Cisco 2851 - Integrated Services Router User manual

Corporate Headquarters:
© 2005 Cisco Systems, Inc. All rights reserved.
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Cisco 2851 Integrated Services Router FIPS
140-2 Non Proprietary Security Policy
Level 2 Validation
Version 1.3
November 23, 2005
Introduction
This document is the non-proprietary Cryptographic Module Security Policy for the Cisco 2851
Integrated Services Router without an AIM card installed. This security policy describes how the Cisco
2851 Integrated Services Router (Hardware Version: 2851; Firmware Version: 12.3(11)T03) meet the
security requirements of FIPS 140-2, and how to operate the router with on-board crypto enabled in a
secure FIPS 140-2 mode. This policy was prepared as part of the Level 2 FIPS 140-2 validation of the
Cisco 2851 Integrated Services Router.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2—Security Requirements for
Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the NIST website at
http://csrc.nist.gov/cryptval/.
This document contains the following sections:
• Introduction, page 1
• Cisco 2851 Routers, page 2
• Secure Operation of the Cisco 2851 Router, page 17
• Related Documentation, page 18
• Obtaining Documentation, page 19
• Documentation Feedback, page 20
• Cisco Product Security Overview, page 20
• Obtaining Technical Assistance, page 21
• Obtaining Additional Publications and Information, page 22

2
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
References
This document deals only with operations and capabilities of the Cisco 2851 Integrated Services Router
in the technical terms of a FIPS 140-2 cryptographic module security policy. More information is
available on the routers from the following sources:
• The Cisco Systems website contains information on the full line of Cisco Systems routers. Please
refer to the following website:
http://www.cisco.com/en/US/products/hw/routers/index.html
• For answers to technical or sales related questions please refer to the contacts listed on the Cisco
Systems website at www.cisco.com.
• The NIST Validated Modules website (http://csrc.nist.gov/cryptval) contains contact information
for answers to technical or sales-related questions for the module.
Terminology
In this document, the Cisco 2851 router is referred to as the router, the module, or the system.
Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
• Vendor Evidence document
• Finite State Machine
• Other supporting documentation as additional references
This document provides an overview of the routers and explains their secure configuration and
operation. This introduction section is followed by the “Cisco 2851 Routers” section on page 2, which
details the general features and functionality of the router. The “Secure Operation of the Cisco 2851
Router” section on page 17 specifically addresses the required configuration for the FIPS-mode of
operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation Submission
Documentation is Cisco-proprietary and is releasable only under appropriate non-disclosure agreements.
For access to these documents, please contact Cisco Systems.
Cisco 2851 Routers
Branch office networking requirements are dramatically evolving, driven by web and e-commerce
applications to enhance productivity and merging the voice and data infrastructure to reduce costs. The
Cisco 2851 routers provide a scalable, secure, manageable remote access server that meets FIPS 140-2
Level 2 requirements. This section describes the general features and functionality provided by the
routers. The following subsections describe the physical characteristics of the routers.

3
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
The Cisco 2851 Cryptographic Module Physical Characteristics
Figure 1 The Cisco 2851 router case
The Cisco 2851 router is a multiple-chip standalone cryptographic module. The router has a processing
speed of 450MHz. Depending on configuration, either the internal Safenet chip or the IOS software is
used for cryptographic operations.
The cryptographic boundary of the module is the device's case, shown in Figure 1. All of the
functionality discussed in this document is provided by components within this cryptographic boundary.
The interface for the router is located on the front and rear panels as shown in Figure 2 and Figure 3.
Figure 2 Cisco 2851 Front Panel Physical Interfaces
95903
Do Not Remove During Network Operation
COMPACT FLASH
CONSOLE
AUX
SYS
PWR
AUX/
PWR
SYS
ACT CF
0
1
OPTIONALRPSINPUT
12V11A
-48V4A
100-240 V~ 4A
50/60 Hz
95553
Do Not Remove During Network Operation
COMPACT FLASH
0
1
OPTIONAL RPS INPUT
SYS
PWR AUX/ PWR SYS ACT CF
12V 18A
100-240 V~ 3A
50/60 Hz
1457 6 3
CONSOLE
AUX
2

4
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
Figure 3 Cisco 2851 Rear Panel Physical Interfaces
The Cisco 2851 router features a console port, an auxiliary port, two Universal Serial Bus (USB) ports,
four high-speed WAN interface card (HWIC) slots, two10/100 Gigabit Ethernet RJ45 ports, a Enhanced
Network Module (ENM) slot, a Voice Network Module (VeNoM) slot, and a Compact Flash (CF) drive.
The Cisco 2851 router supports one single-width network module, four single-width or two
double-width HWICs, two internal advanced integration modules (AIMs)1, three internal packet voice
data modules (PVDMs), two fast Ethernet connections, and 16 ports of IP phone power output. Figure 2
shows the front panel and Figure 3 shows the rear panel. The front panel contains 4 LEDs that output
status data about the system power, auxiliary power, system activity, and compact flash busy status. The
back panel consists of 13 LEDs: two Ethernet activity LEDs, two duplex LEDs, two speed LEDs, two
link LEDs, three PVDM LEDs, and two AIM LEDs.
The front panel contains the following:
• (1) Power inlet
• (2) Power switch
• (3) Console and auxiliary ports
• (4) USB ports
• (5) CF drive
• (6) LEDs described in Table 1
• (7) Optional RPS input
The back panel contains the following:
• (1) GE 0 port
• (2) GE 1 port
• (3) HWIC 0 slot
• (4) HWIC 1 slot
• (5) HWIC 2 slot
• (6) HWIC 3 slot
• (7) VeNoM slot
• (8) ENM slot
• (9) Ground connector
EVM 2 ONLY
A= ACT
GE 0/1
PVDM2 PVDM1 PVDM0 AIM1 AIM0
GE 0/0
S= SPEED A= FDX A= LINK
A
F
S
L
A
F
S
L
H
W
I
C
2
H
W
I
C
0
H
W
I
C
3
H
W
I
C
1
1
95557
73
5
461
2
9
8
1. However, an AIM module may not be installed in accordance with this security policy. There is a separate
security policy covering the Cisco 2851 router with AIM module installed.

5
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
Table 1 and Table 2 provide more detailed information conveyed by the LEDs on the front and rear panel
of the router:
Table 3 describes the meaning of Ethernet LEDs on the rear panel:
Table 1 Cisco 2851 Front Panel Indicators
Name State Description
System Power Off
Blinking Green
Solid Green
Solid Orange
Power off
ROMMON mode
Operating normally
System Error Detected
Auxiliary Power Off
Solid Green
Solid Orange
-48V PS and RPS not present
-48V PS or RPS present and functional
-48V PS or RPS present and failure detected
Activity Off
Blinking Green
Solid Green
No interrupts or packet transfer occurring
System is servicing interrupts
System is actively transferring packets
Compact Flash Off
Solid Green
No ongoing accesses, eject permitted
Device is busy, do not eject
Table 2 Cisco 2851 Rear Panel Indicators
Name State Description
PVDM2 Off
Solid Green
Solid Orange
PVDM2 not installed
PVDM2 installed and initialized
PVDM2 installed and initialized error
PVDM1 Off
Solid Green
Solid Orange
PVDM1 not installed
PVDM1 installed and initialized
PVDM1 installed and initialized error
PVDM0 Off
Solid Green
Solid Orange
PVDM0 not installed
PVDM0 installed and initialized
PVDM0 installed and initialized error
AIM1 Off
Solid Green
Solid Orange
AIM1 not installed
AIM1 installed and initialized
AIM1 installed and initialized error
AIM0 Off
Solid Green
Solid Orange
AIM0 not installed
AIM0 installed and initialized
AIM0 installed and initialized error

6
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in the
Table 4:
Table 3 Cisco 2851 Ethernet Indicators
Name State Description
Activity Off
Solid/Blinking Green
Not receiving packets
Receiving packets
Duplex Off
Solid Green
Half-Duplex
Full-Duplex
Speed One Blink Green
Two Blink Green
10 Mbps
100 Mbps
Link Off
Solid Green
No link established
Ethernet link is established
Table 4 Cisco 2851 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slot
Ve N o M S l o t
Data Input Interface
10/100 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slot
Ve N o M S l o t
Data Output Interface
10/100 Ethernet LAN Ports
HWIC Ports
Power Switch
Console Port
Auxiliary Port
ENM Slot
Control Input Interface

7
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
There are two USB ports but they are not supported currently. The ports will be supported in the future
for smartcard or token reader.
The CF card that stored the IOS image is considered an internal memory module, because the IOS image
stored in the card may not be modified or upgraded. The card itself must never be removed from the
drive. Tamper evident seal will be placed over the card in the drive.
Roles and Services
Authentication in Cisco 2851 is role-based. There are two main roles in the router that operators can
assume: the Crypto Officer role and the User role. The administrator of the router assumes the Crypto
Officer role in order to configure and maintain the router using Crypto Officer services, while the Users
exercise only the basic User services. The module supports RADIUS and TACACS+ for authentication.
A complete description of all the management and configuration capabilities of the router can be found
in the Performing Basic System Management manual and in the online help for the router.
User Services
Users enter the system by accessing the console port with a terminal program or via IPSec protected
telnet or SSH session to a LAN port. The IOS prompts the User for username and password. If the
password is correct, the User is allowed entry to the IOS executive program.
The services available to the User role consist of the following:
• Status Functions—View state of interfaces and protocols, version of IOS currently running.
• Network Functions—Connect to other network devices through outgoing telnet, PPP, etc. and
initiate diagnostic network services (i.e., ping, mtrace).
• Terminal Functions—Adjust the terminal session (e.g., lock the terminal, adjust flow control).
• Directory Services—Display directory of files kept in flash memory.
10/100 Ethernet LAN Port LEDs
AIM LEDs
PVDM LEDs
Power LED
Activity LEDs
Auxiliary LED
Compact Flash LED
Console Port
Auxiliary Port
Status Output Interface
Main Power Plug
Redundant Power Supply Plug
Power Interface
Table 4 Cisco 2851 FIPS 140-2 Logical Interfaces (Continued)

8
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
Crypto Officer Services
During initial configuration of the router, the Crypto Officer password (the “enable” password) is
defined. A Crypto Officer can assign permission to access the Crypto Officer role to additional accounts,
thereby creating additional Crypto Officers.
The Crypto Officer role is responsible for the configuration and maintenance of the router. The Crypto
Officer services consist of the following:
• Configure the router—Define network interfaces and settings, create command aliases, set the
protocols the router will support, enable interfaces and network services, set system date and time,
and load authentication information.
• Define Rules and Filters—Create packet Filters that are applied to User data streams on each
interface. Each Filter consists of a set of Rules, which define a set of packets to permit or deny based
on characteristics such as protocol ID, addresses, ports, TCP connection establishment, or packet
direction.
• View Status Functions—View the router configuration, routing tables, active sessions, use gets to
view SNMP MIB statistics, health, temperature, memory status, voltage, packet statistics, review
accounting logs, and view physical interface status.
• Manage the router—Log off users, shutdown or reload the router, manually back up router
configurations, view complete configurations, manage user rights, and restore router configurations.
• Set Encryption/Bypass—Set up the configuration tables for IP tunneling. Set keys and algorithms
to be used for each IP range or allow plaintext packets to be set from specified IP address.
Physical Security
The router is entirely encased by a metal, opaque case. The rear of the unit contains HWIC/WIC/VIC
connectors, LAN connectors, a CF drive, power connector, console connector, auxiliary connector, USB
port, and fast Ethernet connectors. The front of the unit contains the system status and activity LEDs.
The top, side, and front portion of the chassis can be removed to allow access to the motherboard,
memory, AIM slot, and expansion slots.
Once the router has been configured in to meet FIPS 140-2 Level 2 requirements, the router cannot be
accessed without signs of tampering. To seal the system, apply serialized tamper-evidence labels as
follows:

9
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
To apply serialized tamper-evidence labels to the Cisco 2851:
Step 1 Clean the cover of any grease, dirt, or oil before applying the tamper evidence labels. Alcohol-based
cleaning pads are recommended for this purpose. The temperature of the router should be above 10 C.
Step 2 The tamper evidence label should be placed so that the one half of labels A, B, C, D and E covers the
enclosure and the other half covers the port adapter slot.
Step 3 The tamper evidence label should be placed so that the one half of label F covers the enclosure and the
other half covers the rear panel.
Step 4 The tamper evidence label should be placed so that one half of labels G and H covers the front panel and
the other half covers the enclosure.
Step 5 The tamper evidence label I should be placed over the CF card in the slot so that any attempt to remove
the card will show sign of tampering.
Step 6 The labels completely cure within five minutes.
Figure 4 and Figure 5 show the tamper evidence label placements for the Cisco 2851.
Figure 4 Cisco 2851 Tamper Evident Label Placement (Back View)
Figure 5 Cisco 2851 Tamper Evident Label Placement (Front View)
Cryptographic Key Management
The router securely administers both cryptographic keys and other critical security parameters such as
passwords. The tamper evidence seals provide physical protection for all keys. All keys are also
protected by the password-protection on the Crypto Officer role login, and can be zeroized by the Crypto
Officer. All zeroization consists of overwriting the memory that stored the key. Keys are exchanged and
entered electronically or via Internet Key Exchange (IKE).
The routers support the following FIPS 140-2 approved algorithm implementations:

10
Cisco 2851 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8717-01
Cisco 2851 Routers
• Software (IOS) implementations
– AES
– DES (for legacy use only) (transitional phase only – valid until May 19th, 2007)
– 3DES
– SHA-1
– HMAC-SHA-1
– X9.31 PRNG
• Onboard hardware implementations
– AES
– DES (for legacy use only) (transitional phase only – valid until May 19th, 2007)
– 3DES
– SHA-1
– HMAC-SHA-1
The router is in the approved mode of operation only when FIPS 140-2 approved algorithms are used
(except DH which is allowed in the approved mode for key establishment despite being non-approved).
The following are not FIPS 140-2 approved algorithms: RC4, MD5, HMAC-MD5, RSA and DH.
Note: The module supports DH key sizes of 1024 and 1536 bits. Therefore, DH provides 80-bit and
96-bit of encryption strength per NIST 800-57.
The module supports two types of key management schemes:
• Pre-shared key exchange via electronic key entry. DES/3DES/AES key and HMAC-SHA-1 key are
exchanged and entered electronically.
• Internet Key Exchange method with support for pre-shared keys exchanged and entered
electronically.
– The pre-shared keys are used with Diffie-Hellman key agreement technique to derive DES,
3DES or AES keys.
– The pre-shared key is also used to derive HMAC-SHA-1 key.
The module supports commercially available Diffie-Hellman for key establishment. See the Cisco IOS
Reference Guide.
All pre-shared keys are associated with the CO role that created the keys, and the CO role is protected
by a password. Therefore, the CO password is associated with all the pre-shared keys. The Crypto
Officer needs to be authenticated to store keys. All Diffie-Hellman (DH) keys agreed upon for individual
tunnels are directly associated with that specific tunnel only via the IKE protocol.
Key Zeroization:
Each key can be zeroized by sending the “no” command prior to the key function commands. This will
zeroize each key from the DRAM, the running configuration.
“Clear Crypto IPSec SA” will zeroize the IPSec DES/3DES/AES session key (which is derived using
the Diffie-Hellman key agreement technique) from the DRAM. This session key is only available in the
DRAM; therefore this command will completely zeroize this key. The following command will zeroize
the pre-shared keys from the DRAM:
• no set session-key inbound ah spi hex-key-data
• no set session-key outbound ah spi hex-key-data