The TOE is the Extreme Networks Switching Engine version 33.4.100. The TOE provides high density layer 2/3 switching with low latency cut-through switching and IPv4 and IPv6 unicast and multicast routing to enable enterprise aggregation and core backbone deployments. The TOE consists of a hardware appliance with embedded software components.
\r\nAll TOE appliances are shipped ready for immediate access through a Command Line Interface [CLI], with some basic features enabled by default. However, to ensure secure use the product must be configured prior to being put into a production environment as specified in the TOE guidance.
\r\n","evaluation_configuration":"
The TOE consists of the hardware models shown in the table below all running software version 33.4.100:
\r\n| \r\n Platform \r\n | \r\n\r\n Model \r\n | \r\n\r\n Processor \r\n | \r\n
| \r\n Switching Engine 33.4.100 \r\n | \r\n\r\n U5320 \r\n | \r\n\r\n Broadcom BCM56175, BCM56274 (ARMv8) \r\n | \r\n
| \r\n U5420 \r\n | \r\n\r\n Broadcom BCM56274, BCM56275 (ARMv8) \r\n | \r\n|
| \r\n U5520 \r\n | \r\n\r\n Broadcom BCM56375 (ARMv8) \r\n | \r\n|
| \r\n U5720 \r\n | \r\n\r\n Intel Atom C3338, C3538 Denverton \r\n | \r\n|
| \r\n U7520 \r\n | \r\n\r\n Intel Atom C3758 Denverton \r\n | \r\n|
| \r\n U7720 \r\n | \r\n\r\n Intel Atom C3758 Denverton \r\n | \r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Extreme Switch Engine Common Criteria Configuration Guide, 33.4.100, August 2026 document, satisfies all of the security functional requirements stated in the Extreme Networks Switching Engine version 33.4.100 Security Target, Version 0.4, August 4, 2026. The project underwent CCEVS Validator review. The evaluation was completed in September 2026. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11688-2026) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Extreme Networks Switching Engine version 33.4.100 are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Security audit:
\r\nThe TOE generates audit records for all security-relevant events. For each audited event, the TOE records the date and time, the type of event, the subject identity, and the outcome of the event. The resulting records are stored locally and can be sent securely to a designated audit server for archiving. Security Administrators, using the appropriate CLI commands, can also view audit records locally. The TOE provides a reliable timestamp relying on the appliance’s built-in clock or using an NTP server.
\r\nCryptographic support:
\r\nThe TOE performs the following cryptographic functionality:
\r\nThe TOE uses a dedicated cryptographic module to manage CSPs and implements deletion procedures to mitigate the possibility of disclosure or modification of CSPs. Additionally, the TOE provides commands to on-demand clear CSPs (e.g. host RSA keys), that can be invoked by a Security Administrator with appropriate permissions.
\r\nIdentification and authentication:
\r\nThe TOE supports Role-Based Access Control (RBAC) managed by an Authentication, Authorization, and Accounting (AAA) module that stores and manages permissions of all users and their roles. The TOE requires users to provide their assigned unique username and password before any administrative access to the system is granted. Alternatively, the TOE can be configured to rely on an external Radius server for authentication.
\r\nEach authorized user is associated with an assigned role and role-specific permissions that determine their access to TOE features. The AAA module stores the assigned role of each user along with all other information required for that user to access the TOE. All TOE management functions are restricted to the Security Administrator.
\r\nThe TOE supports X509v3 certificate validation during negotiation of TLS protected syslog, TLS protected Radius, and SSH X509 authentication. Certificates are validated as part of the authentication process when they are presented to the TOE and when they are loaded into the TOE
","features":[{"id":5934,"feature_name":"Auditing"},{"id":5935,"feature_name":"Certificate Validation"},{"id":5937,"feature_name":"Cryptograhic Key Generation"},{"id":5936,"feature_name":"Cryptographic Hashing"},{"id":5938,"feature_name":"Cryptographic Signature Generation"},{"id":5939,"feature_name":"Cryptographic Signature Validation"},{"id":5940,"feature_name":"Keyed hash Message Authentication"},{"id":5941,"feature_name":"Network Device"},{"id":5942,"feature_name":"SSH Server"},{"id":5943,"feature_name":"TLS 1.2"},{"id":5944,"feature_name":"TLS Client with Mutual Authentication"},{"id":5945,"feature_name":"Trusted Update Function"}]}