Cisco ISR 4000 series User manual

Cisco Integrated Services Routers (ISR) 4000 Family
CC Configuration Guide
Version 0.2
May 22, 2017

Cisco ISR 4000 Family Routers Administrator Guidance
Page 2of 66
Table of Contents
1. Introduction 7
1.1 Audience 7
1.2 Purpose 7
1.3 Document References 7
1.4 Supported Hardware and Software 9
1.5 Operational Environment 9
1.5.1 Supported non-TOE Hardware/ Software/ Firmware 9
1.6 Excluded Functionality 10
2. Secure Acceptance of the TOE 11
3. Secure Installation and Configuration 14
3.1 Physical Installation 14
3.2 Initial Setup via Direct Console Connection 14
3.2.1 Options to be chosen during the initial setup of the ISR 4000 Family Routers 14
3.2.2 Saving Configuration 15
3.2.3 Enabling FIPS Mode 15
3.2.4 Administrator Configuration and Credentials 15
3.2.5 Session Termination 16
3.2.6 User Lockout 16
3.3 Network Protocols and Cryptographic Settings 17
3.3.1 Remote Administration Protocols 17
3.3.2 Authentication Server Protocols 19
3.3.3 Logging Configuration 19
3.3.4 Usage of Embedded Event Manager 20
3.3.5 Logging Protection 21
3.3.6 Base Firewall Rule set Configuration 23
3.3.7 Routing Protocols 25
3.3.8 MACSEC and MKA Configuration 25
4. Secure Management 26
4.1 User Roles 26
4.2 Passwords 26
4.3 Clock Management 29

Cisco ISR 4000 Family Routers Administrator Guidance
Page 3of 66
4.4 Identification and Authentication 29
4.5 Login Banners 29
4.6 Virtual Private Networks (VPN) 29
4.6.1 IPsec Overview 29
4.6.2 IPsec Transforms and Lifetimes 34
4.6.3 NAT Traversal 35
4.6.4 X.509 Certificates 35
4.6.5 Information Flow Policies 40
4.7 Product Updates 40
Configure Reference Identifier 40
5. Security Relevant Events 43
5.1 Deleting Audit Records 57
6. Network Services and Protocols 59
7. Modes of Operation 62
8. Security Measures for the Operational Environment 64
9. Obtaining Documentation and Submitting a Service Request 65
9.1 Documentation Feedback 65
9.2 Obtaining Technical Assistance 65

Cisco ISR 4000 Family Routers Administrator Guidance
Page 4of 66
List of Tables
Table 1 Acronyms.......................................................................................................................... 5
Table 2 Cisco Documentation........................................................................................................ 7
Table 3 IT Environment Components............................................................................................ 9
Table 4 Excluded Functionality................................................................................................... 10
Table 5 TOE External Identification............................................................................................ 11
Table 6 Evaluated Software Images ............................................................................................ 13
Table 7 General Auditable Events............................................................................................... 44
Table 8 Auditable Administrative Events.................................................................................... 53
Table 9 Protocols and Services.................................................................................................... 59
Table 10 Operational Environment Security Measures............................................................... 64

Cisco ISR 4000 Family Routers Administrator Guidance
Page 5of 66
List of Acronyms
The following acronyms and abbreviations are used in this document:
Table 1 Acronyms
Acronyms /
Abbreviations
Definition
AAA
Administration, Authorization, and Accounting
AES
Advanced Encryption Standard
FIPS
Federal Information Processing Standards
EAL
Evaluation Assurance Level
HTTPS
Hyper-Text Transport Protocol Secure
IP
Internet Protocol
NTP
Network Time Protocol
RADIUS
Remote Authentication Dial In User Service
SFP
Security Function Policy
SSHv2
Secure Shell (version 2)
TCP
Transport Control Protocol
TOE
Target of Evaluation

Cisco ISR 4000 Family Routers Administrator Guidance
Page 6of 66
DOCUMENT INTRODUCTION
Prepared By:
Cisco Systems, Inc.
170 West Tasman Dr.
San Jose, CA 95134
DOCUMENT INTRODUCTION
This document provides supporting evidence for an evaluation of a specific Target of Evaluation
(TOE), the Cisco Integrated Services Routers (ISR) 4000 (4321, 4331 and 4351) Family. This
Operational User Guidance with Preparative Procedures addresses the administration of the TOE
software and hardware and describes how to install, configure, and maintain the TOE in the
Common Criteria evaluated configuration. Administrators of the TOE will be referred to as
administrators, authorized administrators, TOE administrators, semi-privileged administrators,
and privileged administrators in this document.

Cisco ISR 4000 Family Routers Administrator Guidance
Page 7of 66
1. Introduction
This Operational User Guidance with Preparative Procedures documents the administration of the
Cisco Integrated Services Routers (ISR) 4000 Family (4321, 4331 and 4351), the TOE, as it was
certified under Common Criteria. The Cisco Integrated Services Routers (ISR) 4000 Family may
be referenced below as the ISR 4000 Family Router, TOE, or simply router.
1.1 Audience
This document is written for administrators configuring the TOE. This document assumes that you
are familiar with the basic concepts and terminologies used in internetworking, and understand
your network topology and the protocols that the devices in your network can use, that you are a
trusted individual, and that you are trained to use the operating systems on which you are running
your network.
1.2 Purpose
This document is the Operational User Guidance with Preparative Procedures for the Common
Criteria evaluation. It was written to highlight the specific TOE configuration and administrator
functions and interfaces that are necessary to configure and maintain the TOE in the evaluated
configuration. This document is not meant to detail specific actions performed by the
administrator but rather is a road map for identifying the appropriate locations within Cisco
documentation to get the specific details for configuring and maintaining ISR 4000 operations.
All security relevant commands to manage the TSF data are provided within this documentation
within each functional section.
1.3 Document References
This document makes reference to several Cisco Systems documents. The documents used are
shown below in Table 2. Throughout this document, the guides will be referred to by the “#”, such
as [1].
Table 2 Cisco Documentation
#
Title
Link
[1]
Loading and Managing
System Images
Configuration Guide
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sys-image-
mgmt/configuration/xe-16/sysimgmgmt-xe-16-book.html
[2]
Hardware Installation Guide
for the Cisco 4000 Series
Integrated Services Router
http://www.cisco.com/c/en/us/td/docs/routers/access/440
0/hardware/installation/guide4400-4300/C4400_isr.html
[3]
Configuration Fundamentals
Configuration Guide
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/fundamentals/configuration/xe-16/fundamentals-xe-
16-book.html

Cisco ISR 4000 Family Routers Administrator Guidance
Page 8of 66
#
Title
Link
[4]
Basic System Management
Configuration Guide
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/bsm/configuration/xe-16/bsm-xe-16-book.html
[5]
RADIUS Configuration
Guide
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/sec_usr_rad/configuration/xe-16/sec-usr-rad-xe-16-
book.html
[6]
Using Setup Mode to
Configure a Cisco
Networking Device
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/fundamentals/configuration/15-s/fundamentals-15-s-
book.html
[8]
Cisco IOS Security
Command Reference
http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-
a1-cr-book.html
http://www.cisco.com/en/US/docs/ios-xml/ios/security/d1/sec-
d1-cr-book.html
http://www.cisco.com/en/US/docs/ios-xml/ios/security/m1/sec-
m1-cr-book.html
http://www.cisco.com/en/US/docs/ios-xml/ios/security/s1/sec-
s1-cr-book.html
[9]
Public Key Infrastructure
Configuration Guide
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/sec_conn_pki/configuration/xe-16/sec-pki-xe-16-
book.html
[11]
IPsec Data Plane
Configuration Guide
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/sec_conn_dplane/configuration/xe-16/sec-ipsec-data-
plane-xe-16-book.html
[12]
FlexVPN and Internet Key
Exchange Version 2
Configuration Guide
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/sec_conn_ike2vpn/configuration/xe-16/sec-flex-vpn-
xe-16-book.html
[13]
Cisco IOS Configuration
Fundamentals Command
Reference
http://www.cisco.com/en/US/docs/ios-
xml/ios/fundamentals/command/Cisco_IOS_Configuration_Fu
ndamentals_Command_Reference.html
[14]
Release Notes for the Cisco
4000 Series ISRs
http://www.cisco.com/c/en/us/td/docs/routers/access/4400/rele
ase/xe-16-rn/isr4k-rel-notes-xe-16_3.html
[15]
Cisco 4000 Series ISRs
Software Configuration
Guide
http://www.cisco.com/c/en/us/td/docs/routers/access/4400/soft
ware/configuration/guide/isr4400swcfg.pdf

Cisco ISR 4000 Family Routers Administrator Guidance
Page 9of 66
#
Title
Link
[16]
Removed
Removed
[17]
MACSEC and MKA
Configuration Guide
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/macsec/configuration/xe-16/macsec-xe-16-book.html
[18]
IP Addressing: NAT
Configuration Guide
http://www.cisco.com/c/en/us/td/docs/ios-
xml/ios/ipaddr_nat/configuration/xe-16/nat-xe-16-book.html
1.4 Supported Hardware and Software
Only the hardware and software listed in section 1.5 of the Security Target (ST) is compliant with
the Common Criteria evaluation. Using hardware not specified in the ST invalidates the secure
configuration. Likewise, using any software version other than the evaluated software listed in the
ST will invalidate the secure configuration. The TOE is a hardware and software solution that
makes up the Cisco Integrated Services Routers (ISR) 4000 Family (4321, 4331 and 4351) model.
The network, on which they reside, is considered part of the environment. The software is pre-
installed and is comprised of the Cisco IOS-XE software image Release 16.3.2. In addition, the
software image is also downloadable from the Cisco web site.
1.5 Operational Environment
1.5.1 Supported non-TOE Hardware/ Software/ Firmware
The TOE supports (in some cases optionally) the following hardware, software, and firmware in
its environment:
Table 3 IT Environment Components
Component
Required
Usage/Purpose Description for TOE performance
RADIUS
AAA Server
No
This includes any IT environment RADIUS AAA server that provides single-
use authentication mechanisms. This can be any RADIUS AAA server that
provides single-use authentication. The TOE correctly leverages the services
provided by this RADIUS AAA server to provide single-use authentication
to administrators.
Management
Workstation
with SSH
Client
Yes
This includes any IT Environment Management workstation with a SSH
client installed that is used by the TOE administrator to support TOE
administration through SSH protected channels. Any SSH client that
supports SSHv2 may be used.
Local
Console
No
This includes any IT Environment Console that is directly connected to the
TOE via the Serial Console Port and is used by the TOE administrator to
support TOE administration.

Cisco ISR 4000 Family Routers Administrator Guidance
Page 10 of 66
Component
Required
Usage/Purpose Description for TOE performance
Certification
Authority
No
This includes any IT Environment Certification Authority on the TOE
network. This can be used to provide the TOE with a valid certificate during
certificate enrolment.
Remote VPN
Endpoint
Yes
This includes any VPN peer or client with which the TOE participates in
VPN communications. Remote VPN Endpoints may be any device or
software client that supports IPsec VPN communications. Both VPN clients
and VPN gateways are considered to be Remote VPN Endpoints by the TOE.
NTP Server
No
The TOE supports communications with an NTP server in order to
synchronize the date and time on the TOE with the NTP server’s date and
time. A solution must be used that supports secure communications with up
to a 32 character key.
Syslog Server
Yes
This includes any syslog server to which the TOE would transmit syslog
messages.
1.6 Excluded Functionality
The following functionality is excluded from the evaluation.
Table 4 Excluded Functionality
Excluded Functionality
Exclusion Rationale
Non-FIPS 140-2 mode of operation
This mode of operation includes non-FIPS allowed
operations.
Telnet for management purposes.
Telnet passes authentication credentials in clear text.
SSHv2 is to be used instead.
These services will be disabled by configuration. The exclusion of this functionality does not
affect compliance to the U.S. Government Protection Profile for Security Requirements for
Network Devices.