Ivanti Policy Secure (IPS) is a next-generation Network Access Control (NAC) that enables visibility to understand an organization’s security posture and enforce role-based access and endpoint security policies for network users. IPS allows administrators to define, implement, and enforce policy by enabling endpoint discovery, monitoring, and alerting.
","evaluation_configuration":"The following environmental components are required to operate the TOE in the evaluated configuration:
\r\nTable 2 – Required Environmental Components
\r\n| \r\n Components \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Syslog server \r\n | \r\n\r\n
| \r\n
| \r\n Remote workstation \r\n | \r\n\r\n
| \r\n
| \r\n CRL Server \r\n | \r\n\r\n
| \r\n
| \r\n DNS Server \r\n | \r\n\r\n
| \r\n
| \r\n Console Server \r\n | \r\n\r\n
| \r\n
| \r\n VMware ESXi \r\n | \r\n\r\n
| \r\n
This section provides an overview of the TOE architecture, including physical boundaries, security functions, and relevant TOE documentation and references.
\r\nFigure 1 – Representative TOE Deployment of Physical Appliance
\r\n\r\n
\r\n
\r\n
Figure 2 – Representative TOE Deployment of Virtual Appliance
\r\n\r\nThe TOE consists of the following hardware:
\r\nRunning:
\r\n\r\n
These platforms run Ivanti Policy Secure (IPS) v22.7R1. The IPS software is delivered pre-installed on one of the above hardware appliances. The TOE is delivered with the IPS v22.7R1 software installed on one of the ISA appliances.
\r\n\r\n
Table 3 – TOE Physical Boundary Components
\r\n| \r\n Model \r\n | \r\n\r\n Processor \r\n | \r\n\r\n Network Options \r\n | \r\n
| \r\n ISA 6000 \r\n | \r\n\r\n Intel Core i3 10100E 10th gen (Comet Lake) \r\n | \r\n\r\n 2 x 10 Gigabit Copper Ethernet traffic ports \r\n1 x 1GbE Management port \r\n1 x RJ-45 Console Port \r\n | \r\n
| \r\n ISA 8000C \r\n | \r\n\r\n Intel Xeon Gold 5317 (Ice Lake) \r\n | \r\n\r\n 2 x 10 Gigabit Ethernet copper traffic ports with link redundancy \r\n1 x 1GbE Management port \r\n1 x RJ-45 Console Port \r\n | \r\n
| \r\n ISA 8000F \r\n | \r\n\r\n Intel Xeon Gold 5317 (Ice Lake) \r\n | \r\n\r\n 2 x 10 Gigabit fiber traffic ports with link redundancy \r\n1 x 1GbE Management port \r\n1 x RJ-45 Console Port \r\n | \r\n
\r\n
Table 4 - Virtual TOE Models
\r\n| \r\n Model \r\n | \r\n\r\n Processor \r\n | \r\n\r\n Hypervisor \r\n | \r\n
| \r\n ISA 6000-V (virtual platform) on PowerEdge R640 \r\n | \r\n\r\n Intel(R) Xeon(R) Gold 6252 (Cascade lake) \r\n | \r\n\r\n VMware ESXi 8.0.3 \r\n | \r\n
| \r\n ISA 8000-V (virtual platform) on PowerEdge R640 \r\n | \r\n\r\n Intel(R) Xeon(R) Gold 6252 (Cascade lake) \r\n | \r\n\r\n VMware ESXi 8.0.3 \r\n | \r\n
\r\n
In the evaluated configuration, the devices are placed in Network Device collaborative Protection Profile (NDcPP) mode by configuration according to the Administrative Guidance.
","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Ivanti Policy Secure 22.7R1 was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the Ivanti Policy Secure 22.7R1 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in June 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by the Collaborative Protection Profile for Network Devices, Version 3.0e, 06 December 2023 [CPP_ND_V3.0E], hereafter referred to as NDcPP v3.0e or NDcPP.
\r\nThe TOE generates audit records for security relevant events. The TOE maintains a local audit log and also sends the audit records to a remote Syslog server as soon as they are generated, in real-time. Audit records sent to the remote server are protected by a TLS connection. Each audit record includes identity (username, IP address, or process), date and time of the event, type of event, and the outcome of the event. The TOE prevents modification to the local audit log. The TSF manages local audit storage using two log files (active and inactive). When the active log file reaches its capacity, the TSF overwrites the inactive log file (if it exists). If no inactive log file is available, the TOE creates a new log file, switches logging to the new file, and generates an audit log indicating the capacity limit was reached.
\r\nThe TOE includes the Ivanti Secure Cryptographic Module that implements CAVP-validated cryptographic algorithms for random bit generation, encryption/decryption, authentication, and integrity protection/verification. These algorithms are used to provide security for the TLS and HTTPS connections for secure management and secure connections to a syslog server. TLS and HTTPS are also used to verify firmware updates. The cryptographic services provided by the TOE are described below.
\r\nTable 1 - TOE Cryptographic Protocols
\r\n| \r\n Cryptographic Protocol \r\n | \r\n\r\n Use within the TOE \r\n | \r\n
| \r\n HTTPS/TLS (client) \r\n | \r\n\r\n Secure connection to syslog FCS_HTTPS_EXT.1, FCS_TLSC_EXT.1, FCS_TLSC_EXT.2 \r\n | \r\n
| \r\n HTTPS/TLS (server) \r\n | \r\n\r\n Secure management connections and verification of firmware updates via web browser \r\nFCS_HTTPS_EXT.1, FCS_TLSS_EXT.1 \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Provides encryption/decryption in support of the TLS protocol. FCS_TLSC_EXT.1, FCS_TLSC_EXT.2, FCS_TLSS_EXT.1 \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n Deterministic random bit generation used to generate keys. FCS_TLSS_EXT.1, FCS_RBG_EXT.1 \r\n | \r\n
| \r\n Secure hash \r\n | \r\n\r\n Used as part of digital signatures and for hashing passwords prior to storage on the TOE. \r\nFCS_COP.1/Hash, FCS_TLSC_EXT.1, FCS_TLSC_EXT.2, FCS_TLSS_EXT.1, FPT_APW_EXT.1 \r\n | \r\n
| \r\n HMAC \r\n | \r\n\r\n Provides keyed hashing services in support of TLS. \r\nFCS_COP.1/KeyedHash, FCS_TLSC_EXT.1, FCS_TLSC_EXT.2, FCS_TLSS_EXT.1 \r\n | \r\n
| \r\n ECDSA \r\n | \r\n\r\n Provides key generation and signature generation and verification in support of TLS. \r\nFCS_CKM.1, FCS_COP.1/SigGen, FCS_COP.1/SigVer, FCS_TLSC_EXT.1, \r\nFCS_TLSC_EXT.2, FCS_TLSS_EXT.1 \r\n | \r\n
| \r\n EC-DH \r\n | \r\n\r\n Provides key establishment for TLS. \r\nFCS_CKM.2, FCS_TLSC_EXT.1, FCS_TLSC_EXT.2, FCS_TLSS_EXT.1 \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n Provide key generation and signature generation and verification (PKCS1_V1.5) in support of TLS. \r\nFCS_CKM.1, FCS_CKM.2, FCS_COP.1/SigGen, FCS_COP.1/SigVer, FCS_TLSC_EXT.1, FCS_TLSC_EXT.2, FCS_TLSS_EXT.1 \r\n | \r\n
\r\n
Each of these cryptographic algorithms have been validated for conformance to the requirements specified in their respective standards, as identified in Section 6.1 CAVP Algorithm Certificate Details.
\r\nThe TOE authenticates administrative users using a username/password or username/X.509 certificate combination. The TOE does not allow access to any administrative functions prior to successful authentication. The TOE validates and authenticates X.509 certificates for all certificate uses.
\r\nThe TOE supports passwords consisting of alphanumeric and special characters and enforces minimum password lengths. The TSF supports certificates using RSA or ECDSA signature algorithms.
\r\nThe TOE only allows users to view the login warning banner and send/receive ICMP packets prior to authentication.
\r\nRemote administrators are locked out after a configurable number of unsuccessful authentication attempts.
\r\nThe TOE allows users with the Security Administrator role to administer the TOE over a remote web GUI or a local CLI. These interfaces do not allow the Security Administrator to execute arbitrary commands or executables on the TOE. Security Administrators can manage connections to an external Syslog server, as well as determine the size of local audit storage.
\r\nThe TOE implements several self-protection mechanisms. It does not provide an interface for the reading of secret or private keys. The TOE ensures timestamps, timeouts, and certificate checks are accurate by maintaining a real-time clock. Upon startup, the TOE runs a suite of self-tests to verify that it is operating correctly. The TOE also verifies the integrity and authenticity of firmware updates by verifying a digital signature of the update prior to installing it.
\r\nThe TOE can be configured to display a warning and consent banner when an administrator attempts to establish an interactive session over the local CLI or remote web GUI. The TOE also enforces a configurable inactivity timeout for remote and local administrative sessions.
\r\nThe TOE uses TLS to provide a trusted communication channel between itself and remote Syslog servers. The trusted channels utilize X.509 certificates to perform mutual authentication. The TOE initiates the TLS trusted channel with the remote server.
","features":[{"id":3234,"feature_name":"Asymmetric Key Generation"},{"id":3332,"feature_name":"Auditing"},{"id":3237,"feature_name":"Cryptographic Hashing"},{"id":3235,"feature_name":"Cryptographic Key Establishment"},{"id":3236,"feature_name":"Cryptographic Signature Verification"},{"id":3233,"feature_name":"DRBG"},{"id":3331,"feature_name":"Flaw Remediation"},{"id":3238,"feature_name":"Keyed-hash message authentication"}]}