Cisco 2651 User manual

Corporate Headquarters:
Copyright © 2004 Cisco Systems, Inc. All rights reserved.
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725,
and 3745 Modular Access Routers and 7206-VXR
NPE-400 Router FIPS 140-2 Non-Proprietary
Security Policy
Level 2 Validation
Version 2.4
November 19, 2004
Introduction
This is the non-proprietary Cryptographic Module Security Policy for the Cisco 1721, 1760, 2621XM,
2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 routers. This security policy describes how the
routers meet the security requirements of FIPS 140-2, and how to operate the routers in a secure FIPS
140-2 mode. This policy was prepared as part of the Level 2 FIPS 140-2 certification of the routers.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2—Security Requirements for
Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the NIST website at
http://csrc.nist.gov/cryptval/.
This document contains the following sections:
•Introduction, page 1
•The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers,
page 3
•Secure Operation of the Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR
NPE-400 Routers, page 42
•Related Documentation, page 44
•Obtaining Documentation, page 45
•Documentation Feedback, page 46

2
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
Introduction
•Obtaining Technical Assistance, page 46
•Obtaining Additional Publications and Information, page 47
References
This document deals only with operations and capabilities of the 1721, 1760, 2621XM, 2651XM, 2691,
3725, 3745, and 7206 VXR NPE-400 routers in the technical terms of a FIPS 140-2 cryptographic
module security policy. More information is available on the routers from the following sources:
•The Cisco Systems website contains information on the full line of products at www.cisco.com.
– The 1700 Series product descriptions can be found at:
http://www.cisco.com/en/US/products/hw/routers/ps221/index.html
– The 2600 Series product descriptions can be found at:
http://www.cisco.com/en/US/products/hw/routers/ps259/index.html
– The 3700 Series product descriptions can be found at:
http://www.cisco.com/en/US/products/hw/routers/ps282/index.html
– The 7200 Series product descriptions can be found at:
http://www.cisco.com/en/US/products/hw/routers/ps341/index.html
•For answers to technical or sales related questions please refer to the contacts listed on the Cisco
Systems website at www.cisco.com.
•The NIST Validated Modules website (http://csrc.nist.gov/cryptval) contains contact information
for answers to technical or sales-related questions for the module
Terminology
In this document, the Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400
routers are referred to as the routers, the modules, or the systems.
Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
•Vendor Evidence document
•Finite State Machine
•Module Software Listing
•Other supporting documentation as additional references
This document provides an overview of the routers and explains the secure configuration and operation
of the modules. This introduction section is followed by the “The Cisco 1721, 1760, 2621XM, 2651XM,
2691, 3725, 3745, and 7206 VXR NPE-400 Routers” section, which details the general features and
functionality of the routers. The “Secure Operation of the Cisco 1721, 1760, 2621XM, 2651XM, 2691,
3725, 3745, and 7206 VXR NPE-400 Routers” section specifically addresses the required configuration
for the FIPS-mode of operation.

3
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Certification Submission
Documentation is Cisco-proprietary and is releasable only under appropriate non-disclosure agreements.
For access to these documents, please contact Cisco Systems.
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206
VXR NPE-400 Routers
Branch office networking requirements are dramatically evolving, driven by web and e-commerce
applications to enhance productivity and merging the voice and data infrastructure to reduce costs. The
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 modular
multi-service routers offer versatility, integration, and security to branch offices. With numerous WAN
Interface Cards (WICs) and Network Modules (NMs) available, the modular architecture of the Cisco
router easily allows interfaces to be upgraded to accommodate network expansion. The Cisco 1721,
1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 provide a scalable, secure,
manageable remote access server that meets FIPS 140-2 Level 2 requirements as a multiple-chip
embedded module. This section describes the general features and functionality provided by the Cisco
1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 routers. Additional
adapters (e.g. WICs and other modules) are excluded from the validation.
•The Cisco 1721/1760 Cryptographic Module, page 4
•Cisco 1721 and 1760 Module Interfaces, page 5
•The Cisco 2621XM/2651XM Cryptographic Module, page 10
•Cisco 2621XM and 2651XM Module Interfaces, page 10
•The Cisco 2691 Cryptographic Module, page 13
•Cisco 2691 Module Interfaces, page 14
•The Cisco 3725/3745 Cryptographic Module, page 18
•Cisco 3725 and 3745 Module Interfaces, page 18
•The Cisco 7206 VXR NPE-400 Cryptographic Module, page 24
•Cisco 7206 VXR NPE-400 Module Interfaces, page 25
•Roles and Services, page 27
•Physical Security, page 29
•Cryptographic Key Management, page 36
•Self-Tests, page 42

4
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
The Cisco 1721/1760 Cryptographic Module
Figure 1 The Cisco 1721 and Cisco 1760 Routers
The cryptographic boundary is defined as encompassing the "top," "front," "left," "right," and "bottom"
surfaces of the case; all portions of the "backplane" of the case which are not designed to accommodate
a WIC; and the inverse of the three-dimensional space within the case that would be occupied by an
installed WIC. The cryptographic boundary includes the connection apparatus between the WIC and the
motherboard/daughterboard that hosts the WIC, but the boundary does not include the WIC itself. In
other words, the cryptographic boundary encompasses all hardware components within the case of the
device except any installed modular WICs. All of the functionality discussed in this document is
provided by components within this cryptographic boundary.
The 1760 requires that a special opacity shield be installed over the right-hand side air vents in order to
operate in FIPS-approved mode. The shield decreases the effective size of the vent holes, reducing
visibility within the cryptographic boundary to FIPS-approved specifications. The shield is
self-adhering to the side of the chassis. To install the shield, remove it from its paper backing and apply
the shield to the chassis, aligning the holes on the shield with the vent-holes on the side of the chassis.
Figure 2 demonstrates the proper application of the shield.
Figure 2 Cisco 1760 Opacity Shield Application
99390
Cisco 1700
Series
PWRACT
ACT/CH0
ACT/CH1
OK
ACT/CH0
WIC0WIC1ETH
ACT/CH1COL
Cisco
1700
SERIES
ROUTER
10/100ETHERNETAUX
CONSOLE
PVDM 0
OK
OK
PWR 1
0
SLOT0
OK
PVDM 1
OK
MOD
OK
1
0
SLOT1
OK
LINK
100
FDX
ACT COL 1
0
SLOT2
OK
1
0
SLOT3
OK
99395

5
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
Cisco IOS features such as tunneling, data encryption, and termination of Remote Access WANs via
IPSec, Layer 2 Forwarding (L2F) and Layer 2 Tunneling Protocols (L2TP) make the Cisco 1700 an ideal
platform for building virtual private networks or outsourced dial solutions. Cisco 1700`s RISC-based
processor provides the power needed for the dynamic requirements of the remote branch office.
Cisco 1721 and 1760 Module Interfaces
The interfaces for the router are located on the rear panel of the Cisco 1721 and the front panel of the
Cisco 1760 as shown in Figure 3.
Figure 3 Cisco 1721 and Cisco 1760 Physical Interfaces
The Cisco 1721 and 1760 routers feature console and auxiliary ports, single fixed LAN interfaces, two
Cisco WAN interface card (WIC) slots on the 1721, and two WIC slots and two Voice interface card
(VIC) slots on the 1760. WAN interface cards support a variety of serial, ISDN BRI, and integrated
CSU/DSU options for primary and backup WAN connectivity. All Cisco 1700 series routers include an
auxiliary port supporting 115Kbps Dial-On-Demand Routing, ideal for back-up WAN connectivity.
A WIC is inserted into one of the WIC slots, which are located on the back panel of the 1721 and the
front panel of the 1760. WICs interface directly with the processor, and cannot perform cryptographic
functions; they only serve as a data input and data output physical interface.
The physical interfaces include a power plug for the power supply and a power switch. The router has
one Fast Ethernet (10/100 RJ-45) connector for data transfers in and out. The module also has two other
RJ-45 connectors on the back panel for a console terminal for local system access and an auxiliary port
Cisco 1700 Series
10/100 ETHERNET AUX
CONSOLE
PWR OK PVDM 0
OK
PVDM 1
OK
MOD
OK
ACT COL FDX 100 LINKSLOT 0
OK
0 1 SLOT 1
OK
0 1 SLOT 2
OK
0 1 SLOT 3
OK
0 1
99391
THESE SLOTS ACCEPT ONLY VOICE INTERFACE CARDS
Power
socket
+5, +12, -12 VDC
CONSOLE
10/100 ETHERNET AUX
FDX LINK100WIC 0 OK WIC 1 OKMOD OK
Power switch
Model
Cisco 1721
65524
FDX/100/
LINK LEDs
WIC/VIC Slot 0 WIC/VIC Slot 1 VIC Slot 2 VIC Slot 3
Slot 3
LEDs
Slot 2
LEDs
Slot 1
LEDs
Slot 0
LEDs
PVDM 0/1
OK LEDs
MOD
OK LED
Router
OK
Power LED
Auxiliary port
Auxiliary
port
Ethernet
port
Ethernet
LEDs
Kensington-compatible
locking socket
WIC 0
OK LED
10/100-Mbps
Ethernet port
MOD OK
LED
WIC 1 OK
LED
WIC 0 slot WIC 1 slot
Console port
Console port
SEE MANUAL BEFORE INSTALLATION
DSU
56K
CD AL LP RD TD

6
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
for remote system access or dial backup using a modem. The 10/100Base-T LAN port has Link/Activity,
10/100Mbps, and half/full duplex LEDs. Figure 4 shows the LEDs located on the rear panel of the
Cisco 1721 with descriptions detailed in Table 1:
Figure 4 Cisco 1721 Rear Panel LEDs
Figure 5 shows the front panel LEDs of the 1721 and 1760, which provide overall status of the router's
operation. The front panel of the 1721 displays whether or not the router is booted, overall activity/link
status, and collision information. The front panel of the 1760 displays whether or not the router is
booted, overall activity/link status, collision information, and specific information for each installed
interface.
Table 1 Cisco 1721 Rear Panel LEDs and Descriptions
LED Indication Description
WIC 0 OK Green A WIC is correctly inserted in the card slot
Off No WIC present / WIC incorrectly inserted in the card slot
WIC 1 OK Green A WIC is correctly inserted in the card slot
Off No WIC present / WIC incorrectly inserted in the card slot
FDX Green The interface is transmitting data in full-duplex mode
Off When off, the interface is transmitting data in half-duplex mode
100 Mbps Green The speed of the interface is 100 Mbps
Off The speed of the interface is 10 Mbps or no link is established
LINK Green An Ethernet link has been established
Off No Ethernet link established
MOD OK Green VPN hardware encryption module is installed and recognized by Cisco IOS
Off VPN hardware encryption module not installed / not recognized by
Cisco IOS
+5, +12, -12 VDC
CONSOLE
10/100 ETHERNET AUX
FDX LINK100WIC 0 OK WIC 1 OKMOD OK
Model
Cisco 1721
99392
FDX/100/
LINK LEDs
WIC 0
OK LED
MOD OK
LED
WIC 1 OK
LED
SEE MANUAL BEFORE INSTALLATION
DSU
56K
CD AL LP RD TD

7
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
Figure 5 Cisco 1721 and 1760 Front Panel LEDs
Table 2 and Table 3 provide more detailed information conveyed by the LEDs on the front panel of the
Cisco 1721 and 1760 routers:
Cisco 1700 Series
10/100 ETHERNET AUX
CONSOLE
PWR OK PVDM 0
OK
PVDM 1
OK
MOD
OK
ACT COL FDX 100 LINKSLOT 0
OK
0 1 SLOT 1
OK
0 1 SLOT 2
OK
0 1 SLOT 3
OK
0 1
99393
THESE SLOTS ACCEPT ONLY VOICE INTERFACE CARDS
Slot 3
LEDs
Slot 2
LEDs
Slot 1
LEDs
Slot 0
LEDs
PVDM 0/1
OK LEDs
MOD
OK LED
Router
OK
Power LED
Auxiliary
port
Ethernet
port
Ethernet
LEDs
PWR
ACT
ACT/CH0
ACT/CH1
OK
ACT/CH0
WIC0 WIC1 ETH
ACT/CH1 COL
Table 2 Cisco 1721 Front Panel LEDs and Descriptions
LED Indication Description
PWR Green Power is supplied to the router
Off The router is not powered on
OK Green The router has successfully booted up and the software is functional. This
LED blinks during the power-on self-test (POST)
Off The router has not successfully booted up
WIC 0
ACT/CH0
Green Serial and DSU/CSU cards—Blinks when data is being sent to or received
from the port on the card in the WIC0 slot
ISDN cards—On solid when the first ISDN B channel is up for the card in
the WIC0 slot
2-port serial cards—Blinks when data is being sent to or received from the
first port on the 2-port card in the WIC0 slot
WIC 0
ACT/CH1
Green Serial and CSU/DSU cards—Remains off
ISDN cards—On solid when the second ISDN B channel is up for the card
in the WIC0 slot
2-port serial cards—Blinks when data is being sent to or received from the
second port on the 2-port card in the WIC0 slot
WIC 1
ACT/CH0
Green Serial and DSU/CSU cards—Blinks when data is being sent to or received
from the port on the card in the WIC1 slot
ISDN cards—On solid when the first ISDN B channel is up for the card in
the WIC1 slot
2-port serial cards—Blinks when data is being sent to or received from the
first port on the 2-port card in the WIC1 slot

8
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
WIC 1
ACT/CH1
Green Serial and CSU/DSU cards—Remains off
ISDN cards—On solid when the second ISDN B channel is up for the card
in the WIC1 slot
2-port serial cards—Blinks when data is being sent to or received from the
second port on the 2-port card in the WIC1 slot
ETH ACT Green Blinks when there is network activity on the Ethernet port
ETH COL Yellow Blinks when there are packet collisions on the local Ethernet network
Table 3 Cisco 1760 Front Panel LEDs and Descriptions
LED Indication Description
PWR Green Power is supplied to the router
Off The router is not powered on
OK Green The router has successfully booted up and the software is functional. This
LED blinks during the power-on self-test (POST)
Off The router has not successfully booted up
PVDM 0
OK
Green On when a packet voice data module (PVDM) is correctly inserted in
PVDM card slot 0
PVDM 1
OK
Green n when a packet voice data module (PVDM) is correctly inserted in PVDM
card slot 1
MOD OK Green On when a VPN module is present
FDX Green The interface is transmitting data in full-duplex mode
Off When off, the interface is transmitting data in half-duplex mode
100 Mbps Green The speed of the interface is 100 Mbps
Off The speed of the interface is 10 Mbps or no link is established
LINK Green An Ethernet link has been established
Off No Ethernet link established
SLOT 0 OK Green On when either a WIC or a VIC is correctly inserted in the card slot
0 Green ISDN—On when the first ISDN B channel is connected
Serial, CSU/DSU, and VIC—Blinks when data is being sent to or received
from port 0 in slot 0. For the VIC-2BRI-ST-NT/TE, blinks when data is
being sent to or received from any of the B channels
1 Green ISDN—On when the second ISDN B channel is connected
Serial and VIC—Blinks when data is being sent to or received from port 1
in slot 0
SLOT 1 OK Green On when either a WIC or a VIC is correctly inserted in the card slot
0 Green ISDN—On when the first ISDN B channel is connected
Serial, CSU/DSU, and VIC—Blinks when data is being sent to or received
from port 0 in slot 1
Table 2 Cisco 1721 Front Panel LEDs and Descriptions (Continued)
LED Indication Description

9
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
All of these physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in
the Table 4:
1 Green ISDN—On when the second ISDN B channel is connected
Serial and VIC—Blinks when data is being sent to or received from port 1
in slot 1
SLOT 2 OK Green On when a VIC is correctly inserted in the card slot
0 Green VIC—Blinks when data is being sent to or received from port 0 in slot 2
1 Green VIC—Blinks when data is being sent to or received from port 1 in slot 2
SLOT 3 OK Green On when a VIC is correctly inserted in the card slot
0 Green VIC—Blinks when data is being sent to or received from port 0 in slot 3
1 Green VIC—Blinks when data is being sent to or received from port 1 in slot 3
Table 3 Cisco 1760 Front Panel LEDs and Descriptions (Continued)
LED Indication Description
Table 4 Cisco 1721 and Cisco 1760 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100BASE-TX LAN Port
WIC/VIC Interface
Console Port
Auxiliary Port
Data Input Interface
10/100BASE-TX LAN Port
WIC/VIC Interface
Console Port
Auxiliary Port
Data Output Interface
10/100BASE-TX LAN Port
WIC/VIC Interface
Power Switch
Console Port
Auxiliary Port
Control Input Interface
10/100BASE-TX LAN Port
WIC/VIC Interface
LAN Port LEDs
10/100BASE-TX LAN Port LEDs
Power LED
Activity LED
Console Port
Auxiliary Port
Status Output Interface
Power Plug Power Interface

10
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
The Cisco 2621XM/2651XM Cryptographic Module
Figure 6 The Cisco 2621XM/2651XM Router
The cryptographic boundary is defined as encompassing the "top," "front," "left," "right," and "bottom"
surfaces of the case; all portions of the "backplane" of the case which are not designed to accommodate
a WIC or Network Module; and the inverse of the three-dimensional space within the case that would be
occupied by an installed WIC or Network Module. The cryptographic boundary includes the connection
apparatus between the WIC or Network Module and the motherboard/daughterboard that hosts the WIC
or Network Module, but the boundary does not include the WIC or Network Module itself. In other
words, the cryptographic boundary encompasses all hardware components within the case of the device
except any installed modular WICs or Network Modules. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
Cisco IOS features such as tunneling, data encryption, and termination of Remote Access WANs via
IPSec, Layer 2 Forwarding (L2F) and Layer 2 Tunneling Protocols (L2TP) make the Cisco 2600 an ideal
platform for building virtual private networks or outsourced dial solutions. Cisco 2600`s RISC-based
processor provides the power needed for the dynamic requirements of the remote branch office,
achieving wire speed Ethernet to Ethernet routing with up to 30 thousand packets per second (Kpps)
throughput capacity for the 2621XM, and 40 Kpps for the 2651XM.
Cisco 2621XM and 2651XM Module Interfaces
The interfaces for the router are located on the rear panel as shown in Figure 7.
Figure 7 Cisco 2621XM and Cisco 2651XM Physical Interfaces
POWER
RPS ACTIVITY
Cisco 2600
SERIES
99493
SEE MANUAL BEFORE INSTALLATION
SERIAL 1
SERIAL 0
CONN CONN
WIC
2A/S
SEE MANUAL BEFORE INSTALLATION
SERIAL 1
SERIAL 0
CONN CONN
WIC
2T
Cisco 2650
W1
100-240V–1A
50/60Hz47W
W0
AUX
CONSOLE
ETHERNET0 ACT
LINK
ETHERNET1 ACT
LINK
10/100BASE-T
Ethernet 0/0
(RJ-45)
10/100BASE-T
Ethernet 0/1
(RJ-45) Auxiliary port
(RJ-45)
Console
port (RJ-45)
Cisco 2650
99494
Network
module
WIC slots

11
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
The Cisco 2621XM and 2651XM routers feature a console port, an auxiliary port, dual fixed LAN
interfaces, a Network Module slot, and two WIC slots.
LAN support includes single and dual Ethernet options; 10/100 Mbps auto-sensing Ethernet; mixed
Token-Ring and Ethernet; and single Token Ring chassis versions.
WAN interface cards support a variety of serial, ISDN BRI, and integrated CSU/DSU options for
primary and backup WAN connectivity. Available Network Modules support multi-service
voice/data/fax integration, departmental dial concentration, and high-density serial options
All Cisco 2600 series routers include an auxiliary port supporting 115Kbps Dial-On-Demand Routing,
ideal for back-up WAN connectivity.
When a Network Module is inserted, it fits into an adapter called the Network Module expansion bus.
The expansion bus interacts with the PCI bridge in the same way that the fixed LAN ports do; therefore,
no critical security parameters pass through the Network Module (just as they don't pass through the
LAN ports). Network modules do not perform any cryptographic functions.
WICs are similar to Network Modules in that they greatly increase the router's flexibility. A WIC is
inserted into one of two slots, which are located above the fixed LAN ports. WICs interface directly with
the processor. They do not interface with the cryptographic card; therefore no security parameters will
pass through them. WICs cannot perform cryptographic functions; they only serve as a data input and
data output physical interface.
The physical interfaces include a power plug for the power supply and a power switch. The router has
two Fast Ethernet (10/100 RJ-45) connectors for data transfers in and out. The module also has two other
RJ-45 connectors on the back panel for a console terminal for local system access and an auxiliary port
for remote system access or dial backup using a modem. The 10/100Base-T LAN ports have
Link/Activity, 10/100Mbps, and half/full duplex LEDs. Figure 8 shows the LEDs located on the rear
panel with descriptions detailed in Table 5:
Figure 8 Cisco 2621XM and Cisco 2651XM Rear Panel LEDs
99495
SEE MANUAL BEFORE INSTALLATION
SERIAL 1
SERIAL 0
CONN CONN
WIC
2A/S
SEE MANUAL BEFORE INSTALLATION
SERIAL 1
SERIAL 0
CONN CONN
WIC
2A/S
Cisco 2621
W0
W1
AUX
CONSOLE
10/100 ETHERNET 0/0
10/100 ETHERNET 0/1
10/100BASE-T
Ethernet 0/0
(RJ-45)
10/100BASE-T
Ethernet 0/1
(RJ-45)
Auxiliary
port (RJ-45)
Console
port (RJ-45)
FDX
LED FDX
LED
Link FDXFDX
Link
LED
100 Mbps
100 Mbps
LED
Link
Link
LED
100 Mbps
100 Mbps
LED

12
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
Figure 9 shows the front panel LEDs, which provide overall status of the router's operation. The front
panel displays whether or not the router is booted, if the redundant power is (successfully) attached and
operational, and overall activity/link status.
Figure 9 Cisco 2621XM and Cisco 2651XM Front Panel LEDs
Table 6 provides more detailed information conveyed by the LEDs on the front panel of the router:
All of these physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in
Table 7:
Table 5 Cisco 2621XM and Cisco 2651XM Rear Panel LEDs and Descriptions
LED Indication Description
LINK Green An Ethernet link has been established
Off No Ethernet link established
FDX Green The interface is transmitting data in full-duplex mode
Off When off, the interface is transmitting data in half-duplex mode
100 Mbps Green The speed of the interface is 100 Mbps
Off The speed of the interface is 10 Mbps or no link is established
POWER RPS ACTIVITY
99496
Table 6 Cisco 2621XM and Cisco 2651XM Front Panel LEDs and Descriptions
LED Indication Description
Power Green Power is supplied to the router and the router is operational
Off The router is not powered on
RPS1
1. RPS = Redundant Power System
Green RPS is attached and operational
Off No RPS is attached
Blink RPS is attached, but has a failure
Activity Off In the Cisco IOS software, but no network activity
Blink (500 ms ON, 500 ms OFF) In ROMMON, no errors
Blink (500 ms ON, 500 ms OFF,
2 sec between codes)
In ROMMON, error detected
Blink (less than 500 ms) In the Cisco IOS software, the blink rate reflects the level of activity

13
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
The Cisco 2691 Cryptographic Module
Figure 10 The Cisco 2691 Router
Table 7 Cisco 2621XM and Cisco 2651XM FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
Console Port
Auxiliary Port
Data Input Interface
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
Console Port
Auxiliary Port
Data Output Interface
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
Power Switch
Console Port
Auxiliary Port
Control Input Interface
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
LAN Port LEDs
10/100BASE-TX LAN Port LEDs
Power LED
Redundant Power LED
Activity LED
Console Port
Auxiliary Port
Status Output Interface
Power Plug Power Interface
99499
SEE MANUAL BEFORE INSTALLATION
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
EN
V0
BANK 4 BANK 3 BANK 2 BANK 1 BANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD

14
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
The cryptographic boundary is defined as encompassing the "top," "front," "left," "right," and "bottom"
surfaces of the case; all portions of the "backplane" of the case which are not designed to accommodate
a WIC or Network Module; and the inverse of the three-dimensional space within the case that would be
occupied by an installed WIC or Network Module. The cryptographic boundary includes the connection
apparatus between the WIC or Network Module and the motherboard/daughterboard that hosts the WIC
or Network Module, but the boundary does not include the WIC or Network Module itself. In other
words, the cryptographic boundary encompasses all hardware components within the case of the device
except any installed modular WICs or Network Modules. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
Cisco IOS features such as tunneling, data encryption, and termination of Remote Access WANs via
IPSec, Layer 2 Forwarding (L2F) and Layer 2 Tunneling Protocols (L2TP) make the Cisco 2600 an ideal
platform for building virtual private networks or outsourced dial solutions. Cisco 2600`s RISC-based
processor provides the power needed for the dynamic requirements of the remote branch office,
achieving wire speed Ethernet to Ethernet routing with up to 70 thousand packets per second (Kpps)
throughput capacity.
Cisco 2691 Module Interfaces
The interfaces for the router are located on the rear panel as shown in Figure 11.
Figure 11 Cisco 2691 Physical Interfaces
The Cisco 2691 router features console and auxiliary ports, dual fixed LAN interfaces, a Network
Module slot, two Cisco WAN interface card (WIC) slots, and a Compact Flash slot.
LAN support includes single and dual Ethernet options; 10/100 Mbps auto-sensing Ethernet; mixed
Token-Ring and Ethernet; and single Token Ring chassis versions. WAN interface cards support a variety
of serial, ISDN BRI, and integrated CSU/DSU options for primary and backup WAN connectivity, while
available Network Modules support multi-service voice/data/fax integration, departmental dial
concentration, and high-density serial options. The AIM slot supports integration of advanced services
such as hardware-assisted data compression and encryption. All Cisco 2600 series routers include an
auxiliary port supporting 115Kbps Dial-On-Demand Routing, ideal for back-up WAN connectivity.
When a Network Module is inserted, it fits into an adapter called the Network Module expansion bus.
The expansion bus interacts with the PCI bridge in the same way that the fixed LAN ports do; therefore,
no critical security parameters pass through the Network Module (just as they don't pass through the
LAN ports). Network modules do not perform any cryptographic functions.
99500
SEE MANUAL BEFORE INSTALLATION
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
EN
V0
BANK 4 BANK 3 BANK 2 BANK 1 BANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
2
3 5
694
8
7
1

15
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
WICs are similar to Network Modules in that they greatly increase the router's flexibility. A WIC is
inserted into one of two slots, which are located above the fixed LAN ports. WICs interface directly with
the processor. They do not interface with the cryptographic card; therefore no security parameters will
pass through them. WICs cannot perform cryptographic functions; they only serve as a data input and
data output physical interface.
The physical interfaces include a power plug for the power supply and a power switch. The router has
two Fast Ethernet (10/100 RJ-45) connectors for data transfers in and out. The module also has two other
RJ-45 connectors on the back panel for a console terminal for local system access and an auxiliary port
for remote system access or dial backup using a modem. The 10/100Base-T LAN ports have
Link/Activity, 10/100Mbps, and half/full duplex LEDs. Figure 12 shows the LEDs located on the rear
panel with descriptions detailed in Table 8:
Figure 12 Cisco 2691 Rear Panel LEDs
Table 8 Cisco 2691 Rear Panel LEDs and Descriptions
LED Indication Description
LINK On An Ethernet link has been established
Off No Ethernet link established
ACT On The interface is transmitting or receiving packets
Off The interface is not transmitting or receiving packets
100 Mbps On The speed of the interface is 100 Mbps
Off The speed of the interface is 10 Mbps or no link is established
CF1 On The Flash device is being accessed in either READ or WRITE mode
Off The Flash device is not being accessed
99501
SEE MANUAL BEFORE INSTALLATION
CONSOLE AUX
FAST ETHERNET 0/1 FAST ETHERNET 0/0
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
ACT LED
100 Mbps LED
LINK LED
CF1
LED
FastEthernet 0/1
FastEthernet 0/0
ACT
100 Mbps
LINK
ACT
100 Mbps
LINK
CF1
CISCO2691
Compact
Flash
slot
Console
port
Auxiliary
port

16
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
Figure 13 shows the front panel LEDs, which provide overall status of the router's operation. The front
panel displays whether or not the router is booted, if the redundant power is (successfully) attached and
operational, and overall activity/link status.
Figure 13 Cisco 2691 Front Panel LEDs
Table 9 provides more detailed information conveyed by the LEDs on the front panel of the router:
All of these physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in
Table 10:
SYS
RPS
PWR ACT
99502
Table 9 Cisco 2691 Front Panel LEDs and Descriptions
LED Indication Description
PWR On Power is supplied to the router
Off The router is not powered on
SYS/RPS Rapid blinking System is booting
Slow blinking System error
On System OK
ACT Off No system activity
Blinking System activity

17
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
Table 10 Cisco 2691 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
Console Port
Auxiliary Port
Compact Flash slot
Data Input Interface
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
Console Port
Auxiliary Port
Compact Flash slot
Data Output Interface
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
Power Switch
Console Port
Auxiliary Port
Control Input Interface
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
LAN Port LEDs
10/100BASE-TX LAN Port LEDs
Power LED
Activity LED
Console Port
Auxiliary Port
Status Output Interface
Power Plug Power Interface

18
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
The Cisco 3725/3745 Cryptographic Module
Figure 14 The Cisco 3725 and Cisco 3745 Routers
The cryptographic boundary is defined as encompassing the "top," "front," "left," "right," and "bottom"
surfaces of the case; all portions of the "backplane" of the case which are not designed to accommodate
a WIC or Network Module; and the inverse of the three-dimensional space within the case that would be
occupied by an installed WIC or Network Module. The cryptographic boundary includes the connection
apparatus between the WIC or Network Module and the motherboard/daughterboard that hosts the WIC
or Network Module, but the boundary does not include the WIC or Network Module itself. In other
words, the cryptographic boundary encompasses all hardware components within the case of the device
except any installed modular WICs or Network Modules. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
Cisco IOS features such as tunneling, data encryption, and termination of Remote Access WANs via
IPSec, Layer 2 Forwarding (L2F) and Layer 2 Tunneling Protocols (L2TP) make the Cisco 3700 an ideal
platform for building virtual private networks or outsourced dial solutions. Cisco 3700`s RISC-based
processor provides the power needed for the dynamic requirements of the remote branch office,
achieving wire speed Ethernet to Ethernet routing with up to 100 thousand packets per second (Kpps)
throughput capacity for the 3725, and 225 Kpps for the 3745.
Cisco 3725 and 3745 Module Interfaces
The interfaces for the router are located on the rear panel as shown in Figure 15.
SEE MANUAL BEFORE INSTALLATION
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
EN
V0
BANK 4 BANK 3 BANK 2 BANK 1 BANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
99504
EN
V0
BANK4 BANK3 BANK2 BANK1 BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4 BANK3 BANK2 BANK1 BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4 BANK3 BANK2 BANK1 BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4 BANK3 BANK2 BANK1 BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
SEEMANUALBEFOREINSTALLATION
SERIAL1
SERIAL0
CONNCONN
WIC
2T
SEEMANUALBEFOREINSTALLATION
SERIAL1
SERIAL0
CONNCONN
WIC
2T
SEEMANUALBEFOREINSTALLATION
DSU
56K
CD
AL
LP
RD
TD

19
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
Figure 15 Cisco 3725 and Cisco 3745 Physical Interfaces
The Cisco 3725 and 3745 routers feature console and auxiliary ports, dual fixed LAN interfaces, two
network module slots on the 3725 and four on the 3745, three Cisco WAN interface card (WIC) slots,
and a Compact Flash slot.
LAN support includes single and dual Ethernet options; 10/100 Mbps auto-sensing Ethernet; mixed
Token-Ring and Ethernet; and single Token Ring chassis versions. WAN interface cards support a variety
of serial, ISDN BRI, and integrated CSU/DSU options for primary and backup WAN connectivity, while
available network modules support multi-service voice/data/fax integration, departmental dial
concentration, and high-density serial options. All Cisco 3700 series routers include an auxiliary port
supporting 115Kbps Dial-On-Demand Routing, ideal for back-up WAN connectivity.
1Interface Card Slots 5FastEthernet 0/1
2Network Modules 6Compact Flash Slot
3Power Supply 7Auxiliary Port
4FastEthernet 0/0 8Console Port
SEE MANUAL BEFORE INSTALLATION
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
EN
V0
BANK 4 BANK 3 BANK 2 BANK 1 BANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
1 3
2
4
6
7
9
8
99505
EN
V0
BANK4 BANK3 BANK2 BANK1 BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4 BANK3 BANK2 BANK1BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4BANK3 BANK2 BANK1BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4 BANK3BANK2 BANK1BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
SEEMANUALBEFOREINSTALLATION
SERIAL1
SERIAL0
CONNCONN
WIC
2T
SEEMANUALBEFOREINSTALLATION
SERIAL1
SERIAL0
CONNCONN
WIC
2T
SEEMANUALBEFOREINSTALLATION
DSU
56K
CD
AL
LP
RD
TD
5
8
76
9
3
5
42
1
10

20
Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, and 3745 Modular Access Routers and 7206-VXR NPE-400 Router FIPS 140-2 Non-Proprietary
OL-6083-01
The Cisco 1721, 1760, 2621XM, 2651XM, 2691, 3725, 3745, and 7206 VXR NPE-400 Routers
When a network module is inserted, it fits into an adapter called the network module expansion bus. The
expansion bus interacts with the PCI bridge in the same way that the fixed LAN ports do; therefore, no
critical security parameters pass through the network module (just as they don't pass through the LAN
ports). Network modules do not perform any cryptographic functions.
WICs are similar to network modules in that they greatly increase the router's flexibility. A WIC is
inserted into one of two slots, which are located above the fixed LAN ports. WICs interface directly with
the processor. They do not interface with the cryptographic card; therefore no security parameters will
pass through them. WICs cannot perform cryptographic functions; they only serve as a data input and
data output physical interface.
The physical interfaces include a power plug for the power supply and a power switch. The router has
two Fast Ethernet (10/100 RJ-45) connectors for data transfers in and out. The module also has two other
RJ-45 connectors on the back panel for a console terminal for local system access and an auxiliary port
for remote system access or dial backup using a modem. The 10/100Base-T LAN ports have
Link/Activity, 10/100Mbps, and half/full duplex LEDs. Figure 16 shows the LEDs located on the rear
panel with descriptions detailed in Table 11 and Table 12:
Figure 16 Cisco 3725 and Cisco 3745 Rear Panel LEDs
SEE MANUAL BEFORE INSTALLATION
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
AL
CD
LP
RD
TD
SEE MANUAL BEFORE INSTALLATION
DSU
56K
EN
V0
BANK 4 BANK 3 BANK 2 BANK 1 BANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
99506
EN
V0
BANK4BANK3BANK2BANK1BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4BANK3BANK2BANK1BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4BANK3BANK2BANK1BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
EN
V0
BANK4BANK3BANK2BANK1BANK0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLATION
CTRLRE2CTRLRE1
AL
LP
CD
SEE MANUAL BEFOREINSTALLATION
SERIAL 1
SERIAL 0
CONNCONN
WIC
2T
SEEMANUALBEFOREINSTALLATION
SERIAL 1
SERIAL 0
CONNCONN
WIC
2T
SEEMANUALBEFOREINSTALLATION
DSU
56K
CD
AL
LP
RD
TD
FastEthernet 0/1
FastEthernet 0/0
FastEthernet 0/1
FastEthernet 0/0
CF
POWERSYSTEMSYSTEMETMNPAAIM1AIM0
POWER SYSTEM
CF
ETM NPA AIM1 AIM0