The TOE is VMware Avi Load Balancer Version 30.2.3 which is a network device running as VMware ESXi based Virtual Machine. The TOE is a distributed software TOE consisting of the VMware Avi Controller (hereafter referred to as Controller) and the VMware Avi Service Engine (hereafter referred to as SE).
The software-defined, scale-out architecture provides on-demand autoscaling of elastic load balancers. The distributed software load balancers and the backend applications can scale up or down in response to real-time traffic monitoring. Application load balancing becomes more adaptable and intelligent.
","evaluation_configuration":"The TOE is a distributed virtual TOE comprised of two components:
\r\nThe following figure represents a sample TOE deployment:
\r\nFigure 1 – Representative TOE Deployment
\r\n\r\n
The physical boundaries of the distributed TOE components are described as follows:
\r\nThe Controller and SE components are vNDs as defined in Case 1 of NDcPP. The ESXi 7.0.3 hypervisor and underlying hardware platform are part of the evaluated configuration but not included in the TOE boundary.
\r\n\r\n
The following environmental components are required to operate the TOE in the evaluated configuration:
\r\nTable 2 – TOE Required Environmental Components
\r\n| \r\n Components \r\n | \r\n\r\n Required \r\n | \r\n\r\n Purpose/Description \r\n | \r\n
| \r\n Syslog server \r\n | \r\n\r\n Required in support of FAU_STG_EXT.1 \r\n | \r\n\r\n External syslog server to which audit logs generated on the TOE are sent. \r\n | \r\n
| \r\n Management workstation \r\n | \r\n\r\n Required in support of FTP_TRP.1/Admin, FMT_SMF.1, FPT_TUD_EXT.1 \r\n | \r\n\r\n Administrator workstation from which the TOE is managed remotely and where TOE updates are uploaded from. \r\nLocal console is achieved via VMware remote administration of the Controller and SE virtual appliances respectively. \r\n | \r\n
| \r\n CA Server \r\n | \r\n\r\n Required in support of FIA_X509_EXT.1/ITT X.509 Certificate Validation, FIA_X509_EXT.2/ITT X.509 Certificate Validation \r\n | \r\n\r\n The Certificate Authority (CA) server is responsible for issuing, generating, and managing X.509 certificates used with the TOE, as well as handling certificate revocation. \r\n\r\n | \r\n
| \r\n NTP Server \r\n | \r\n\r\n Required in support of FCS_NTP_EXT.1 NTP Protocol \r\n | \r\n\r\n The Controller component implements NTP v4 for reliable time stamps in accordance with RFC 5905. \r\n | \r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the VMware Avi Load Balancer Version 30.2.3 was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the VMware Avi Load Balancer Version 30.2.3 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in May 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by the Collaborative Protection Profile for Network Devices, hereafter referred to as NDcPP v2.2e or NDcPP.
\r\nThe Controller is capable of generating audit records and maintaining a local storage which is rotated when the buffer becomes full. The SE component generated audit records and maintains them temporarily in a local buffer until it has been transferred to the Controller. The Controller component sends its audit records directly to an external syslog server over a trusted channel protected with TLS. The SE component sends its audit records to the Controller component over TLS.
\r\nThe Controller and the SE performs cryptographic functions including key generation and key establishment, symmetric encryption and decryption, hashing, keyed hash message authentication, digital signatures, and random number generation. The following cryptographic libraries is used in support of this functionality:
\r\nThese cryptographic modules were validated on Ubuntu Server 20.04 with ESXi v7.0.3 on an Intel Xeon Gold 6126 processor. The CAVP algorithm certificate details are provided in Section 6.1.
\r\nThe Controller and the SE cryptographic functionality is implemented in support of TLS v1.2 server (HTTPS) and client (Syslog over TLS) functionality, as necessary to support trusted path and channel
\r\nfunctions. Additionally, Controller provides SSHv2 server functionality for remote administration necessary to support trusted path and serves as a trusted channel for manual update functions.
\r\nRemote and local administrators are authenticated via the Controller component. Repeated failed remote authentications will lock the administrative account after a configurable threshold of attempts. Locked accounts are re-enabled after a configurable time period or can be re-enabled by another administrator. Passwords must meet a configurable minimum length and may be composed of upper-case and lower-case letters, numbers, and special characters. No functionality is available prior to successful authentication. Password characters are obscured during entry.
\r\n\r\n
The Controller and SE components support X.509v3 certificate authentication and revocation checking for the following purposes:
\r\nThe Controller is capable of generating certificate signing requests in support of authentication in the following scenarios:
\r\nThe Controller is the primary management component of the TOE and supports local management via VMware console connection as well as remote management via an HTTPS/TLS Web UI and SSH CLI.
\r\nThe following functionality is available and restricted to authorized security administrators:
\r\nAdministrative passwords are stored in the filesystem of the Controller and are protected via a salted hash. Private keys are stored in the Controller filesystems and public keys are stored in the SE and neither is readable through any TOE interface.
\r\nThe Controller and SE communicate via an internal trusted channel using TLS.
\r\nThe system clocks of the Controller and SE components are set manually by the security administrator in support of reliable time stamps. The security administrator can also synchronise time with an NTP server.
\r\nThe Controller and SE components perform a suite of cryptographic known algorithm tests, entropy noise source tests, and hash signature-based integrity test of the TOE executable code during startup. In the event of a failure of any of the required self-tests, the TOE will shut down its operations until the error can be recovered.
\r\nUpdates are verified and installed manually by the TOE security administrator using a published hash value.
\r\nThe Controller terminates local administrative sessions after a configurable time period of inactivity.
\r\nThe Controller terminates a remote administrative session after a configurable time period of inactivity.
\r\nAdministrators may terminate their own session by issuing a ‘logout’ command from either the remote CLI or GUI.
\r\nPrior to authenticating to the local CLI or the remote CLI or GUI, the administrator is presented with a configurable advisory notice and consent message.
\r\nThe TOE acts as a server for the following communications:
\r\nThe TOE acts as a client for the following communications:
\r\n