Cisco 3825 Series Service manual

Corporate Headquarters:
© 2005 Cisco Systems, Inc. All rights reserved.
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Cisco 3825 and Cisco 3845 Integrated Services
Routers FIPS 140-2 Non Proprietary Security
Policy
Level 2 Validation
Version 1.1
November 1, 2005
Introduction
This document is the non-proprietary Cryptographic Module Security Policy for the Cisco 3825 and
Cisco 3845 Integrated Services Routers without an AIM card installed. This security policy describes
how the Cisco 3825 and Cisco 3845 Integrated Services Routers (Hardware Version: Cisco 3825 or
Cisco 3845; Firmware Version: IOS 12.3(11)T03) meet the security requirements of FIPS 140-2, and
how to operate the router with on-board crypto enabled in a secure FIPS 140-2 mode. This policy was
prepared as part of the Level 2 FIPS 140-2 validation of the Cisco 3825 and Cisco 3845 Integrated
Services Routers.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2—Security Requirements for
Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the NIST website at
http://csrc.nist.gov/cryptval/.
This document contains the following sections:
•Introduction, page 1
•Cisco 3825 and Cisco 3845 Routers, page 2
•Secure Operation of the Cisco 3825 or Cisco 3845 router, page 23
•Related Documentation, page 24
•Obtaining Documentation, page 25
•Documentation Feedback, page 26
•Cisco Product Security Overview, page 26
•Obtaining Technical Assistance, page 27

2
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
•Obtaining Additional Publications and Information, page 28
References
This document deals only with operations and capabilities of the Cisco 3825 and Cisco 3845 routers in
the technical terms of a FIPS 140-2 cryptographic module security policy. More information is available
on the routers from the following sources:
•The Cisco Systems website contains information on the full line of Cisco Systems routers. Please
refer to the following website:
http://www.cisco.com/en/US/products/hw/routers/index.html
•For answers to technical or sales related questions please refer to the contacts listed on the Cisco
Systems website at www.cisco.com.
•The NIST Validated Modules website (http://csrc.nist.gov/cryptval) contains contact information
for answers to technical or sales-related questions for the module.
Terminology
In this document, the Cisco 3825 or Cisco 3845 routers are referred to as the router, the module, or the
system.
Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
•Vendor Evidence document
•Finite State Machine
•Other supporting documentation as additional references
This document provides an overview of the routers and explains their secure configuration and
operation. This introduction section is followed by the “Cisco 3825 and Cisco 3845 Routers” section on
page 2, which details the general features and functionality of the router. The “Secure Operation of the
Cisco 3825 or Cisco 3845 router” section on page 23 specifically addresses the required configuration
for the FIPS-mode of operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation Submission
Documentation is Cisco-proprietary and is releasable only under appropriate non-disclosure agreements.
For access to these documents, please contact Cisco Systems.
Cisco 3825 and Cisco 3845 Routers
Branch office networking requirements are dramatically evolving, driven by web and e-commerce
applications to enhance productivity and merging the voice and data infrastructure to reduce costs. The
Cisco 3825 and Cisco 3845 routers provide a scalable, secure, manageable remote access server that
meets FIPS 140-2 Level 2 requirements. This section describes the general features and functionality
provided by the routers. The following subsections describe the physical characteristics of the routers.

3
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
The Cisco 3825 Cryptographic Module Physical Characteristics
Figure 1 The Cisco 3825 Router Case
The Cisco 3825 Router is a multiple-chip standalone cryptographic module. The router has a processing
speed of 500MHz. Depending on configuration, either the internal Safenet chip or the IOS software is
used for cryptographic operations.
The cryptographic boundary of the module is the device's case. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
The interface for the router is located on the rear and front panels as shown in Figure 2 and Figure 3,
respectively.
Figure 2 Cisco 3825 Rear Panel Physical Interfaces
117040
0
1
COMPACT FLASH
SYSAUXACTRPSIPPWRAIM0AIM1PVDM0PVDM1PVDM2PVDM3
R
AUX
CONSOLE
AUX
GE 0/1
SPD LNK
SPD LNK
GE 0/0
H
W
I
C
2
H
W
I
C
0
1
2
H
W
I
C
3
H
W
I
C
1SFP
2
987654
EN
NM-
ESW-
16
15x 7x 14x 6x 13x 5x
FastEthernet Ports
12x 4x 11x 3x 10x 2x 9x 1x 8x 0x
Ext
Pwr
-48V
0x
8x
7x
15x
GE
10/100/
1000
Base-Tx
3
116842
Cisco 3825
EN
NMD-
ESW-
36
23x 5x
FastEthernet Ports
22x 4x 21x 3x 20x 2x 19x 1x 18x 0x29x 11x 28x 10x 27x 9x 26x 8x 25x 17 24x 6x35x 17x 34x 16x 33x 15x 32x 14x 31x 13x 30x 12x
Ext
Pwr
-48V
0x
18x
GE0
10/100/
1000
Base-Tx
35x
10/100/1000
Base-Tx
GE1
17x
1
10

4
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Figure 3 Cisco 3825 Front Panel Physical Interfaces
The Cisco 3825 router features a console port, auxiliary port, dual Universal Serial Bus (USB) ports,
four high-speed WAN interface card (HWIC) slots, two 10/100/1000 Gigabit Ethernet RJ45 ports, two
Enhanced Network Module (ENM) slots, small form factor pluggable (SFP), redundant power supply
(RPS) inlet, power inlet, and Compact Flash (CF) drive. The Cisco 3825 router supports two internal
advanced integration modules (AIMs)1, and two Ethernet connections. Figure 2 shows the rear panel and
Figure 3 shows the front panel. The front panel consists of 12 LEDs: CF LED, SYS LED, ACT LED,
SYS PWR LED, RPS LED, AUX PWR LED, AIM0 LED, AIM1 LED, PVDM0 LED, PVDM1 LED,
PVDM2 LED, and PVDM3 LED. The back panel contains LEDs to indicate the status of the GE ports.
The front panel contains the following:
•LEDs
•Power switch
•Power input
•CF drive
•USB ports
The rear panel contains the following:
•HWIC/WIC/VIC slots 0 and 1
•Console port
•Auxiliary port
•GE ports
•ENM Ports
•SFP Port
Table 1 and Table 2 provide more detailed information conveyed by the LEDs on the front and rear panel
of the router:
116841
100-240 V~ 3A
50/60 Hz
1
0SYS ACT
SYS
PWR RPS
AUX
PWR AIM0 AIM1 PVDM0 PVDM1 PVDM2 PVDM 3
43 51 6
CF
COMPACT FLASH
DO NOT REMOVE DURING NETWORK OPERATION
2
1. However, an AIM module may not be installed in accordance with this security policy. There is a separate
security policy covering the Cisco 3825 and Cisco 3845 routers with AIM module installed.

5
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Table 1 Cisco 3825 Front Panel Indicators
Name State Description
System Solid Green
Blinking Green
Amber
Off
Normal System Operation.
Booting or in ROM monitor (ROMMON) mode.
Powered, but malfunctioning.
Router is not receiving power.
System Power Green
Amber
Off
Power supply present and enabled.
Power supply present and off or with failure.
Power supply not present.
Auxiliary Power Green
Amber
Off
Indicates IP phone power supply present.
Indicates IP phone power supply present.
IP phone power supply not present.
Redundant
Power Supply
Green
Off
System running on RPS PSU.
System running on primary PSU.
Activity Green
Off
Solid or blinking indicates packet activity.
No interrupts or packet transfer occurring.
Compact Flash Solid Green
Blinking Green
Off
Compact Flash present and enabled.
Compact Flash accessed.
Compact Flash not present.
PVDM3 Green
Amber
Off
PVDM3 installed and initialized.
PVDM3 installed and initialized error.
PVDM3 not installed.
PVDM2 Green
Amber
Off
PVDM2 installed and initialized.
PVDM2 installed and initialized error.
PVDM2 not installed.
PVDM1 Green
Amber
Off
PVDM1 installed and initialized.
PVDM1 installed and initialized error.
PVDM1 not installed.
PVDM0 Green
Amber
Off
PVDM0 installed and initialized.
PVDM0 installed and initialized error.
PVDM0 not installed.
AIM1 Green
Amber
Off
AIM1 present and enabled.
AIM1 present with failure.
AIM1 not installed.
AIM0 Green
Amber
Off
AIM0 present and enabled.
AIM0 present with failure.
AIM0 not installed.

6
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Table 3 describes the meaning of Ethernet LEDs on the rear panel:
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in Table 4:
Table 2 Cisco 3825 Rear Panel Indicators
Name State Description
Speed Green (Blinking) Blinking frequency indicates port speed.
Link Solid Green
Off
Ethernet link is established
No link established
Table 3 Cisco 3825 Ethernet Indicators
Name State Description
Duplex Solid Green
Off
Full-Duplex
Half-Duplex
Speed Solid Green
Off
100 Mbps
10 Mbps
Link Solid Green
Off
Ethernet link is established
No link established
Table 4 Cisco 3825 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Data Input Interface
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Data Output Interface

7
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
There are two USB ports but they are not supported currently. The ports will be supported in the future
for smartcard or token reader.
The CF card that stored the IOS image is considered an internal memory module, because the IOS image
stored in the card may not be modified or upgraded. The card itself must never be removed from the
drive. Tamper evident seal will be placed over the card in the drive.
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Control Input Interface
10/100/1000 Ethernet LAN LEDs
SFP LED
AIM LEDs
PVDM LEDs
Power LED
System Activity LED
System LED
Compact Flash LED
Auxiliary Power LED
RPS LED
Console Port
Auxiliary Port
Status Output Interface
Power Plug
Redundant Power Supply Plug
Power Interface
Table 4 Cisco 3825 FIPS 140-2 Logical Interfaces (Continued)

8
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
The Cisco 3845 Cryptographic Module Physical Characteristics
Figure 4 The Cisco 3845 Router Case
The Cisco 3845 router with on-board crypto enabled is a multiple-chip standalone cryptographic
module. The router has a processing speed of 650MHz. Depending on configuration, either the internal
Safenet chip or the IOS software is used for cryptographic operations.
The cryptographic boundary of the module is the device's case. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
The interfaces for the router are located on the front and rear panel as shown in Figure 5 and Figure 6,
respectively.
Figure 5 Cisco 3845 Front Panel Physical Interfaces
117045
116843
1
2 3 4

9
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Figure 6 Cisco 3845 Rear Panel Physical Interfaces
The Cisco 3845 router features a console port, auxiliary port, dual Universal Serial Bus (USB) ports,
four high-speed WAN interface card (HWIC) slots, two 10/100/1000 Gigabit Ethernet RJ45 ports, four
Enhanced Network Module (ENM) slots, small form factor pluggable (SFP), power inlets, and Compact
Flash (CF) drive. The Cisco 3845 router supports two internal advanced integration modules (AIMs)1,
and two Ethernet connections. Figure 5 shows the front panel and Figure 6 shows the rear panel. The
front panel consists of 7 LEDs: CF LED, PVDM0 LED, PVDM1 LED, PVDM2 LED, PVDM3 LED,
AIM0 LED, and AIM1 LED. The back panel consists of 6 LEDs: SYS LED, ACT LED, SYS PWR1
LED, AUX PWR1 LED, SYS PWR2 LED, and AUX PWR2 LED.
The front panel contains the following:
•LEDs
•Power switch
•Power input
The rear panel contains the following:
•CF drive
•USB ports
•Console and Auxiliary ports
•HWIC ports
•LEDs
•HWIC ports
•GE ports
•SFP port
•ENM slots
Table 5 provides more detailed information conveyed by the LEDs on the front of the router:
116844
CONSOLE
HWIC 3
CF
AIM 1
PVDM 3 AIM 0
SFP
GE 0/0
GE 0/1
PVDM 0PVDM 1
PVDM 2
SPD
SPD
LNK
LNK
HWIC 2 HWIC 1 HWIC 0
Do Not Remove During Network Operation
AUX
CISCO3845
1
0
4
2
1
3
8 9
14
13121110
1 2 3 4 5 7
6
1. However, an AIM module may not be installed in accordance with this security policy. There is a separate
security policy covering the Cisco 3825 and Cisco 3845 routers with AIM module installed.

10
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Table 5 Cisco 3845 Front Panel Indicators
Name State Description
System Solid Green
Blinking Green
Amber
Off
Normal System Operation.
Booting or in ROM monitor (ROMMON) mode.
Powered, but malfunctioning.
Router is not receiving power.
System Power1 Green
Amber
Off
Power1 supply present and enabled.
Power1 supply present and off or with failure.
Power1 supply not present.
Auxiliary
Power1
Green
Amber
Off
Indicates IP phone power1 supply present.
Indicates IP phone power1 supply present.
IP phone power1 supply not present.
System Power2 Green
Amber
Off
Power2 supply present and enabled.
Power2 supply present and off or with failure.
Power2 supply not present.
Auxiliary
Power2
Green
Amber
Off
Indicates IP phone power2 supply present.
Indicates IP phone power2 supply present.
IP phone power2 supply not present.
Activity Green
Off
Solid or blinking indicates packet activity.
No interrupts or packet transfer occurring.
Compact Flash Solid Green
Blinking Green
Off
Compact Flash present and enabled.
Compact Flash accessed.
Compact Flash not present.
PVDM3 Green
Amber
Off
PVDM3 installed and initialized.
PVDM3 installed and initialized error.
PVDM3 not installed.
PVDM2 Green
Amber
Off
PVDM2 installed and initialized.
PVDM2 installed and initialized error.
PVDM2 not installed.
PVDM1 Green
Amber
Off
PVDM1 installed and initialized.
PVDM1 installed and initialized error.
PVDM1 not installed.
PVDM0 Green
Amber
Off
PVDM0 installed and initialized.
PVDM0 installed and initialized error.
PVDM0 not installed.