Cisco 7609-S User manual

© Copyright 2007 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
1
Cisco 7606-S and 7609-S Routers with Supervisor SUP720-3B
FIPS 140-2 Non Proprietary Security Policy
Level 2 Validation
Version 0.5
May, 2011

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
2
Table of Contents
1 INTRODUCTION.................................................................................................................. 3
1.1PURPOSE............................................................................................................................. 3
1.2MODULE VALIDATION LEVEL ............................................................................................ 3
1.3REFERENCES....................................................................................................................... 3
1.4TERMINOLOGY ................................................................................................................... 4
1.5DOCUMENT ORGANIZATION ............................................................................................... 4
2CISCO 7606-S AND 7609-S ROUTERS WITH SUPERVISOR SUP720-3B .................. 5
2.1CRYPTOGRAPHIC MODULE PHYSICAL CHARACTERISTICS .................................................. 5
2.2MODULE INTERFACES......................................................................................................... 6
2.3ROLES AND SERVICES......................................................................................................... 8
2.3.1Authentication................................................................................................9
2.3.2Services.........................................................................................................9
a. User Services........................................................................................................9
b. Crypto Officer Services .......................................................................................10
2.3.3Unauthenticated Services............................................................................11
2.4PHYSICAL SECURITY ........................................................................................................ 11
2.4.1Module Opacity ...........................................................................................11
2.4.2Tamper Evidence........................................................................................13
2.5CRYPTOGRAPHIC ALGORITHMS........................................................................................ 17
2.5.1Approved Cryptographic Algorithms............................................................17
2.5.2Non-FIPS Approved Algorithms Allowed in FIPS Mode ..............................18
2.5.3Non-Approved Cryptographic Algorithms....................................................18
2.6CRYPTOGRAPHIC KEY MANAGEMENT.............................................................................. 18
2.7SELF-TESTS ...................................................................................................................... 20
2.7.1Self-tests performed by the IOS image .......................................................20
3SECURE OPERATION ...................................................................................................... 21
3.1SYSTEM INITIALIZATION AND CONFIGURATION................................................................ 21
3.2PROTOCOLS ...................................................................................................................... 22
3.3REMOTE ACCESS .............................................................................................................. 22

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
3
1 Introduction
1.1 Purpose
This document is the non-proprietary Cryptographic Module Security Policy for the Cisco 7606-
S and 7609-S Routers with Supervisor SUP720-3B. This security policy describes how the
Cisco 7606-S and 7609-S Routers with Supervisor SUP720-3B (Hardware Version: Chassis:
7606-S and 7609-S with SUP720-3B; Firmware Version: 15.1(2)S) meet the security
requirements of FIPS 140-2, and how to operate the router with on-board crypto enabled in a
secure FIPS 140-2 mode. This policy was prepared as part of the Level 2FIPS 140-2 validation
of the Cisco 7606-S and 7609-S Routers with Supervisor SUP720-3B.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2 — Security
Requirements for Cryptographic Modules) details the U.S. Government requirements for
cryptographic modules. More information about the FIPS 140-2 standard and validation program
is available on the NIST website at http://csrc.nist.gov/groups/STM/index.html.
1.2 Module Validation Level
The following table lists the level of validation for each area in the FIPS PUB 140-2.
No. Area Title Level
1 Cryptographic Module Specification 2
2 Cryptographic Module Ports and Interfaces 2
3 Roles, Services, and Authentication 3
4 Finite State Model 2
5 Physical Security 2
6 Operational Environment N/A
7 Cryptographic Key management 2
8 Electromagnetic Interface/Electromagnetic Compatibility 2
9 Self-Tests 2
10 Design Assurance 2
11 Mitigation of Other Attacks N/A
Overall module validation level 2
Table 1 Module Validation Level
1.3 References
This document deals only with operations and capabilities of the Cisco 7606-S and 7609-S
Routers with Supervisor SUP720-3B in the technical terms of a FIPS 140-2 cryptographic
module security policy. More information is available on the routers from the following sources:
The Cisco Systems website contains information on the full line of Cisco Systems routers. Please
refer to the following website:

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
4
http://www.cisco.com/en/US/prod/collateral/routers/ps368/ps371/product_data_sheet0900aecd80
57f3c8.html
For answers to technical or sales related questions please refer to the contacts listed on
the Cisco Systems website at www.cisco.com.
The NIST Validated Modules website
(http://csrc.nist.gov/groups/STM/cmvp/validation.html) contains contact information
for answers to technical or sales-related questions for the module.
1.4 Terminology
In this document, the Cisco 7606-S and 7609-S Routers with Supervisor SUP720-3B is referred
to as the router, the module, or the system.
1.5 Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
Vendor Evidence document
Finite State Machine
Other supporting documentation as additional references
This document provides an overview of the Cisco 7606-S and 7609-S Routers with Supervisor
SUP720-3B and explains the secure configuration and operation of the module. This introduction
section is followed by Section 2, which details the general features and functionality of the
router. Section 3 specifically addresses the required configuration for the FIPS-mode of
operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation
Submission Documentation is Cisco-proprietary and is releasable only under appropriate non-
disclosure agreements. For access to these documents, please contact Cisco Systems.

© Copyri
g
This docum
e
2Cis
c
The Cis
c
form fac
t
Label S
w
service
p
infrastru
c
applicati
o
WAN a
n
followin
g
2.1 Cr
y
g
ht 2011 Cis
c
e
nt may be freel
y
c
o 7606-S
c
o 7600-S R
o
t
or for depl
o
w
itching (M
P
p
roviders. It
e
c
ture that su
p
o
ns in both
t
n
d metropoli
t
g
subsectio
n
y
p
t
o
g
raphi
c
c
o Systems, I
n
y
reproduced an
and 7609
-
o
uter is a co
m
o
yment at th
e
P
LS) servic
e
e
nables Car
r
p
ports a ran
g
t
he residenti
t
an-area net
w
n
s describe t
h
c
Module P
h
n
c.
d distributed wh
o
-
S Router
m
pact, high
-
e
network e
d
e
s are neces
s
r
ier Etherne
t
g
e of IP vid
e
al and busi
n
w
ork (MA
N
h
e physical
c
hy
sical Cha
r
Figure 1 -
C
o
le and intact in
c
5
s with Su
p
-
performan
c
d
ge, where r
o
s
ary to meet
t
service pro
e
o and tripl
e
n
ess services
N
) networkin
g
c
haracteristi
c
r
acteristics
C
isco 7606-S
R
c
luding this Cop
y
p
ervisor
S
c
e router des
i
o
bust perfo
r
the require
m
viders to de
p
e
-play (voic
e
markets. T
h
g
solutions
a
c
s of the ro
u
R
outer
y
right Notice.
S
UP720-3
B
i
gned in a 6
-
r
mance and
I
m
ents of bot
h
p
loy an adv
a
e
, video, an
d
h
e Cisco 76
0
a
t the enterp
r
u
ters.
B
-
slot and 9-
s
I
P/Multipro
t
h
enterprise
s
a
nced netw
o
d
data) syste
m
0
0-S also de
l
r
ise edge. T
h
s
lot
t
ocol
s
and
o
rk
m
l
ivers
h
e

© Copyri
g
This docum
e
The cry
p
The cry
p
module.
All of th
e
cryptogr
a
2.2 M
o
The mo
d
1.
T
2.
O
3.
O
4. F
5.
T
6.
T
7.
T
These in
t
g
ht 2011 Cis
c
e
nt may be freel
y
p
tographic b
o
p
tographic b
o
e
functional
i
a
phic boun
d
o
dule Inter
fa
d
ule features
T
wo SFP Et
h
O
ne 10/100/
1
O
ne serial co
n
our Status
L
T
wo Disk L
E
T
hree Link
L
T
wo Compa
c
t
erfaces are
d
c
o Systems, I
n
y
reproduced an
o
undary is
d
o
undary is i
l
i
ty describe
d
d
ary. The m
o
fa
ces
the followi
n
h
ernet ports
1
000 Ethern
e
n
sole port
L
EDs
E
Ds
L
EDs
c
tFlash Typ
e
d
epicted in
t
n
c.
d distributed wh
o
Figure 2 -
C
d
efined as
b
e
l
lustrated in
d
in this pub
l
o
dule incorp
o
n
g interface
s
e
t port
e
II slots (
d
i
s
t
he figures
b
o
le and intact in
c
6
C
isco 7609-S
R
ing the phy
s
Figures 1 a
n
l
ication is p
r
o
rates one o
r
s
:
s
abled via T
E
b
elow:
c
luding this Cop
y
R
outer
s
ical enclos
u
n
d 2 above
a
r
ovided by
c
r
more supe
r
E
L)
y
right Notice.
u
re of the ch
a
a
s the dark b
o
c
omponents
w
r
visor blade
s
a
ssis.
o
rder aroun
d
w
ithin this
s
.
d
the

© Copyri
g
This docum
e
The foll
o
rear pan
e
g
ht 2011 Cis
c
e
nt may be freel
y
o
wing tables
e
l of the rou
t
Name
Status
System
Active
c
o Systems, I
n
y
reproduced an
provide m
o
t
er:
State
Green
Orange
Red
Green
Orange
Red
Green
Orange
n
c.
d distributed wh
o
Figure 3 - S
o
re detailed i
o
le and intact in
c
7
UP 720-3B in
t
nformation
c
Descriptio
n
All diagnosti
c
operational (
n
The supervis
o
diagnostics (
n
The diagnost
i
failed. The s
u
b
ecause a fau
l
sequence.
All chassis e
n
OK.
A minor hard
w
A major hard
w
The supervis
o
The supervis
o
c
luding this Cop
y
t
erfaces
c
onveyed b
y
n
c
s pass. The s
u
n
ormal initiali
z
o
r engine is bo
o
n
ormal initiali
z
i
c test (includi
n
u
pervisor engi
n
l
t occurred du
r
n
vironmental
m
w
are problem
w
are problem
h
o
r engine is op
e
o
r engine is in
s
y
right Notice.
y
the LEDs
o
u
pervisor engi
n
z
ation sequenc
e
o
ting or runni
n
z
ation sequenc
e
n
g FIPS POST
n
e is not opera
t
r
ing the initiali
m
onitors are re
p
has been dete
c
h
as occurre
d
e
rational and
a
s
tandby mode.
o
n the front
a
n
e is
e
).
n
g
e
)
s)
t
ional
zation
p
orting
c
ted.
a
ctive.
a
nd

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
8
PWR MGMT Orange Power-up mode; running self-diagnostics.
Green Power management is functioning normally and
sufficient power is available for all modules.
Orange A minor power management problem has been
detected. There is insufficient power for all
modules to power up.
Red A major power failure has occurred.
DISK 0 and
DISK 1 N/A These LEDs are illuminated green when the installed Flash PC card is being accessed and is
performing either a read operation or a write
operation.
Table 2 – LED Indicators
The module provides a number of physical and logical interfaces to the device, and the physical
interfaces provided by the module are mapped to the following FIPS 140-2 defined logical
interfaces: data input, data output, control input, status output, and power. The logical interfaces
and their mapping are described in the following table:
Router Physical Interface FIPS 140-2 Logical Interface
Gigabit/SFP Ethernet ports
Console Port Data Input Interface
Gigabit/SFP Ethernet ports
Console Port Data Output Interface
Gigabit/SFP Ethernet ports
Console Port Control Input Interface
Gigabit/SFP Ethernet ports
Console Port
LEDs
Status Output Interface
Power plug Power Interface
Table 3 – FIPS 140-2 Logical Interfaces
2.3 Roles and Services
Authentication in the module is identity-based. There are two main roles in the router that
operators can assume:
1. the Crypto Officer role and
2. the User role.
The administrators of the router assumes the Crypto Officer role in order to configure and
maintain the router using Crypto Officer services, while the Users exercise only the basic User
services. A detailed list of services attributed to each role can be found in section 2.3.2

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
9
2.3.1 Authentication
The module provides password based and digital signature based authentication. Crypto Officers
are always authenticated using passwords whereas a User can be authenticated either via a
password or digital signature.
a. Password based Authentication
The security policy stipulates that all user passwords and shared secrets must be 8 alphanumeric
characters, so the password space is 2.8 trillion possible passwords. The possibility of randomly
guessing a password is thus far less than one in one million. To exceed a one in 100,000
probability of a successful random password guess in one minute, an attacker would have to be
capable of 28 million password attempts per minute, which far exceeds the operational
capabilities of the module to support.
b. Digital signature based Authentication
When using RSA based authentication, RSA key pair has modulus size of 1024 bit to 2048 bit,
thus providing between 80 bits and 112 bits of strength. Assuming the low end of that range, an
attacker would have a 1 in 280 chance of randomly obtaining the key, which is much stronger
than the one in a million chance required by FIPS 140-2. To exceed a one in 100,000 probability
of a successful random key guess in one minute, an attacker would have to be capable of
approximately 1.8x1021 attempts per minute, which far exceeds the operational capabilities of the
modules to support.
2.3.2 Services
a. User Services
Users can access the system via the console port with a terminal program or SSH session to an
Ethernet port. The IOS prompts the User for username and password. If the password is correct,
the User is allowed entry to the IOS executive program. In addition to username/password
combination, RSA digital certificates can be used to authenticate the user over the SSH session.
The services available to the User role consist of the following:
Services &
Access Description Keys & CSPs
Status Functions
(r, x) View state of interfaces and protocols,
version of IOS currently running.
User password
Network Connect to other network devices DRBG seed, DRBG V, DH

© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
10
Functions (r, w,
x, z) through SSH, telnet, PPP, etc. and
initiate diagnostic network services
(i.e., ping, mtrace).
shared secret, DH private
exponent, SSH Private key, SSH
session key
Terminal
Functions Adjust the terminal session (e.g., lock
the terminal, adjust flow control). N/A
Directory
Services Display directory of files kept in flash
memory. N/A
Perform Self-
Tests Perform the FIPS 140 start-up tests on
demand N/A
Table 4 - User Services
b. Crypto Officer Services
During initial configuration of the router, the Crypto Officer password (the “enable” password) is
defined. A Crypto Officer can assign permission to access the Crypto Officer role to additional
accounts, thereby creating additional Crypto Officers.
The Crypto Officer role is responsible for the configuration and maintenance of the router. Just
like the User, the Crypto Officer can access the router via the console port or via SSH session.
The Crypto Officer services consist of the following:
Services & Access Description Keys & CSPs
Configure the router
(r, w, z) Define network interfaces and
settings, create command aliases, set
the protocols the router will support,
enable interfaces and network
services, set system date and time, and
load authentication information.
User password, Enable
password, RADIUS secret,
TACACS+ secret, DH shared
secret, Router Authentication
key, PPP authentication key,
SSH private key
Define Rules and
Filters Create packet Filters that are applied
to User data streams on each interface.
Each Filter consists of a set of Rules,
which define a set of packets to permit
or deny based on characteristics such
as protocol ID, addresses, ports, TCP
connection establishment, or packet
direction.
N/A
View Status
Functions (r, x) View the router configuration, routing
tables, active sessions, use gets to
view SNMP MIB statistics, health,
temperature, memory status, voltage,
packet statistics, review accounting
logs, and view physical interface
User password, Enable
password, RADIUS secret,
TACACS+ secret, DH shared
secret, Router Authentication
key, PPP authentication key,
SSH private key