The TOE is the HPE Juniper Networking QFX5120-48YM switch on JUNOS 23.4R2 with MACsec.
\r\nThe following appliance model constitutes the TOE:
\r\nThe TOE is a secure network device that protects itself largely by offering only a minimal logical interface to the network and attached nodes. It includes the Junos OS firmware, JUNOS OS 23.4R2, which is a special purpose OS offering no general-purpose computing capabilities. Junos OS implements both management and control functions as well as all IP routing.
\r\nThe appliance’s primary function is to support the definition and enforcement of information flow policies among network nodes. Each information flow from one network node to other passes through an instance of the TOE. Information flow is controlled based on network node addresses and protocol. The TOE also ensures that security-relevant activity is audited and implements the necessary tools to manage all security functions.
\r\nThe TOE implements a variety of high-speed interfaces (only Ethernet is in the scope of the evaluation) for enterprise branch, campus, and data center networks. The appliance is physically self-contained, housing the firmware and hardware necessary to perform all routing functions. The architecture components of the TOE are:
\r\nThe appliance supports numerous routing and switching standards for flexibility and scalability. Juniper’s Virtual Chassis technology allows multiple interconnected switches to operate as a single, logical unit, enabling users to manage all platforms as one virtual device. The functions of the appliances can all be managed through the Junos firmware, either from a connected terminal console or via a network connection. Network management is secured using the SSH protocol. All management, whether from a user connecting to a terminal or from the network, requires successful authentication. In the evaluated deployment the TOE is managed and configured via Command Line Interface, either via a directly connected console or over the network secured using the SSH protocol.
\r\nThe TOE implements MACsec between adjacent devices. All traffic communicated between the devices including frames for LLDP (Link Layer Discovery Protocol), DHCP (Dynamic Host Configuration Protocol), ARP (Address Resolution Protocol), STP (Spanning Tree Protocol), Ethernet Control frames, etc. (the exceptions to this protection are Destination MAC and Source MAC addresses in MACsec and MKA frames).
\r\nMACsec can be deployed in point-to-point mode or shared mode with multiple stations. In the evaluated configuration MACsec must be configured individually on each point-to-point Ethernet link, such that a pair of MACsec devices (connected by a physical medium) protect Ethernet frames switched or routed from one device to the other. The two MACsec devices are provided with a Connectivity Association Key (CAK) and utilize the MACsec Key Agreement (MKA) protocol to create a secure tunnel. MKA is used by the two MACsec devices to agree upon MACsec keys. MACsec must be configured to protect all traffic between the devices, with the exception of the MKA or Ethernet control traffic such as EAP over LAN (EAPOL) frames. The devices will first exchange MKA frames, which serve to determine if the peer is an authorized peer and agree upon a shared key and MACsec cipher suite used to set up a transmit (Tx) Security Association (SA) and a receive (Rx) SA. Once the SAs are set up, MACsec-protected frames traverse the unprotected link.
","evaluation_configuration":"\r\nTOE Environment
\r\nThe following environmental components are required to operate the TOE in the evaluated configuration:
\r\nRequired Environmental Components
\r\n| \r\n Components \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Local Management Console \r\n | \r\n\r\n Any management workstation (computer) that is directly (serially) connected to the TOE’s console port may be used by the TOE administrator for local administration of the TOE. \r\n | \r\n
| \r\n Remote Management Workstation \r\n | \r\n\r\n Any management workstation (computer) with a SSHv2 client installed that may be used by the TOE administrator for remote administration of the TOE through SSH protected channel. \r\n | \r\n
| \r\n Syslog Server \r\n | \r\n\r\n A syslog server, used for remote storage of audit records that have been generated by and transmitted from the TOE securely using SSH tunnel (SSHv2). \r\n | \r\n
| \r\n MACsec Peer \r\n | \r\n\r\n A MACsec Peer, used for establishing MACsec communication for securing Layer 2 data using MACsec functionality. \r\n | \r\n
\r\n
\r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the \"QFX5120-48YM switch on JUNOS 23.4R2\" was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the QFX5120-48YM switch on JUNOS 23.4R2 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in April 2026. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by the Collaborative Protection Profile for Network Devices, hereafter referred to as ‘NDcPP v3.0e’ or ‘NDcPP’, PP-Module for MACsec Ethernet Encryption, hereafter referred to as ‘MOD_MACsec V1.0’ and Functional Package for SSH Version 1.0, hereafter referred to as ‘PKG_SSH_v1.0’.
\r\nThe TOE generates audit events for all start-up and shutdown functions as well as all auditable events specified in Table 12 – Security Functional Requirements [ST] and Auditable Events and Table 13 – Security Functional Requirements and Auditable Events/MACsec [ST]. Auditable events are stored in the syslog files on the appliance and can be sent to an external log server (via Netconf over SSH). Auditable events include start-up and shutdown of the audit functions, authentication events, and all SFR-specific events required by the applicable Protection Profiles. Audit records include the date and time, event category, event type, username, and the outcome of the event (success or failure). Local syslog storage limits are configurable and monitored. If the storage limit is reached the oldest logs will be overwritten.
\r\nThe TOE implements an SSH server to support protected communications for administrators to establish secure sessions and to connect to external syslog servers. The TOE requires that applications exchanging information with it are successfully authenticated prior to any exchange (i.e. applications connecting over SSH). Communication over point-to-point links between Juniper appliances can be secured using MACsec. The TOE includes cryptographic modules that implement the underlying cryptographic services, including key management and protection of stored keys, algorithms, random bit generation and crypto administration. The cryptographic modules provide confidentiality and integrity services for authentication and for protecting communications with connecting applications. Details on cryptographic implementations by the TOE are mentioned in the Table 3 – TOE Cryptography Implementation [ST].
\r\nTable 3 - TOE Cryptography Implementation
\r\n| \r\n Cryptographic Methods \r\n | \r\n\r\n Usage \r\n | \r\n
| \r\n FCS_CKM.1 Cryptographic Key Generation \r\n | \r\n\r\n
| \r\n
| \r\n FCS_CKM.2 Cryptographic Key Establishment \r\n | \r\n\r\n
| \r\n
| \r\n FCS_CKM.4 Cryptographic Key Destruction \r\n | \r\n\r\n
| \r\n
| \r\n FCS_COP.1/DataEncryption Cryptographic Operations (AES Data Encryption/Decryption) \r\n | \r\n\r\n
| \r\n
| \r\n FCS_COP.1/SigGen Cryptographic Operation (Signature Generation and Verification) \r\n | \r\n\r\n
| \r\n
| \r\n FCS_COP.1/Hash Cryptographic Operations (Hash Algorithm) \r\n | \r\n\r\n
| \r\n
| \r\n FCS_COP.1/KeyedHash Cryptographic Operation (Keyed Hash Algorithm) \r\n | \r\n\r\n
| \r\n
| \r\n FCS_COP.1/CMAC Cryptographic Operation (AES-CMAC Keyed Hash Algorithm) \r\n | \r\n\r\n
| \r\n
| \r\n FCS_COP.1/MACSEC Cryptographic Operation (MACsec AES Data Encryption/Decryption) \r\n | \r\n\r\n
\r\n
| \r\n
| \r\n FCS_RBG_EXT.1 Random Bit Generation \r\n | \r\n\r\n
\r\n
| \r\n
| \r\n FCS_SSHS_EXT.1 SSH Server Protocol and FCS_SSH_EXT.1 SSH Protocol \r\n | \r\n\r\n
| \r\n
| \r\n FCS_MACSEC_EXT.1 MACsec \r\n | \r\n\r\n
\r\n
\r\n
| \r\n
| \r\n FCS_MACSEC_EXT.2 MACsec Integrity and Confidentiality \r\n | \r\n\r\n
\r\n
\r\n
| \r\n
| \r\n FCS_MACSEC_EXT.3 MACsec Randomness \r\n | \r\n\r\n
\r\n
| \r\n
| \r\n FCS_MACSEC_EXT.4 MACsec Key Usage \r\n | \r\n\r\n
\r\n
\r\n
\r\n
\r\n
| \r\n
| \r\n FCS_MKA_EXT.1 MACsec Key Agreement \r\n | \r\n\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
| \r\n
TOE supports Role Based Access Control. All users must be authenticated to the TOE prior to being granted access to any management actions. The TOE supports password-based authentication and public key-based authentication. Based on the assigned role, a user is granted a set of privileges to access the system. Administrative users must provide unique identification and authentication data before any administrative access to the system is granted. Authentication data entered and stored on the TOE is protected.
\r\nThe TOE provides a Security Administrator role that is responsible for
\r\nThe devices are managed through a Command Line Interface (CLI). The CLI is accessible through local (serial) console connection or remote administrative (SSH) session.
\r\nThe TOE protects all passwords, pre-shared keys, symmetric keys and private keys from unauthorized disclosure. Passwords are stored using sha256 or sha512. The TOE executes self-tests during initial start-up to ensure correct operation and enforcement of its security functions. An administrator can install software updates to TOE. The TOE internally maintains the date and time.
\r\nThe TOE displays a customizable banner before any administrative session can be established with it. The TOE will terminate local or remote interactive sessions after a specified period of session inactivity configured by an administrator. An administrator can terminate their own interactive local or remote sessions.
\r\nThe TOE supports SSH for secure communications with authorized IT entities such as syslog servers. The TOE supports SSHv2 (remote CLI) for secure remote administration. The TOE also supports MACsec for securing data at Layer 2 between TOE and MACsec supporting peer device.
\r\n","features":[{"id":47,"feature_name":"Media Access Control Security (MACsec)"},{"id":48,"feature_name":"Network Switch"}]}