Compliant Product - Cisco Aggregation Services Router 9000 (ASR9K) running on IOS-XR 7.1
Certificate Date: 2022.04.18CC Certificate Security Target Validation Report
Validation Report Number: CCEVS-VR-VID11197-2022
Product Type: Network Device
Conformance Claim: Protection Profile Compliant
PP Identifier: collaborative Protection Profile for Network Devices Version 2.2e
Extended Package for MACsec Ethernet Encryption Version 1.2
CC Testing Lab: Acumen Security
This section provides an overview of the ASR9K Target of Evaluation (TOE). This section also defines the TOE components included in the evaluated configuration of the TOE. The TOE is comprised of both software and hardware. The hardware is comprised of the following: ASR-9006-SYS, ASR-9010-SYS, ASR-9901, ASR-9904, ASR-9906, ASR-9910, ASR-9912 and ASR-9922. The software is comprised of the Cisco IOS-XR 7.1.
The TOE consists of a number of components including:
· Chassis: The TOE chassis includes 2-RU, 6-RU, 10-RU, 14-RU, 21-RU, 30-RU and 44-RU form factors. The chassis is the component of the TOE in which all other TOE components are housed.
· Route Switch Processor (RSP): A route processor in each chassis provide the advanced routing capabilities of the TOE. They also monitor and manage the other components in the ASR9K.
· Data is secured at Layer 2 with MACsec. The supporting MACsec hardware includes the A9K-4X100GE and A9K-8X100GE line cards.
· Non MACsec Line Cards - A99-8X100GE, A99-12X100GE, A9K-16X100GE , A99-32X100GE
The TOE consists of one or more physical devices along with MACsec-supporting hardware (4X100GE and A9K-8X100GE), non-MACsec line cards (A99-8X100GE, A99-12X100GE, A9K-16X100GE and A99-32X100GE) and includes the Cisco IOS-XR software. The TOE has two or more network interfaces and is connected to at least one internal and one external network. The Cisco IOS-XR configuration determines how packets are handled to and from the TOE’s network interfaces. The router configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination. An external syslog server must be used to store audit records. The TOE authenticates those devices with X.509v3 certificates and protects communication channels with the TLS protocol. Secure remote administration is protected with SSH which is implemented with authentication failure handling.
For remote administration, a secure session using SSHv2 must be established.
The following are considered to be in the IT Environment:
· MACsec Peer
· Management Workstation
· Audit (Syslog) Server
· Local Console
· Certificate Authority
NOTE: The TOE is only the ASR9K device. Only one TOE device is required for deployment in an evaluated configuration.
Security Evaluation Summary
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Cisco Aggregation Services Router 9000 (ASR9K) running on IOS-XR 7.1 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered configured as identified in the Cisco Aggregation Services Router 9000 (ASR9K) running IOS-XR 7.1 Common Criteria Operational User Guidance, satisfies all of the security functional requirements stated in the Cisco Aggregation Services Router 9000 (ASR9K) running IOS-XR 7.1 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in April 2022. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
The TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below.
· Security Audit
· Cryptographic Support
· Identification and Authentication
· Security Management
· Protection of the TSF
· TOE Access
· Trusted Path/Channels
These features are described in more detail in the subsections below. In addition, the TOE implements all SFRs of the NDcPP v2.2e and MACsec EP v1.2 as necessary to satisfy testing/assurance measures prescribed therein.
The TOE provides extensive auditing capabilities. The TOE can audit events related to cryptographic functionality, identification and authentication, and administrative actions. The TOE generates an audit record for each auditable event. Each security relevant audit event has the date, timestamp, event description, and subject identity. The administrator configures auditable events, performs back-up operations and manages audit data storage. The TOE provides the administrator with a circular audit trail. The TOE is configured to transmit its audit messages to an external syslog server over an encrypted channel using TLS.
The TOE provides cryptography in support of other TOE security functionality. All the algorithms claimed have CAVP certificates (Operational Environment – Intel Xeon D-1530 (Broadwell), Intel Xeon E5-2628L (Ivy Bridge), Intel Xeon Silver 4109T (Skylake)). In addition, the TOE supports MACsec using the CoMIRA Mentor Questa Sim 10.7 processor (see Table 1 for certificate references).
Table 1: FIPS References
The TOE provides cryptography in support of remote administrative management via SSHv2 and secures the session between the ASR9K and remote syslog server using TLS.
The TOE authenticates and encrypts packets between itself and a MACsec peer. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys to protect data exchanged by the peers.
The cryptographic services provided by the TOE are described in Table 2 below:
Identification & Authentication
The TOE provides authentication services for administrative users wishing to connect to the TOEs secure CLI administrator interface. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. The TOE can be configured to require a minimum password length of 15 characters as well as mandatory password complexity rules.
After a configurable number of incorrect login attempts, ASR9K will lockout the account until a configured amount of time for lockout expires.
The TOE provides administrator authentication against a local user database. Password-based authentication can be performed on the serial console or SSH interfaces. The SSHv2 interface also supports authentication using SSH keys.
The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for TLS connections.
The TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure SSHv2 session or via a local console connection. The TOE provides the ability to securely manage all TOE administrative users, all identification and authentication, all audit functionality of the TOE, all TOE cryptographic functionality, the timestamps maintained by the TOE, and updates to the TOE. The TOE supports a privileged administrator role. Only the privileged administrator can perform the above security relevant management functions.
Administrators can create configurable login banners to be displayed at time of login, and can also define an inactivity timeout for each admin interface to terminate sessions after a set period of inactivity.
Protection of the TSF
The TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. Additionally, Cisco IOS-XR is not a general-purpose operating system and access to Cisco IOS-XR memory space is restricted to only Cisco IOS-XR functions.
The TOE is also able to detect replay of information received via secure channels (MACsec). The detection applied to network packets that terminate at the TOE, such as trusted communications between the TOE and an IT entity (e.g., MACsec peer). If replay is detected, the packets are discarded.
The TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE’s clock manually. Finally, the TOE performs testing to verify correct operation of the router itself and that of the cryptographic module.
The TOE is able to verify any software updates prior to the software updates being installed on the TOE to avoid the installation of unauthorized software.
The TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
The TOE can also display a Security Administrator specified banner on the CLI management interface prior to allowing any administrative access to the TOE.
The TOE establishes a trusted path between the appliance and the CLI using SSHv2 and the syslog server using TLS. MACsec is used to secure communication channels between MACsec peers at Layer 2.
Cisco Systems, Inc.