Cisco 3825 Series Service manual

Corporate Headquarters:
© 2005 Cisco Systems, Inc. All rights reserved.
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Cisco 3825 and Cisco 3845 Integrated Services
Routers FIPS 140-2 Non Proprietary Security
Policy
Level 2 Validation
Version 1.1
November 1, 2005
Introduction
This document is the non-proprietary Cryptographic Module Security Policy for the Cisco 3825 and
Cisco 3845 Integrated Services Routers without an AIM card installed. This security policy describes
how the Cisco 3825 and Cisco 3845 Integrated Services Routers (Hardware Version: Cisco 3825 or
Cisco 3845; Firmware Version: IOS 12.3(11)T03) meet the security requirements of FIPS 140-2, and
how to operate the router with on-board crypto enabled in a secure FIPS 140-2 mode. This policy was
prepared as part of the Level 2 FIPS 140-2 validation of the Cisco 3825 and Cisco 3845 Integrated
Services Routers.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2—Security Requirements for
Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the NIST website at
http://csrc.nist.gov/cryptval/.
This document contains the following sections:
•Introduction, page 1
•Cisco 3825 and Cisco 3845 Routers, page 2
•Secure Operation of the Cisco 3825 or Cisco 3845 router, page 23
•Related Documentation, page 24
•Obtaining Documentation, page 25
•Documentation Feedback, page 26
•Cisco Product Security Overview, page 26
•Obtaining Technical Assistance, page 27

2
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
•Obtaining Additional Publications and Information, page 28
References
This document deals only with operations and capabilities of the Cisco 3825 and Cisco 3845 routers in
the technical terms of a FIPS 140-2 cryptographic module security policy. More information is available
on the routers from the following sources:
•The Cisco Systems website contains information on the full line of Cisco Systems routers. Please
refer to the following website:
http://www.cisco.com/en/US/products/hw/routers/index.html
•For answers to technical or sales related questions please refer to the contacts listed on the Cisco
Systems website at www.cisco.com.
•The NIST Validated Modules website (http://csrc.nist.gov/cryptval) contains contact information
for answers to technical or sales-related questions for the module.
Terminology
In this document, the Cisco 3825 or Cisco 3845 routers are referred to as the router, the module, or the
system.
Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
•Vendor Evidence document
•Finite State Machine
•Other supporting documentation as additional references
This document provides an overview of the routers and explains their secure configuration and
operation. This introduction section is followed by the “Cisco 3825 and Cisco 3845 Routers” section on
page 2, which details the general features and functionality of the router. The “Secure Operation of the
Cisco 3825 or Cisco 3845 router” section on page 23 specifically addresses the required configuration
for the FIPS-mode of operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation Submission
Documentation is Cisco-proprietary and is releasable only under appropriate non-disclosure agreements.
For access to these documents, please contact Cisco Systems.
Cisco 3825 and Cisco 3845 Routers
Branch office networking requirements are dramatically evolving, driven by web and e-commerce
applications to enhance productivity and merging the voice and data infrastructure to reduce costs. The
Cisco 3825 and Cisco 3845 routers provide a scalable, secure, manageable remote access server that
meets FIPS 140-2 Level 2 requirements. This section describes the general features and functionality
provided by the routers. The following subsections describe the physical characteristics of the routers.

3
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
The Cisco 3825 Cryptographic Module Physical Characteristics
Figure 1 The Cisco 3825 Router Case
The Cisco 3825 Router is a multiple-chip standalone cryptographic module. The router has a processing
speed of 500MHz. Depending on configuration, either the internal Safenet chip or the IOS software is
used for cryptographic operations.
The cryptographic boundary of the module is the device's case. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
The interface for the router is located on the rear and front panels as shown in Figure 2 and Figure 3,
respectively.
Figure 2 Cisco 3825 Rear Panel Physical Interfaces
117040
0
1
COMPACT FLASH
SYSAUXACTRPSIPPWRAIM0AIM1PVDM0PVDM1PVDM2PVDM3
R
AUX
CONSOLE
AUX
GE 0/1
SPD LNK
SPD LNK
GE 0/0
H
W
I
C
2
H
W
I
C
0
1
2
H
W
I
C
3
H
W
I
C
1SFP
2
987654
EN
NM-
ESW-
16
15x 7x 14x 6x 13x 5x
FastEthernet Ports
12x 4x 11x 3x 10x 2x 9x 1x 8x 0x
Ext
Pwr
-48V
0x
8x
7x
15x
GE
10/100/
1000
Base-Tx
3
116842
Cisco 3825
EN
NMD-
ESW-
36
23x 5x
FastEthernet Ports
22x 4x 21x 3x 20x 2x 19x 1x 18x 0x29x 11x 28x 10x 27x 9x 26x 8x 25x 17 24x 6x35x 17x 34x 16x 33x 15x 32x 14x 31x 13x 30x 12x
Ext
Pwr
-48V
0x
18x
GE0
10/100/
1000
Base-Tx
35x
10/100/1000
Base-Tx
GE1
17x
1
10

4
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Figure 3 Cisco 3825 Front Panel Physical Interfaces
The Cisco 3825 router features a console port, auxiliary port, dual Universal Serial Bus (USB) ports,
four high-speed WAN interface card (HWIC) slots, two 10/100/1000 Gigabit Ethernet RJ45 ports, two
Enhanced Network Module (ENM) slots, small form factor pluggable (SFP), redundant power supply
(RPS) inlet, power inlet, and Compact Flash (CF) drive. The Cisco 3825 router supports two internal
advanced integration modules (AIMs)1, and two Ethernet connections. Figure 2 shows the rear panel and
Figure 3 shows the front panel. The front panel consists of 12 LEDs: CF LED, SYS LED, ACT LED,
SYS PWR LED, RPS LED, AUX PWR LED, AIM0 LED, AIM1 LED, PVDM0 LED, PVDM1 LED,
PVDM2 LED, and PVDM3 LED. The back panel contains LEDs to indicate the status of the GE ports.
The front panel contains the following:
•LEDs
•Power switch
•Power input
•CF drive
•USB ports
The rear panel contains the following:
•HWIC/WIC/VIC slots 0 and 1
•Console port
•Auxiliary port
•GE ports
•ENM Ports
•SFP Port
Table 1 and Table 2 provide more detailed information conveyed by the LEDs on the front and rear panel
of the router:
116841
100-240 V~ 3A
50/60 Hz
1
0SYS ACT
SYS
PWR RPS
AUX
PWR AIM0 AIM1 PVDM0 PVDM1 PVDM2 PVDM 3
43 51 6
CF
COMPACT FLASH
DO NOT REMOVE DURING NETWORK OPERATION
2
1. However, an AIM module may not be installed in accordance with this security policy. There is a separate
security policy covering the Cisco 3825 and Cisco 3845 routers with AIM module installed.

5
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Table 1 Cisco 3825 Front Panel Indicators
Name State Description
System Solid Green
Blinking Green
Amber
Off
Normal System Operation.
Booting or in ROM monitor (ROMMON) mode.
Powered, but malfunctioning.
Router is not receiving power.
System Power Green
Amber
Off
Power supply present and enabled.
Power supply present and off or with failure.
Power supply not present.
Auxiliary Power Green
Amber
Off
Indicates IP phone power supply present.
Indicates IP phone power supply present.
IP phone power supply not present.
Redundant
Power Supply
Green
Off
System running on RPS PSU.
System running on primary PSU.
Activity Green
Off
Solid or blinking indicates packet activity.
No interrupts or packet transfer occurring.
Compact Flash Solid Green
Blinking Green
Off
Compact Flash present and enabled.
Compact Flash accessed.
Compact Flash not present.
PVDM3 Green
Amber
Off
PVDM3 installed and initialized.
PVDM3 installed and initialized error.
PVDM3 not installed.
PVDM2 Green
Amber
Off
PVDM2 installed and initialized.
PVDM2 installed and initialized error.
PVDM2 not installed.
PVDM1 Green
Amber
Off
PVDM1 installed and initialized.
PVDM1 installed and initialized error.
PVDM1 not installed.
PVDM0 Green
Amber
Off
PVDM0 installed and initialized.
PVDM0 installed and initialized error.
PVDM0 not installed.
AIM1 Green
Amber
Off
AIM1 present and enabled.
AIM1 present with failure.
AIM1 not installed.
AIM0 Green
Amber
Off
AIM0 present and enabled.
AIM0 present with failure.
AIM0 not installed.

6
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Table 3 describes the meaning of Ethernet LEDs on the rear panel:
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in Table 4:
Table 2 Cisco 3825 Rear Panel Indicators
Name State Description
Speed Green (Blinking) Blinking frequency indicates port speed.
Link Solid Green
Off
Ethernet link is established
No link established
Table 3 Cisco 3825 Ethernet Indicators
Name State Description
Duplex Solid Green
Off
Full-Duplex
Half-Duplex
Speed Solid Green
Off
100 Mbps
10 Mbps
Link Solid Green
Off
Ethernet link is established
No link established
Table 4 Cisco 3825 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Data Input Interface
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Data Output Interface

7
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
There are two USB ports but they are not supported currently. The ports will be supported in the future
for smartcard or token reader.
The CF card that stored the IOS image is considered an internal memory module, because the IOS image
stored in the card may not be modified or upgraded. The card itself must never be removed from the
drive. Tamper evident seal will be placed over the card in the drive.
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Control Input Interface
10/100/1000 Ethernet LAN LEDs
SFP LED
AIM LEDs
PVDM LEDs
Power LED
System Activity LED
System LED
Compact Flash LED
Auxiliary Power LED
RPS LED
Console Port
Auxiliary Port
Status Output Interface
Power Plug
Redundant Power Supply Plug
Power Interface
Table 4 Cisco 3825 FIPS 140-2 Logical Interfaces (Continued)

8
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
The Cisco 3845 Cryptographic Module Physical Characteristics
Figure 4 The Cisco 3845 Router Case
The Cisco 3845 router with on-board crypto enabled is a multiple-chip standalone cryptographic
module. The router has a processing speed of 650MHz. Depending on configuration, either the internal
Safenet chip or the IOS software is used for cryptographic operations.
The cryptographic boundary of the module is the device's case. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
The interfaces for the router are located on the front and rear panel as shown in Figure 5 and Figure 6,
respectively.
Figure 5 Cisco 3845 Front Panel Physical Interfaces
117045
116843
1
2 3 4

9
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Figure 6 Cisco 3845 Rear Panel Physical Interfaces
The Cisco 3845 router features a console port, auxiliary port, dual Universal Serial Bus (USB) ports,
four high-speed WAN interface card (HWIC) slots, two 10/100/1000 Gigabit Ethernet RJ45 ports, four
Enhanced Network Module (ENM) slots, small form factor pluggable (SFP), power inlets, and Compact
Flash (CF) drive. The Cisco 3845 router supports two internal advanced integration modules (AIMs)1,
and two Ethernet connections. Figure 5 shows the front panel and Figure 6 shows the rear panel. The
front panel consists of 7 LEDs: CF LED, PVDM0 LED, PVDM1 LED, PVDM2 LED, PVDM3 LED,
AIM0 LED, and AIM1 LED. The back panel consists of 6 LEDs: SYS LED, ACT LED, SYS PWR1
LED, AUX PWR1 LED, SYS PWR2 LED, and AUX PWR2 LED.
The front panel contains the following:
•LEDs
•Power switch
•Power input
The rear panel contains the following:
•CF drive
•USB ports
•Console and Auxiliary ports
•HWIC ports
•LEDs
•HWIC ports
•GE ports
•SFP port
•ENM slots
Table 5 provides more detailed information conveyed by the LEDs on the front of the router:
116844
CONSOLE
HWIC 3
CF
AIM 1
PVDM 3 AIM 0
SFP
GE 0/0
GE 0/1
PVDM 0PVDM 1
PVDM 2
SPD
SPD
LNK
LNK
HWIC 2 HWIC 1 HWIC 0
Do Not Remove During Network Operation
AUX
CISCO3845
1
0
4
2
1
3
8 9
14
13121110
1 2 3 4 5 7
6
1. However, an AIM module may not be installed in accordance with this security policy. There is a separate
security policy covering the Cisco 3825 and Cisco 3845 routers with AIM module installed.

10
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Table 5 Cisco 3845 Front Panel Indicators
Name State Description
System Solid Green
Blinking Green
Amber
Off
Normal System Operation.
Booting or in ROM monitor (ROMMON) mode.
Powered, but malfunctioning.
Router is not receiving power.
System Power1 Green
Amber
Off
Power1 supply present and enabled.
Power1 supply present and off or with failure.
Power1 supply not present.
Auxiliary
Power1
Green
Amber
Off
Indicates IP phone power1 supply present.
Indicates IP phone power1 supply present.
IP phone power1 supply not present.
System Power2 Green
Amber
Off
Power2 supply present and enabled.
Power2 supply present and off or with failure.
Power2 supply not present.
Auxiliary
Power2
Green
Amber
Off
Indicates IP phone power2 supply present.
Indicates IP phone power2 supply present.
IP phone power2 supply not present.
Activity Green
Off
Solid or blinking indicates packet activity.
No interrupts or packet transfer occurring.
Compact Flash Solid Green
Blinking Green
Off
Compact Flash present and enabled.
Compact Flash accessed.
Compact Flash not present.
PVDM3 Green
Amber
Off
PVDM3 installed and initialized.
PVDM3 installed and initialized error.
PVDM3 not installed.
PVDM2 Green
Amber
Off
PVDM2 installed and initialized.
PVDM2 installed and initialized error.
PVDM2 not installed.
PVDM1 Green
Amber
Off
PVDM1 installed and initialized.
PVDM1 installed and initialized error.
PVDM1 not installed.
PVDM0 Green
Amber
Off
PVDM0 installed and initialized.
PVDM0 installed and initialized error.
PVDM0 not installed.

11
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Table 6 describes the meaning of Ethernet LEDs on the front panel:
The physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in Table 7:
AIM1 Green
Amber
Off
AIM1 present and enabled.
AIM1 present with failure.
AIM1 not installed.
AIM0 Green
Amber
Off
AIM0 present and enabled.
AIM0 present with failure.
AIM0 not installed.
Table 5 Cisco 3845 Front Panel Indicators (Continued)
Table 6 Cisco 3845 Ethernet Indicators
Name State Description
Speed One Blinking
Green
Two Blinking
Green
Three Blinking
Green
10 Mbps
100 Mbps
1000Mbps
Link Solid Green
Off
Ethernet link is established
No link established
SFP Solid Green
Off
SFP fiber link is established
No link established
Table 7 Cisco 3845 FIPS 140-2 Logical Interfaces
Router Physical Interface FIPS 140-2 Logical Interface
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Data Input Interface
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Data Output Interface

12
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
There are two USB ports but they are not supported currently. The ports will be supported in the future
for smartcard or token reader.
The CF card that stored the IOS image is considered an internal memory module. The reason is the IOS
image stored in the card cannot be modified or upgraded. The card itself must never be removed from
the drive. Tamper evident seal will be placed over the card in the drive.
Roles and Services
Authentication in Cisco 3825 and Cisco 3845 is role-based. There are two main roles in the router that
operators can assume: the Crypto Officer role and the User role. The administrator of the router assumes
the Crypto Officer role in order to configure and maintain the router using Crypto Officer services, while
the Users exercise only the basic User services. The module supports RADIUS and TACACS+ for
authentication. A complete description of all the management and configuration capabilities of the router
can be found in the Performing Basic System Management manual and in the online help for the router.
User Services
Users enter the system by accessing the console port with a terminal program or via IPSec protected
telnet or SSH session to a LAN port. The IOS prompts the User for username and password. If the
password is correct, the User is allowed entry to the IOS executive program.
10/100/1000 Ethernet LAN Ports
HWIC Ports
Console Port
Auxiliary Port
ENM Slots
SFP
Control Input Interface
10/100/1000 Ethernet LAN LEDs
SFP LED
AIM LEDs
PVDM LEDs
System Power LEDs
System Activity LED
System LED
Compact Flash LED
Auxiliary Power LEDs
Console Port
Auxiliary Port
Status Output Interface
Power Plug Power Interface
Table 7 Cisco 3845 FIPS 140-2 Logical Interfaces (Continued)

13
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
The services available to the User role consist of the following:
•Status Functions—View state of interfaces and protocols, version of IOS currently running.
•Network Functions—Connect to other network devices through outgoing telnet, PPP, etc. and
initiate diagnostic network services (i.e., ping, mtrace).
•Terminal Functions—Adjust the terminal session (e.g., lock the terminal, adjust flow control).
•Directory Services—Display directory of files kept in flash memory.
Crypto Officer Services
During initial configuration of the router, the Crypto Officer password (the “enable” password) is
defined. A Crypto Officer can assign permission to access the Crypto Officer role to additional accounts,
thereby creating additional Crypto Officers.
The Crypto Officer role is responsible for the configuration and maintenance of the router. The Crypto
Officer services consist of the following:
•Configure the router—Define network interfaces and settings, create command aliases, set the
protocols the router will support, enable interfaces and network services, set system date and time,
and load authentication information.
•Define Rules and Filters—Create packet Filters that are applied to User data streams on each
interface. Each Filter consists of a set of Rules, which define a set of packets to permit or deny based
characteristics such as protocol ID, addresses, ports, TCP connection establishment, or packet
direction.
•View Status Functions—View the router configuration, routing tables, active sessions, use gets to
view SNMP MIB statistics, health, temperature, memory status, voltage, packet statistics, review
accounting logs, and view physical interface status.
•Manage the router—Log off users, shutdown or reload the outer, manually back up router
configurations, view complete configurations, manager user rights, and restore router
configurations.
•Set Encryption/Bypass—Set up the configuration tables for IP tunneling. Set keys and algorithms
to be used for each IP range or allow plaintext packets to be set from specified IP address.
Physical Security
The router is entirely encased by a metal, opaque case. The rear of the unit contains auxiliary port,
console port, Gigabit Ethernet ports, HWIC ports, and ENM slots. The front of the unit contains USB
connectors, CF drive, power inlets, power switch, and LEDs. The top, side, and front portion of the
chassis can be removed to allow access to the motherboard, memory, AIM slots, and expansion slots.
Once the router has been configured in to meet FIPS 140-2 Level 2 requirements, the router cannot be
accessed without signs of tampering. To seal the system, apply serialized tamper-evidence labels as
follows:
To apply serialized tamper-evidence labels to the Cisco 3825:
Step 1 Clean the cover of any grease, dirt, or oil before applying the tamper evidence labels. Alcohol-based
cleaning pads are recommended for this purpose. The temperature of the router should be above 10 C.
Step 2 Tamper evidence label A shall be placed so that one half of the label covers the top of the front panel
and the other half covers the enclosure.

14
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Step 3 Tamper evidence label B shall be placed so that one half of the label covers the bottom of the front panel
and the CF card and the other half covers the enclosure.
Step 4 Tamper evidence labels C and D should be placed so that the one half of the label covers the enclosure
and the other half covers the left and right upper ENM slots.
Step 5 Tamper evidence label E should be placed so that the one half of the label covers the lower right ENM
slot and the other half covers the enclosure.
Step 6 Tamper evidence label F should be placed so that the one half of the label covers the left upper and lower
HWIC slots and the other half covers the enclosure.
Step 7 Tamper evidence label G should be placed so that the one half of the label covers the right upper and
lower HWIC slots and the other half covers the enclosure.
Step 8 Allow the labels five minutes to completely cure.
Figure 7 and Figure 8 show the tamper evidence label placements for the Cisco 3825.
Figure 7 Cisco 3825 Tamper Evident Label Placement (Front View)
Figure 8 Cisco 3825 Tamper Evident Label Placement (Back View)
To apply serialized tamper-evidence labels to the Cisco 3845:
Step 1 Clean the cover of any grease, dirt, or oil before applying the tamper evidence labels. Alcohol-based
cleaning pads are recommended for this purpose. The temperature of the router should be above 10 C.
Step 2 Tamper evidence labels A and B should be placed so that one half of the label covers the front panel and
the other half covers the enclosure.
Step 3 Tamper evidence label C should be placed so that one half of the label covers the left upper and lower
ENM modules and the other half covers the enclosure.
Step 4 Tamper evidence labels D and E should be placed so that one half of each label covers the side of right
ENM modules and the other half covers the enclosure.

15
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Step 5 Tamper evidence labels F, G, H and I should be placed so that one half of each label covers the top side
of HWIC modules and the other half covers the enclosure.
Step 6 Tamper evidence label J should be placed over the CF slot.
Step 7 Allow the labels five minutes to completely cure.
Figure 9 and Figure 10 show the tamper evidence label placements for the Cisco 3845.
Figure 9 Cisco 3845 Tamper Evident Label Placement (Front View)
Figure 10 Cisco 3845 Tamper Evident Label Placement (Back View)
The tamper evidence seals are produced from a special thin gauge vinyl with self-adhesive backing. Any
attempt to open the router will damage the tamper evidence seals or the material of the module cover.
Since the tamper evidence seals have non-repeated serial numbers, they can be inspected for damage and
compared against the applied serial numbers to verify that the module has not been tampered. Tamper
evidence seals can also be inspected for signs of tampering, which include the following: curled corners,
bubbling, crinkling, rips, tears, and slices. The word “OPEN” may appear if the label was peeled back.
Cryptographic Key Management
The router securely administers both cryptographic keys and other critical security parameters such as
passwords. The tamper evidence seals provide physical protection for all keys. All keys are also
protected by the password-protection on the Crypto Officer role login, and can be zeroized by the Crypto
Officer. All zeroization consists of overwriting the memory that stored the key. Keys are exchanged and
entered electronically or via Internet Key Exchange (IKE).

16
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
The routers support the following FIPS 140-2 approved algorithm implementations:
•Software (IOS) implementations
– AES
– DES (for legacy use only)
– 3DES
– SHA-1
– HMAC-SHA-1
– X9.31 PRNG
•Onboard hardware implementations (Safenet chip)
– AES
– DES (for legacy use only)
– 3DES
– SHA-1
– HMAC-SHA-1
The router is in the approved mode of operation only when FIPS 140-2 approved algorithms are used
(except DH which is allowed for use in FIPS approved mode for key establishment). The following are
not FIPS 140-2 approved algorithms: RC4, MD5, HMAC-MD5, RSA and DH. DH is allowed for use in
key establishment. The key establishment methodology provides between 80-bits and 96-bits of
encryption strength.
The module supports two types of key management schemes:
•Pre-shared key exchange via electronic key entry. DES/3DES/AES key and HMAC-SHA-1 key are
exchanged and entered electronically.
•Internet Key Exchange method with support for pre-shared keys exchanged and entered
electronically.
– The pre-shared keys are used with Diffie-Hellman key agreement technique to derive DES,
3DES or AES keys.
– The pre-shared key is also used to derive HMAC-SHA-1 key.
The module supports commercially available methods of key establishment, including Diffie-Hellman
and IKE. See Document 7A, Cisco IOS Reference Guide.
All pre-shared keys are associated with the CO role that created the keys, and the CO role is protected
by a password. Therefore, the CO password is associated with all the pre-shared keys. The Crypto
Officer needs to be authenticated to store keys. All Diffie-Hellman (DH) keys agreed upon for individual
tunnels are directly associated with that specific tunnel only via the IKE protocol.
Key Zeroization:
Each key can be zeroized by sending the “no” command prior to the key function commands. This will
zeroize each key from the DRAM, the running configuration.
“Clear Crypto IPSec SA” will zeroize the IPSec DES/3DES/AES session key (which is derived using
the Diffie-Hellman key agreement technique) from the DRAM. This session key is only available in the
DRAM; therefore this command will completely zeroize this key. The following command will zeroize
the pre-shared keys from the DRAM:
•no set session-key inbound ah spi hex-key-data

17
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
•no set session-key outbound ah spi hex-key-data
•no set session-key inbound esp spi cipher hex-key-data [authenticator hex-key-data]
•no set session-key outbound esp spi cipher hex-key-data [authenticator hex-key-data]
The DRAM running configuration must be copied to the start-up configuration in NVRAM in order to
completely zeroize the keys.
The following commands will zeroize the pre-shared keys from the DRAM:
•no crypto isakmp key key-string address peer-address
•no crypto isakmp key key-string hostname peer-hostname
The DRAM running configuration must be copied to the start-up configuration in NVRAM in order to
completely zeroize the keys.
The module supports the following keys and critical security parameters (CSPs). Note that keys stored
in NVRAM are in plaintext unless the configuration file encryption key is configured via the “key
config-key” command is used.
Table 8 Cryptographic Keys and CSPs
Name Algorithm Description Storage
Zeroization
Method
PRNG Seed X9.31 This is the seed for X9.31 PRNG. This CSP is
stored in DRAM and updated periodically after
the generation of 400 bytes – after this it is
reseeded with router-derived entropy; hence, it is
zeroized periodically. Also, the operator can turn
off the router to zeroize this CSP.
DRAM
(plaintext)
Automatically every
400 bytes, or turn off
the router.
Diffie Hellman
private
exponent
DH The private exponent used in Diffie-Hellman
(DH) exchange. Zeroized after DH shared secret
has been generated.
DRAM
(plaintext)
Automatically after
shared secret generated.
Diffie Hellman
public key
DH The public key used in Diffie-Hellman (DH)
exchange as part of IKE. Zeroized after the DH
shared secret has been generated.
DRAM
(plaintext)
Automatically after
shared secret generated.
skeyid Keyed
SHA-1
Value derived from the shared secret within IKE
exchange. Zeroized when IKE session is
terminated.
DRAM
(plaintext)
Automatically after IKE
session terminated.
skeyid_d Keyed
SHA-1
The IKE key derivation key for non ISAKMP
security associations.
DRAM
(plaintext)
Automatically after IKE
session terminated.
skeyid_a SHA-1
HMAC or
DES MAC
The ISAKMP security association authentication
key.
DRAM
(plaintext)
Automatically after IKE
session terminated.
skeyid_e DES/TDES
/AES
The ISAKMP security association encryption key. DRAM
(plaintext)
Automatically after IKE
session terminated.
IKE session
encrypt key
DES/TDES
/AES
The IKE session encrypt key. DRAM
(plaintext)
Automatically after IKE
session terminated.
IKE session
authentication
key
SHA-1
HMAC or
DES MAC
The IKE session authentication key. DRAM
(plaintext)
Automatically after IKE
session terminated.

18
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
ISAKMP
preshared
Secret The key used to generate IKE skeyid during
preshared-key authentication. “no crypto isakmp
key” command zeroizes it. This key can have two
forms based on whether the key is related to the
hostname or the IP address.
NVRAM
(plaintext or
encrypted)
“# no crypto isakmp
key”
IKE hash key SHA-1
HMAC
This key generates the IKE shared secret keys.
This key is zeroized after generating those keys.
DRAM
(plaintext)
secret_1_0_0 The fixed key used in Cisco vendor ID generation.
This key is embedded in the module binary image
and can be deleted by erasing the Flash.
NVRAM
(plaintext or
encrypted)
IPSec
encryption key
DES/TDES
/AES
The IPSec encryption key. Zeroized when IPSec
session is terminated.
DRAM
(plaintext)
Automatically when
IPSec session
terminated.
IPSec
authentication
key
SHA-1
HMAC or
DES MAC
The IPSec authentication key. The zeroization is
the same as above.
DRAM
(plaintext)
Automatically when
IPSec session
terminated.
Configuration
encryption key
AES The key used to encrypt values of the
configuration file. This key is zeroized when the
“no key config-key” is issued. Note that this
command does not decrypt the configuration file,
so zeroize with care.
NVRAM
(plaintext or
encrypted)
“# no key config-key”
Router
authentication
key 1
Shared
secret
This key is used by the router to authenticate itself
to the peer. The router itself gets the password
(that is used as this key) from the AAA server and
sends it onto the peer. The password retrieved
from the AAA server is zeroized upon completion
of the authentication attempt.
DRAM
(plaintext)
Automatically upon
completion of
authentication attempt.
PPP
authentication
key
RFC 1334 The authentication key used in PPP. This key is in
the DRAM and not zeroized at runtime. One can
turn off the router to zeroize this key because it is
stored in DRAM.
DRAM
(plaintext)
Turn off the router.
Router
authentication
key 2
Shared
Secret
This key is used by the router to authenticate itself
to the peer. The key is identical to Router
authentication key 1 except that it is retrieved
from the local database (on the router itself).
Issuing the “no username password” zeroizes the
password (that is used as this key) from the local
database.
NVRAM
(plaintext or
encrypted)
“# no username
password”
SSH session
key
Va r i o u s
symmetric
This is the SSH session key. It is zeroized when
the SSH session is terminated.
DRAM
(plaintext)
Automatically when
SSH session terminated
User password Shared
Secret
The password of the User role. This password is
zeroized by overwriting it with a new password.
NVRAM
(plaintext or
encrypted)
Overwrite with new
password
Enable
password
Shared
Secret
The plaintext password of the CO role. This
password is zeroized by overwriting it with a new
password.
NVRAM
(plaintext or
encrypted)
Overwrite with new
password
Table 8 Cryptographic Keys and CSPs (Continued)

19
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
Note All RSA operations are prohibited by policy, and commands that can be executed by Officer are shown
“# command”.
.
Enable secret Shared
Secret
The ciphertext password of the CO role. However,
the algorithm used to encrypt this password is not
FIPS approved. Therefore, this password is
considered plaintext for FIPS purposes. This
password is zeroized by overwriting it with a new
password.
NVRAM
(plaintext or
encrypted)
Overwrite with new
password
RADIUS secret Shared
Secret
The RADIUS shared secret. This shared secret is
zeroized by executing the “no radius-server key”
command.
NVRAM
(plaintext or
encrypted),
DRAM
(plaintext)
“# no radius-server key”
TACACS+
secret
Shared
Secret
The TACACS+ shared secret. This shared secret is
zeroized by executing the “no tacacs-server key”
command.
NVRAM
(plaintext or
encrypted),
DRAM
(plaintext)
“# no tacacs-server key”
Table 9 Role and Service Access to CSP
SRDI/Role/Service Access Policy
Role/Service User Role Status Functions Network Functions Terminal Functions Directory Services Crypto-Officer Role Configure the Router Define Rules and Filters Status Functions Manage the Router Set Encryptions/Bypass Change WAN Interface Cards
Security Relevant Data Item
PRNG Seed rdr
w
d
DH private exponent r r
w
d
DH public key r r
w
d
Table 8 Cryptographic Keys and CSPs (Continued)

20
Cisco 3825 and Cisco 3845 Integrated Services Routers FIPS 140-2 Non Proprietary Security Policy
OL-8662-01
Cisco 3825 and Cisco 3845 Routers
DH public key r r
w
d
skeyid r r
w
d
skeyid_d r r
w
d
skeyid_a r r
w
d
skeyid_e r r
w
d
IKE session encrypt key r r
w
d
IKE session authentication key r r
w
ISAKMP preshared r r
w
d
IKE hash key r r
w
d
secret_1_0_0 r r
w
d
IPSec encryption key r r
w
d
IPSec encryption key r r
w
d
Table 9 Role and Service Access to CSP (Continued)
SRDI/Role/Service Access Policy
Role/Service User Role Status Functions Network Functions Terminal Functions Directory Services Crypto-Officer Role Configure the Router Define Rules and Filters Status Functions Manage the Router Set Encryptions/Bypass Change WAN Interface Cards