Cisco 2811 - Voice Security Bundle Router Instruction Manual

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
Cisco 2811 and Cisco 2821
Integrated Services Routers
with
AIM-VPN/EPII-Plus
FIPS 140-2 Non Proprietary Security Policy
Level 2 Validation
Version 1.6
September 08, 2008

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
2
Table of Contents
1 INTRODUCTION.................................................................................................................. 3
1.1 P URPOSE ............................................................................................................................. 3
1.2 R EFERENCES ....................................................................................................................... 3
1.3 T ERMINOLOGY .................................................................................................................... 3
1.4 D OCUMENT O RGANIZATION ................................................................................................ 3
2 CISCO 2811 AND 2821 ROUTERS......................................................................................... 5
2.1 T HE 2811 C RYPTOGRAPHIC M ODULE P HYSICAL C HARACTERISTICS ...................................... 5
2.2 T HE 2821 C RYPTOGRAPHIC M ODULE P HYSICAL C HARACTERISTICS ...................................... 8
2.3 R OLES AND S ERVICES ........................................................................................................... 12
2.3.1. User Services................................................................................................12
2.3.2 Crypto Officer Services ..................................................................................12
2.3.3 Unauthenticated Services...............................................................................13
2.3.4 Strength of Authentication..............................................................................14
2.4 P HYSICAL S ECURITY ............................................................................................................. 14
2.5 C RYPTOGRAPHIC K EY M ANAGEMENT .................................................................................. 19
2.6 S ELF -T ESTS ....................................................................................................................... 27
2.6.1 Self-tests performed by the IOS image .......................................................27
2.6.2 Self-tests performed by NetGX Chip...........................................................27
2.6.3 Self-tests performed by AIM........................................................................28
3 SECURE OPERATION OF THE CISCO 2811 OR 2821 ROUTER ............................. 28
3.1 I NITIAL S ETUP ................................................................................................................... 28
3.2 S YSTEM I NITIALIZATION AND C ONFIGURATION ................................................................. 29
3.3 IPS EC R EQUIREMENTS AND C RYPTOGRAPHIC A LGORITHMS ............................................. 29
3.4 P ROTOCOLS ....................................................................................................................... 30
3.5 SSL V 3.1/TLS R EQUIREMENTS AND C RYPTOGRAPHIC A LGORITHMS ................................ 30
3.6 R EMOTE A CCESS ............................................................................................................... 30

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
3
1 Introduction
1.1 Purpose
This document is the non-proprietary Cryptographic Module Security Policy for the Cisco 2811
and 2821 Integrated Services Routers with AIM-VPN/EPII-Plus installed. This security policy
describes how the Cisco 2811 and 2821 Integrated Services Routers (Hardware Version: 2811 or
2821; Firmware Version: IOS 12.4 (15) T3) meet the security requirements of FIPS 140-2, and
how to operate the router enabled in a secure FIPS 140-2 mode. This policy was prepared as part
of the Level 2 FIPS 140-2 validation of the Cisco 2811 or 2821 Integrated Services router.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2 — Security
Requirements for Cryptographic Modules) details the U.S. Government requirements for
cryptographic modules. More information about the FIPS 140-2 standard and validation program
is available on the NIST website at http://csrc.nist.gov/groups/STM/index.html.
1.2 References
This document deals only with operations and capabilities of the 2811 and 2821 routers with
AIM modules in the technical terms of a FIPS 140-2 cryptographic module security policy.
More information is available on the routers from the following sources:
The Cisco Systems website contains information on the full line of Cisco Systems
routers. Please refer to the following website:
http://www.cisco.com/en/US/products/hw/routers/index.html
For answers to technical or sales related questions please refer to the contacts listed on
the Cisco Systems website at www.cisco.com.
The NIST Validated Modules website
(http://csrc.nist.gov/groups/STM/cmvp/validation.html) contains contact information
for answers to technical or sales-related questions for the module.
1.3 Terminology
In this document, the Cisco 2811 or 2821 routers are referred to as the router, the module, or the
system.
1.4 Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
Vendor Evidence document
Finite State Machine
Other supporting documentation as additional references
This document provides an overview of the routers and explains their secure configuration and
operation. This introduction section is followed by Section 2, which details the general features

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
4
and functionality of the router. Section 3 specifically addresses the required configuration for
the FIPS-mode of operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation
Submission Documentation is Cisco-proprietary and is releasable only under appropriate non-
disclosure agreements. For access to these documents, please contact Cisco Systems.

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
5
2 Cisco 2811 and 2821 Routers
Branch office networking requirements are dramatically evolving, driven by web and e-
commerce applications to enhance productivity and merging the voice and data infrastructure to
reduce costs. The Cisco 2811 and 2821 routers provide a scalable, secure, manageable remote
access server that meets FIPS 140-2 Level 2 requirements. This section describes the general
features and functionality provided by the routers. The following subsections describe the
physical characteristics of the routers.
2.1 The 2811 Cryptographic Module Physical Characteristics
Figure 1 – The 2811 router case
The 2811 Router is a multiple-chip standalone cryptographic module. The router has a
processing speed of 350MHz. Depending on configuration, installed AIM-VPN/EPII-Plus
module, or the internal NetGX chip or the IOS software is used for cryptographic operations.
The cryptographic boundary of the module is the device’s case. All of the functionality
discussed in this document is provided by components within this cryptographic boundary.
The interface for the router is located on the front and rear panels as shown in Figure 2 and
Figure 3, respectively.
Figure 2 – Front Panel Physical Interfaces

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
6
Figure 3 – Rear Panel Physical Interfaces
The Cisco 2811 router features a console port, an auxiliary port, two Universal Serial Bus (USB)
ports, four high-speed WAN interface card (HWIC) slots, two10/100 Gigabit Ethernet RJ45
ports, an Enhanced Network Module (ENM) slot, and a Compact Flash (CF) drive. The 2811
router supports one single-width network module, four single-width or two double-width
HWICs, two slots for AIM-VPN/BPII-Plus cards
1
, two internal packet voice data modules
(PVDMs), two fast Ethernet connections, and 16 ports of IP phone power output. Figure 2 shows
the front panel and Figure 3 shows the rear panel. The front panel contains 4 LEDs that output
status data about the system power, auxiliary power, system activity, and compact flash busy
status. The back panel consists of 12 LEDs: two Ethernet activity LEDs, two duplex LEDs, two
speed LEDs, two link LEDs, two PVDM LEDs, and two AIM LEDs.
The front panel contains the following:
•(1) Power inlet
•(2) Power switch
•(3) Optional RPS input
•(4) Console and auxiliary ports
•(5) USB ports
•(6) CF drive
•(7) LEDs described in table 1.
The back panel contains the following:
•(1) Ground connector
•(2) and (3) Ethernet ports and LEDs
•(4)-(7) HWIC slots
•(8) ENM slot.
The following tables provide more detailed information conveyed by the LEDs on the front and
rear panel of the router:
Name State Description
System Power Off
Blinking Green
Solid Green
Solid Orange
Power off
ROMMON mode
Operating normally
System Error Detected
1
The security policy covers the configuration in which one AIM card is used.

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
7
Auxiliary Power Off
Solid Green
Solid Orange
-48V PS and RPS not present
-48V PS or RPS present and functional
-48V PS or RPS present and failure detected
Activity Off
Blinking Green
Solid Green
No interrupts or packet transfer occurring
System is servicing interrupts
System is actively transferring packets
Compact Flash Off
Solid Green No ongoing accesses, eject permitted Device is busy, do not eject
Table 1 – 2811 Front Panel Indicators
Name State Description
PVDM1 Off
Solid Green
Solid Orange
PVDM1 not installed
PVDM1 installed and initialized
PVDM1 installed and initialized error
PVDM0 Off
Solid Green
Solid Orange
PVDM0 not installed
PVDM0 installed and initialized
PVDM0 installed and initialized error
AIM1 Off
Solid Green
Solid Orange
AIM1 not installed
AIM1 installed and initialized
AIM1 installed and initialized error
AIM0 Off
Solid Green
Solid Orange
AIM0 not installed
AIM0 installed and initialized
AIM0 installed and initialized error
Table 2 – 2811 Rear Panel Indicators
The following table describes the meaning of Ethernet LEDs on the rear panel:
Name State Description
Activity Off
Solid/Blinking Green Not receiving packets Receiving packets
Duplex Off
Solid Green Half-Duplex Full-Duplex
Speed One Blink Green
Two Blink Green 10 Mbps 100 Mbps
Link Off
Solid Green No link established Ethernet link is established
Table 3 – 2811 Ethernet Indicators
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in
the following table:
Router Physical Interface FIPS 140-2 Logical Interface
10/100 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slot
USB Ports
Data Input Interface

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
8
Router Physical Interface FIPS 140-2 Logical Interface
10/100 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slot
USB Ports
Data Output Interface
10/100 Ethernet LAN Ports
HWIC Ports
Power Switch
Console Port
Auxiliary Port
ENM Slot
Control Input Interface
10/100 Ethernet LAN Port LEDs
AIM LEDs
PVDM LEDs
Power LED
Activity LEDs
Auxiliary LED
Compact Flash LED
Console Port
Auxiliary Port
USB Ports
Status Output Interface
Main Power Plug
Redundant Power Supply Plug Power Interface
Table 4 – 2811 FIPS 140-2 Logical Interfaces
The CF card that stored the IOS image is considered an internal memory module, because the
IOS image stored in the card may not be modified or upgraded. The card itself must never be
removed from the drive. Tamper evident seal will be placed over the card in the drive.
2.2 The 2821 Cryptographic Module Physical Characteristics
Figure 4 – The 2821 router case
The 2821 router a multiple-chip standalone cryptographic module. The router has a processing
speed of 350MHz. Depending on configuration, either installed AIM-VPN/EPII-Plus card or the
internal NetGX chip or the IOS software is used for cryptographic operations.

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
9
The cryptographic boundary of the module is the device’s case. All of the functionality
discussed in this document is provided by components within this cryptographic boundary.
The interfaces for the router are located on the front and rear panels as shown in Figure 5 and
Figure 6, respectively.
Figure 5 – 2821 Front Panel Physical Interfaces
Figure 6 – 2821 Rear Panel Physical Interfaces
The Cisco 2821 router features a console port, an auxiliary port, two Universal Serial Bus (USB)
ports, four high-speed WAN interface card (HWIC) slots, two10/100 Gigabit Ethernet RJ45
ports, a Enhanced Network Module (ENM) slot, a Voice Network Module (VeNoM) slot, and a
Compact Flash (CF) drive. The 2821 router supports one single-width network module, four
single-width or two double-width HWICs, has two slots for AIM-VPN/BPII-Plus cards
2
, three
internal packet voice data modules (PVDMs), two fast Ethernet connections, and 16 ports of IP
phone power output. Figure 5 shows the front panel and Figure 6 shows the rear panel. The front
panel contains 4 LEDs that output status data about the system power, auxiliary power, system
activity, and compact flash busy status. The back panel consists of 13 LEDs: two Ethernet
activity LEDs, two duplex LEDs, two speed LEDs, two link LEDs, three PVDM LEDs, and two
AIM LEDs.
The front panel contains the following:
•(1) Power inlet
•(2) Power switch
•(3) Console and auxiliary ports
2
The security policy covers the configuration in which one AIM card is used.

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
10
•(4) USB ports
•(5) CF drive
•(6) LEDs described in table 1.
•(7) Optional RPS input
The back panel contains the following:
•(1) GE 0 port
•(2) GE 1 port
•(3) HWIC 0 slot
•(4) HWIC 1 slot
•(5) HWIC 2 slot
•(6) HWIC 3 slot
•(7) VeNoM slot
•(8) ENM slot
•(9) Ground connector
The following tables provide more detailed information conveyed by the LEDs on the front and
rear panel of the router:
Name State Description
System Power Off
Blinking Green
Solid Green
Solid Orange
Power off
ROMMON mode
Operating normally
System Error Detected
Auxiliary Power Off
Solid Green
Solid Orange
-48V PS and RPS not present
-48V PS or RPS present and functional
-48V PS or RPS present and failure detected
Activity Off
Blinking Green
Solid Green
No interrupts or packet transfer occurring
System is servicing interrupts
System is actively transferring packets
Compact Flash Off
Solid Green No ongoing accesses, eject permitted Device is busy, do not eject
Table 5 – 2821 Front Panel Indicators
Name State Description
PVDM2 Off
Solid Green
Solid Orange
PVDM2 not installed
PVDM2 installed and initialized
PVDM2 installed and initialized error
PVDM1 Off
Solid Green
Solid Orange
PVDM1 not installed
PVDM1 installed and initialized
PVDM1 installed and initialized error
PVDM0 Off
Solid Green
Solid Orange
PVDM0 not installed
PVDM0 installed and initialized
PVDM0 installed and initialized error
AIM1 Off
Solid Green
Solid Orange
AIM1 not installed
AIM1 installed and initialized
AIM1 installed and initialized error
AIM0 Off
Solid Green AIM0 not installed AIM0 installed and initialized