{"product_id":6013,"v_id":6013,"product_name":"Cisco Systems [1100, 1200, 1300, 1400 series Wireless Devices running IOS 12.3(8)JA2; 3200 series Wireless Router running IOS 12.4(6)XE3; AS5350, 5400, 5850 Universal Gateway running IOS 12.4(17); IAD2430 Integrated Access Device running IOS 12.4(17)] with Cisco Secure Access Control Server (ACS) version 4.1.4.13 for Microsoft Windows Server","certification_status":"Not Certified","certification_date":"2008-06-09T00:06:00Z","tech_type":"Network Switch, Router","vendor_id":{"name":"Cisco Systems, Inc.","website":"https://www.cisco.com"},"vendor_poc":null,"vendor_phone":"+1 410 309 4862","vendor_email":"certteam@cisco.com","assigned_lab":{"cctl_name":"Arca CCTL"},"product_description":"
The TOE is the Cisco Systems Internetwork Operating System (IOS) running on any one or more of the following network devices with the IOS versions and feature sets specified in the table below [Wireless (1100, 1200, 1300, 1400, 3200), Cisco Devices (IAD 2430), Cisco Access Servers (5350, 5400, 5850) running IOS], and a Cisco Secure Access Control Server for Windows Server (ACS), version 4.1.4.13. These network devices determine the next network point to which a packet should be forwarded toward its destination. They are located at any gateway (where one network meets another). They may create or maintain a table of the available routes and their conditions and use this information along with distance and cost algorithms to determine the best route for a given packet. IP packets are forwarded over one or more of its physical network interfaces to the device, which processes them according to the system’s configuration and state information dynamically maintained by the device. This processing typically results in the IP packets being forwarded out of the device over another interface.
\r\n
 
\r\n
Devices that compose the TOE have common hardware characteristics. These characteristics affect only non-TSF relevant functions of the devices (such as throughput and amount of storage) and therefore support security equivalency of the devices in terms of hardware:
\r\n
 
\r\n\r\n
 
\r\n
Users of the TOE are Device and ACS Administrators, which will hereafter be referred to generically as Authorized Administrators or by the roles of Privileged Administrator (device), Semi-Privileged Administrator (device), and Authentication Administrator (ACS). Privileged Administrators configure the Cisco devices using the Global Configuration commands to apply the features that affect the system as a whole. To initiate Global Configuration mode the Privileged Administrator enters the configure command at the Privileged EXEC mode prompt. The user interface is run from either the console port on the device, or by connecting to the device using Secure Shell. The user interface is a Command Line Interface (CLI) running the Command Interpreter (EXEC).
\r\n
 
\r\n
The Cisco Systems TOE hardware models are:
\r\n
 
\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
\r\n
Series
\r\n 		\r\n
Models
\r\n 		\r\n
IOS Version
\r\n 		\r\n
Type
\r\n 		\r\n
Feature Set
\r\n
\r\n
1100
\r\n 		\r\n
1100, 1130
\r\n 		\r\n
12.3(8)JA2
\r\n 		\r\n
Wireless
\r\n 		\r\n
Wireless LAN
\r\n
\r\n
1200
\r\n 		\r\n
1200, 1232AG, 1242AG
\r\n 		\r\n
12.3(8)JA2
\r\n 		\r\n
Wireless
\r\n 		\r\n
Wireless LAN
\r\n
\r\n
1300
\r\n 		\r\n
1300
\r\n 		\r\n
12.3(8)JA2
\r\n 		\r\n
Wireless
\r\n 		\r\n
Wireless LAN
\r\n
\r\n
1400
\r\n 		\r\n
1400, 1410
\r\n 		\r\n
12.3(8)JA2
\r\n 		\r\n
Wireless
\r\n 		\r\n
Wireless LAN
\r\n
\r\n
3200
\r\n 		\r\n
3220, 3230, 3251, 3270
\r\n 		\r\n
12.4(6)XE3
\r\n 		\r\n
Wireless Flexible, modular access routers
\r\n 		\r\n
Advanced Enterprise Services
\r\n
\r\n
AS
\r\n 		\r\n
AS5350, AS5400, AS5400HPX, AS5850
\r\n 		\r\n
12.4(17)
\r\n 		\r\n
Universal Gateways
\r\n 		\r\n
Enterprise Plus IPSec 3DES
\r\n
\r\n
IAD Series
\r\n 		\r\n
IAD2430
\r\n 		\r\n
12.4(17)
\r\n 		\r\n
Integrated Access Device
\r\n 		\r\n
IP Subset/IPSec 64Bit/FW/Voice
\r\n
\r\n
 
\r\n
The TOE also includes ACS, which provides Authentication, Authorization, and Accounting (AAA) services to network devices that function as AAA clients.
","evaluation_configuration":null,"security_evaluation_summary":"

 

\r\n
The evaluation was carried out in accordance with the Arca Common Criteria Test Laboratory processes and procedures that are compliant with the Common Criteria Evaluation and Validation Scheme (CCEVS). The evaluation demonstrated that the Auditing (Accounting), Identification and Authentication (Authentication), Traffic Filtering, Security Management/Access Control (Authorization), and Protection of the TSF of the Cisco IOS/AAA Wireless Devices and other Network Devices met the security requirements contained in the Security Target. The criteria against which the Cisco IOS/AAA Wireless and other Network Devices were judged are described in the Common Criteria for Information Technology Security Evaluation, Version 2.2 Part II and Part III. The evaluation team conducted the evaluation using the Common Methodology for Information Technology Security Evaluation, Version 2.2.
\r\n
 
\r\n
Arca CCTL concluded that the Common Criteria requirements for Evaluation Assurance Level (EAL) 3 have been met with the addition of ALC_FLR.1. The product, configured as outlined in the Secure Installation Guidance, satisfies all of the security functional requirements stated in the Security Target. A Validation Team, on behalf of CCEVS, monitored the evaluation carried out by Arca CCTL. The evaluation was completed in March 2008. Results of the evaluation can be found in the Validation Report prepared by the National Information Assurance Partnership (NIAP) CCEVS Validation Team.
","environmental_strengths":"

 

\r\n
The TOE consists of one or more physical devices: device(s) with IOS software and ACS software. ACS software runs on a Windows 2000 Server. It should be noted that the Windows PC is not considered part of the TOE, only the ACS software operating on it. The Windows OS includes the host-based traffic filter to protect the OS and the ACS. When the networking device component of the TOE is in use, at least two of the network interfaces of the internetworking device will be attached to different networks. The device configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination.  The ACS will be connected to the networking device either via an internal network or via a crossover cable. 
\r\n
 
\r\n
The TOE can optionally connect to an NTP server on its internal (protected) network for time services. Note: The 1400 and the Mobile Access Router 3200 Series are the only TOE models that support NTP version 3 with MD5 authentication. The wireless access points (1100, 1130, 1200, 1232AG, 1242AG, 1300), Cisco Device (IAD 2430), and Cisco Access Servers (5350, 5400, 5850) do not. For these devices, NTP is not an option. Also, if the network device or ACS Server are to be remotely administered, the management station must be connected to an internal (protected) network, SSH must be used to connect to the network device, and SSL must be used to connect to the ACS. The ACS, remote management, and NTP boxes (if used) must all be attached to the internal (protected) network.
\r\n
 
","features":[]}