The TOE is Juniper Networks, Inc. NFX series Network Services Platform with Junos OS 23.4R1. The NFX series devices integrate routing, switching, and security functions on a single platform.
\r\nThe devices support the definition of, and enforce, information flow policies among network nodes, also providing for stateful inspection of every packet that traverses the network and central management to manage the network security policy. All flow of information from one network node to another passes through an instance of the TOE. Information flow is controlled on the basis of network node addresses, protocol, type of access requested, and services requested. In support of the information flow security functions, the TOE ensures that security-relevant activity is audited, that their own functions are protected from potential attacks, and provides the security tools to manage all of the security functions. The TOE provides multi-site Virtual Private Network (VPN) gateway functionality, firewall functionality and also implements Intrusion Prevention System (IPS) functionality, capable of monitoring information flows to detect potential attacks based on pre-defined attack signature and anomaly characteristics in the traffic.
\r\nThe deployment of the NFX series with Junos OS 23.4R1 TOE includes a hypervisor, which runs a virtual machine (VM) on an NFX series hardware model:
\r\n\r\n
The following environmental components are required to operate the TOE in the evaluated configuration:
| \r\n Components \r\n | \r\n\r\n Mandatory/Optional \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Remote Management System \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The remote management system is used by an administrator to establish a connection using an SSHv2 client to configure the TOE. \r\n | \r\n
| \r\n Local Management System \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The local management system is used by an administrator to configure the TOE over a serial console connection. \r\n | \r\n
| \r\n Audit Server \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The audit server supports an SSHv2 client which inititates the trusted channel between itself and the TOE for transmission of logs using the netconf utility. \r\n | \r\n
| \r\n VPN Peer \r\n\r\n | \r\n\r\n Optional \r\n | \r\n\r\n The VPN peer is a dedicated IPsec interface that establishes an IPsec tunnel with the VPN gateway of the TOE, which supports both IKEv1 and IKEv2. \r\n | \r\n
| \r\n CRL Server \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The CRL server, over HTTP/1.0, supports revocation checking of certificates used by the TOE for IPsec tunnels. \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the \"Juniper NFX series Network Services Platform with Junos OS 23.4R1\" was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the Juniper NFX series Network Services Platform with Junos OS 23.4R1 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in December 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The logical boundary of the TOE includes the following security functionality:
\r\n\r\n
| \r\n Functionality \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Protected Communications \r\n | \r\n\r\n The TOE provides an SSH server to support protected communications for administrators to establish secure management sessions and to connect to external syslog servers. \r\nThe TOE also supports IPsec connections to provide multi-site virtual private network (VPN) gateway functionality. The TOE requires that applications exchanging information with it are successfully authenticated prior to any exchange (i.e. applications connecting over SSH and IPsec). \r\nTelnet, File Transfer Protocol (FTP), and Secure Socket Layer (SSL) are out of scope. \r\nThe TOE includes cryptographic modules that provide the underlying cryptographic services, including key management and protection of stored keys, algorithms, random bit generation and crypto-administration. The cryptographic modules provide confidentiality and integrity services for authentication and for protecting communications with adjacent systems. \r\n | \r\n
| \r\n Administrator Authentication \r\n | \r\n\r\n Administrative users must provide unique identification and authentication data before any administrative access to the system is granted. Authentication data entered and stored on the TOE is protected. The TOE can be configured to terminate inactive user sessions and to present an access banner with warning messages prior to authentication. \r\n | \r\n
| \r\n Correct Operation \r\n | \r\n\r\n The TOE provides for both cryptographic and non-cryptographic self-tests and is capable of automated recovery from failure states. \r\n | \r\n
| \r\n Trusted Update \r\n | \r\n\r\n The administrator can initiate update of the TOE software. The integrity of any software updates is verified prior to installation of the updated software using digital signatures. \r\n | \r\n
| \r\n Audit \r\n | \r\n\r\n TOE auditable events are stored in the syslog files in the VM filesystem and can be sent to an external log server (via Netconf over SSH). Auditable events include start-up and shutdown of the audit functions, authentication events, service requests, IPS events, as well as the events listed in Table 14 and Table 15 of the ST. Audit records include the date and time, event category, event type, username, and the outcome of the event (success or failure). Local (VM) syslog storage limits are configurable and are monitored. In the event of storage limits being reached, the oldest logs are overwritten. \r\n | \r\n
| \r\n Management \r\n | \r\n\r\n The TOE provides a Security Administrator role that is responsible for: \r\n
The devices are managed through a Command Line Interface (CLI). The CLI is accessible through local (serial) console connection or remote administrative (SSH) session. \r\nThe Security Administrator role includes the capability to manage all NFX services. Access to manage the device’s FreeBSD host can only be gained through the JCP. \r\n | \r\n
| \r\n Packet Filtering/Stateful Traffic Filtering \r\n | \r\n\r\n The TOE provides stateful network traffic filtering for IP-based (IPv4 as well as IPv6) traffic, based on examination of network packets and the application of information flow rules. \r\nThis functionality is common across all three NFX devices and involves no cryptographic operations in terms of processing. \r\n | \r\n
| \r\n Intrusion Prevention \r\n | \r\n\r\n The TOE can be configured to analyze IP-based (IPv4 as well as IPv6) network traffic forwarded to the TOE’s interfaces and detect violations of administratively-defined IPS policies. The TOE is capable of initiating a proactive response to terminate/interrupt an active potential threat, and to initiate a response in real time that would cause interruption of the suspicious traffic flow. \r\nThe IPS functionality is common across all three NFX devices and involves no cryptographic operations in terms of processing. \r\n | \r\n
| \r\n User Data Protection/Information Flow Control \r\n | \r\n\r\n The TOE is designed to forward IP-based (IPv4 as well as IPv6) network packets (i.e., information flows) from source network entities to destination network entities based on available routing information using Virtual Routers. This information is either provided directly by TOE users or indirectly from other network entities (outside the TOE) configured by the TOE users. The TOE has the capability to regulate the information flow across its interfaces; traffic filters can be set in accordance with the presumed identity of the source, the identity of the destination, the transport layer protocol, the source service identifier, and the destination service identifier (TCP or UDP port number). \r\n | \r\n