Cisco 2811 Series Instruction Manual

Corporate Headquarters:
© 2005 Cisco Systems, Inc. All rights reserved.
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Cisco 2811 and Cisco 2821 Integrated Services
Router FIPS 140-2 Non Proprietary Security
Policy
Level 2 Validation
Version 1.3
November 23, 2005
Introduction
This document is the non-proprietary Cryptographic Module Security Policy for the Cisco 2811 and
Cisco 2821 Integrated Services Router without an AIM card installed. This security policy describes
how the Cisco 2811 and Cisco 2821 Integrated Services Router (Hardware Version: 2811 or 2821;
Firmware Version: 12.3(11)T03) meet the security requirements of FIPS 140-2, and how to operate the
router enabled in a secure FIPS 140-2 mode. This policy was prepared aspart of the Level 2 FIPS 140-2
validation of the Cisco 2811 or Cisco 2821 Integrated Services Router.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2—Security Requirements for
Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the NIST website at
http://csrc.nist.gov/cryptval/.
This document contains the following sections:
• Introduction, page 1
• Cisco 2811 and Cisco 2821 Routers, page 2
• Secure Operation of the Cisco 2811 or Cisco 2821 router, page 22
• Related Documentation, page 23
• Obtaining Documentation, page 24
• Documentation Feedback, page 25
• Cisco Product Security Overview, page 25
• Obtaining Technical Assistance, page 26

2
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
• Obtaining Additional Publications and Information, page 27
References
This document deals only with operations and capabilities of the Cisco 2811 and Cisco 2821 routers in
the technical terms of a FIPS 140-2 cryptographic module security policy. More information is available
on the routers from the following sources:
• The Cisco Systems website contains information on the full line of Cisco Systems routers. Please
refer to the following website:
http://www.cisco.com/en/US/products/hw/routers/index.html
• For answers to technical or sales related questions please refer to the contacts listed on the Cisco
Systems website at www.cisco.com.
• The NIST Validated Modules website (http://csrc.nist.gov/cryptval) contains contact information
for answers to technical or sales-related questions for the module.
Terminology
In this document, the Cisco 2811 or Cisco 2821 routers are referred to as the router, the module, or the
system.
Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
• Vendor Evidence document
• Finite State Machine
• Other supporting documentation as additional references
This document provides an overview of the routers and explains their secure configuration and
operation. This introduction section is followed by the “Cisco 2811 and Cisco 2821 Routers” section on
page 2, which details the general features and functionality of the router. The “Secure Operation of the
Cisco 2811 or Cisco 2821 router” section on page 22 specifically addresses the required configuration
for the FIPS-mode of operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation Submission
Documentation is Cisco-proprietary and is releasable only under appropriate non-disclosure agreements.
For access to these documents, please contact Cisco Systems.
Cisco 2811 and Cisco 2821 Routers
Branch office networking requirements are dramatically evolving, driven by web and e-commerce
applications to enhance productivity and merging the voice and data infrastructure to reduce costs. The
Cisco 2811 and Cisco 2821 routers provide a scalable, secure, manageable remote access server that
meets FIPS 140-2 Level 2 requirements. This section describes the general features and functionality
provided by the routers. The following subsections describe the physical characteristics of the routers.

3
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
The Cisco 2811 Cryptographic Module Physical Characteristics
Figure 1 The Cisco 2811 router case
The Cisco 2811 router is a multiple-chip standalone cryptographic module. The router has a processing
speed of 350MHz. Depending on configuration, either the internal NetGX chip or the IOS software is
used for cryptographic operations.
The cryptographic boundary of the module is the device's case. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
The interface for the router is located on the rear and front panels as shown in Figure 2 and Figure 3,
respectively.
Figure 2 Cisco 2811 Front Panel Physical Interfaces
Figure 3Cisco2811RearPanel Physical Interfaces
The Cisco 2811 router features a console port, an auxiliary port, two Universal Serial Bus (USB) ports,
four high-speed WAN interface card (HWIC) slots, two10/100 Gigabit Ethernet RJ45 ports, an Enhanced
Network Module (ENM) slot, and a Compact Flash (CF) drive. The Cisco 2811 router supports one
single-width network module, four single-width or two double-width HWICs, two internal advanced
integration modules (AIMs)1, two internal packet voice data modules (PVDMs), two fast Ethernet
connections, and 16 ports of IP phone power output. The Figure 2 shows the front panel and Figure 3
9
5902
Do Not Remove During Network Operation
COMPACT FLASH
CONSOLE OPTIONAL RPS INPUT
12V 11A
AUX
SYS
PWR AUX/
PWR SYS
ACT CF
-48V 4A
100-240 V~ 4A
50/60 Hz
0
1
95551
Do Not Remove During Network Operation
COMPACT FLASH
CONSOLE
0
1
OPTIONAL RPS INPUT
12V 11A
AUX
SYS
PWR AUX/ PWR SYS ACT CF 100-240 V~ 2A
50/60 Hz
124567 3
A= ACT
FE 0/1
PVDM1 PVDM0 AIM1 AIM0
FE 0/0
S= SPEED A= FDX A= LINK A
F
S
L
A
F
S
L
H
W
I
C
2
H
W
I
C
0
H
W
I
C
3
H
W
I
C
1
1
23
95556
45
67 1
8

4
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
shows the rear panel. The front panel contains 4 LEDs that output status data about the system power,
auxiliary power, system activity, and compact flash busy status. The back panel consists of 12 LEDs:
two Ethernet activity LEDs, two duplex LEDs, two speed LEDs, two link LEDs, two PVDM LEDs, and
two AIM LEDs.
The front panel contains the following:
• (1) Power inlet
• (2) Power switch
• (3) Optional RPS input
• (4) Console and auxiliary ports
• (5) USB ports
• (6) CF drive
• (7) LEDs described in table 1.
The back panel contains the following:
• (1) Ground connector
• (2) and (3) Ethernet ports and LEDs
• (4)-(7) HWIC slots
• (8) ENM slot.
Table 1 and Table 2 provide more detailed information conveyed by the LEDs on the front and rear panel
of the router:
1. However, an AIM module may not be installed in accordance with this security policy. There is a separate
security policy covering the Cisco 2811 and Cisco 2821 routers with AIM module installed.
Table 1 Cisco 2811 Front Panel Indicators
Name State Description
System Power Off
Blinking Green
Solid Green
Solid Orange
Power off
ROMMON mode
Operating normally
System Error Detected
Auxiliary Power Off
Solid Green
Solid Orange
-48V PS and RPS not present
-48V PS or RPS present and functional
-48V PS or RPS present and failure detected
Activity Off
Blinking Green
Solid Green
No interrupts or packet transfer occurring
System is servicing interrupts
System is actively transferring packets
Compact Flash Off
Solid Green
No ongoing accesses, eject permitted
Device is busy, do not eject

5
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
Table 3 describes the meaning of Ethernet LEDs on the rear panel:
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in the
Table 4:
Table 2 Cisco 2811 Rear Panel Indicators
Name State Description
PVDM1 Off
Solid Green
Solid Orange
PVDM1 not installed
PVDM1 installed and initialized
PVDM1 installed and initialized error
PVDM0 Off
Solid Green
Solid Orange
PVDM0 not installed
PVDM0 installed and initialized
PVDM0 installed and initialized error
AIM1 Off
Solid Green
Solid Orange
AIM1 not installed
AIM1 installed and initialized
AIM1 installed and initialized error
AIM0 Off
Solid Green
Solid Orange
AIM0 not installed
AIM0 installed and initialized
AIM0 installed and initialized error
Table 3 Cisco 2811 Ethernet Indicators
Name State Description
Activity Off
Solid/Blinking
Green
Not receiving packets
Receiving packets
Duplex Off
Solid Green
Half-Duplex
Full-Duplex
Speed One Blink Green
Two Blink Green
10 Mbps
100 Mbps
Link Off
Solid Green
No link established
Ethernet link is established

6
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
There are two USB ports but they are not supported currently. The ports will be supported in the future
for smartcard or token reader.
The CF card that stored the IOS image is considered an internal memory module, because the IOS image
stored in the card may not be modified or upgraded. The card itself must never be removed from the
drive. Tamper evident seal will be placed over the card in the drive.
Table 4 Cisco 2811 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slot
Data Input Interface
10/100 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slot
Data Output Interface
10/100 Ethernet LAN Ports
HWIC Ports
Power Switch
Console Port
Auxiliary Port
ENM Slot
Control Input Interface
10/100 Ethernet LAN Port LEDs
AIM LEDs
PVDM LEDs
Power LED
Activity LEDs
Auxiliary LED
Compact Flash LED
Console Port
Auxiliary Port
Status Output Interface
Main Power Plug
Redundant Power Supply Plug
Power Interface

7
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
The Cisco 2821 Cryptographic Module Physical Characteristics
Figure 4 The Cisco 2821 router case
The Cisco 2821 router a multiple-chip standalone cryptographic module. The router has a processing
speed of 350MHz. Depending on configuration, either the internal NetGX chip or the IOS software is
used for cryptographic operations.
The cryptographic boundary of the module is the device's case. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
The interfaces for the router are located on the front and rear panel as shown in Figure 5and Figure 6,
respectively.
Figure 5 Cisco 2821 Front Panel Physical Interfaces
95903
Do Not Remove During Network Operation
COMPACT FLASH
CONSOLE
AUX
SYS
PWR
AUX/
PWR
SYS
ACT CF
0
1
OPTIONALRPSINPUT
12V11A
-48V4A
100-240 V~ 4A
50/60 Hz
95553
Do Not Remove During Network Operation
COMPACT FLASH
0
1
OPTIONAL RPS INPUT
SYS
PWR AUX/ PWR SYS ACT CF
12V 18A
100-240 V~ 3A
50/60 Hz
1457 6 3
CONSOLE
AUX
2

8
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
Figure 6 Cisco 2821 Rear Panel Physical Interfaces
The Cisco 2821 router features a console port, an auxiliary port, two Universal Serial Bus (USB) ports,
four high-speed WAN interface card (HWIC) slots, two10/100 Gigabit Ethernet RJ45 ports, a Enhanced
Network Module (ENM) slot, a Voice Network Module (VeNoM) slot, and a Compact Flash (CF) drive.
The Cisco 2821 router supports one single-width network module, four single-width or two
double-width HWICs, two internal advanced integration modules (AIMs)1, three internal packet voice
data modules (PVDMs), two fast Ethernet connections, and 16 ports of IP phone power output. The
Figure 5 shows the front panel and Figure 6 shows the rear panel. The front panel contains 4 LEDs that
output status data about the system power, auxiliary power, system activity, and compact flash busy
status. The back panel consists of 13 LEDs: two Ethernet activity LEDs, two duplex LEDs, two speed
LEDs, two link LEDs, three PVDM LEDs, and two AIM LEDs.
The front panel contains the following:
• (1) Power inlet
• (2) Power switch
• (3) Console and auxiliary ports
• (4) USB ports
• (5) CF drive
• (6) LEDs described in table 1.
• (7) Optional RPS input
The back panel contains the following:
• (1) GE 0 port
• (2) GE 1 port
• (3) HWIC 0 slot
• (4) HWIC 1 slot
• (5) HWIC 2 slot
• (6) HWIC 3 slot
• (7) VeNoM slot
• (8) ENM slot
• (9) Ground connector
95572
12 6 4 3 75
9
A= ACT
GE 0/1
PVDM2 PVDM1 PVDM0 AIM1 AIM0
GE 0/0
S= SPEED A= FDX A= LINK A
F
S
L
A
F
S
LEVM 2 ONLY
1
8
1. However, an AIM module may not be installed in accordance with this security policy. There is a separate
security policy covering the Cisco 2811 and Cisco 2821 routers with AIM module installed.

9
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
Table 5 and Table 6 provide more detailed information conveyed by the LEDs on the front and rear panel
of the router:
Table 7 describes the meaning of Ethernet LEDs on the front panel:
Table 5 Cisco 2821 Front Panel Indicators
Name State Description
System Power Off
Blinking Green
Solid Green
Solid Orange
Power off
ROMMON mode
Operating normally
System Error Detected
Auxiliary Power Off
Solid Green
Solid Orange
-48V PS and RPS not present
-48V PS or RPS present and functional
-48V PS or RPS present and failure detected
Activity Off
Blinking Green
Solid Green
No interrupts or packet transfer occurring
System is servicing interrupts
System is actively transferring packets
Compact Flash Off
Solid Green
No ongoing accesses, eject permitted
Device is busy, do not eject
Table 6 Cisco 2821 Rear Panel Indicators
Name State Description
PVDM2 Off
Solid Green
Solid Orange
PVDM2 not installed
PVDM2 installed and initialized
PVDM2 installed and initialized error
PVDM1 Off
Solid Green
Solid Orange
PVDM1 not installed
PVDM1 installed and initialized
PVDM1 installed and initialized error
PVDM0 Off
Solid Green
Solid Orange
PVDM0 not installed
PVDM0 installed and initialized
PVDM0 installed and initialized error
AIM1 Off
Solid Green
Solid Orange
AIM1 not installed
AIM1 installed and initialized
AIM1 installed and initialized error
AIM0 Off
Solid Green
Solid Orange
AIM0 not installed
AIM0 installed and initialized
AIM0 installed and initialized error

10
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in the
Table 8:
Table 7 Cisco 2821 Ethernet Indicators
Name State Description
Activity Off
Solid/Blinking Green
Not receiving packets
Receiving packets
Duplex Off
Solid Green
Half-Duplex
Full-Duplex
Speed One Blink Green
Two Blink Green
10 Mbps
100 Mbps
Link Off
Solid Green
No link established
Ethernet link is established
Table 8 Cisco 2821 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slot
VeNoM Slot
Data Input Interface
10/100 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slot
VeNoM Slot
Data Output Interface
10/100 Ethernet LAN Ports
HWIC Ports
Power Switch
Console Port
Auxiliary Port
ENM Slot
Control Input Interface