter referred to as MOD_VPNGW v1.3 or MOD_VPNGW, PP-Module for Intrusion Protection Systems (IPS) Version 1.0, hereafter referred to as MOD_IPS v1.0 or MOD_IPS.
\r\n\r\n
The TOE generates audit records for administrative activity, security related configuration changes, cryptographic key changes and startup and shutdown of the audit functions. The audit events are associated with the administrator who performs them, if applicable. The audit records are transmitted over an IPsec VPN tunnel to an external audit server in the IT environment for storage.
\r\n\r\n
The TOE provides cryptographic functions (key generation, key establishment, key destruction, cryptographic operation) to secure remote administrative sessions over Hypertext Transfer Protocol Secure (HTTPS)/Transport Layer Security (TLS), and to support Internet Protocol Security (IPsec) to provide VPN functionality and to protect the connection to the audit server.
\r\n\r\n
The TOE ensures that data cannot be recovered once deallocated.
\r\n\r\n
The TOE provides a password-based logon mechanism. This mechanism enforces minimum strength requirements and ensures that passwords are obscured when entered. The TOE also validates and authenticates X.509 certificates for all certificate use.
\r\n\r\n
The TOE provides management capabilities via a Web-based GUI, accessed over HTTPS. Management functions allow the administrators to configure and update the system, manage users and configure the Virtual Private Network (VPN) and Intrusion Prevention System (IPS) functionality.
\r\n\r\n
The TOE prevents the reading of plaintext passwords and keys. The TOE provides a reliable timestamp for its own use. To protect the integrity of its security functions, the TOE implements a suite of self-tests at startup and shuts down if a critical failure occurs. The TOE verifies the software image when it is loaded. The TOE ensures that updates to the TOE software can be verified using a digital signature.
\r\n\r\n
The TOE monitors local and remote administrative sessions for inactivity and either locks or terminates the session when a threshold time period is reached. An advisory notice is displayed at the start of each session.
\r\n\r\n
The TSF provides IPsec VPN tunnels for trusted communication between itself and an audit server. The TOE implements HTTPS for protection of communications between itself and the Management Console.
\r\n\r\n
The TOE performs analysis of IP-based network traffic and detects violations of administratively defined IPS policies. The TOE inspects each packet header and payload for anomalies and known signature-based attacks and determines whether to allow traffic to traverse the TOE.
\r\n\r\n
The TOE restricts the flow of network traffic between protected networks and other attached networks based on addresses and ports of the network nodes originating (source) and/or receiving (destination) applicable network traffic, as well as on established connection information.
\r\nThe TOE performs packet filtering on network packets.
","features":[{"id":1429,"feature_name":"Asymmetric Key Generation"},{"id":1425,"feature_name":"Auditing"},{"id":1437,"feature_name":"Certificate Authentication"},{"id":1434,"feature_name":"Certificate Validation"},{"id":1432,"feature_name":"Cryptographic Hashing"},{"id":1430,"feature_name":"Cryptographic Key Establishment"},{"id":1431,"feature_name":"Cryptographic Signature Verification"},{"id":1427,"feature_name":"DRBG"},{"id":1446,"feature_name":"Firewall"},{"id":1438,"feature_name":"IKEv2"},{"id":1448,"feature_name":"Intrusion Prevention"},{"id":1436,"feature_name":"IPsec"},{"id":1426,"feature_name":"Key Destruction"},{"id":1433,"feature_name":"Keyed-hash message authentication"},{"id":1440,"feature_name":"TLS 1.2"},{"id":1435,"feature_name":"TLS Server without Mutual Authentication"},{"id":1428,"feature_name":"Virtual Network Device"},{"id":1451,"feature_name":"VPN Gateway"}]}