Nortel 4500 FIPS User manual

© Copyright 2000 Nortel Networks.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
Contivity™ Extranet Switch 4500
FIPS 140-1 Non-Proprietary
Cryptographic Module Security Policy
Level 2 Validation
February 2000

© Copyright 2000 Nortel Networks. 2
Table of Contents
1Introduction..................................................................................................................3
1.1 Purpose................................................................................................................... 3
1.2 References............................................................................................................... 3
1.3 Terminology............................................................................................................. 3
1.4 Document Organization............................................................................................ 3
2The Contivity Extranet 4500 Switch...........................................................................5
2.1 Cryptographic Module............................................................................................. 5
2.2 Module Interfaces.................................................................................................... 5
2.3 Redundancy and Physical Security............................................................................ 7
2.4 Roles and Services................................................................................................. 10
2.4.1 Crypto Officer Services................................................................................. 11
2.4.2 User Services................................................................................................. 12
2.5 Key Management .................................................................................................. 13
2.6 Self Tests............................................................................................................... 13
3Secure Operation of the Contivity Switch................................................................13

© Copyright 2000 Nortel Networks. 3
1Introduction
1.1 Purpose
This is a non-proprietary Cryptographic Module Security Policy for the Contivity™ Extranet
Switch 4500. This security policy describes how the Contivity™ Extranet Switch 4500 meets
the security requirements of FIPS 140-1, and how to operate the Contivity™ Extranet Switch
4500 in a secure FIPS 140-1 mode. This policy was prepared as part of the level 2 FIPS 140-
1 certification of the Contivity™ Extranet Switch 4500.
FIPS 140-1 (Federal Information Processing Standards Publication 140-1 -- Security
Requirements for Cryptographic Modules) details the U.S. Government requirements for
cryptographic modules. More information about the FIPS 140-1 standard and validation
program is available on the NIST web site at http://csrc.nist.gov/cryptval/.
1.2 References
This document deals only with operations and capabilities of the Contivity™ Extranet Switch
4500 in the technical terms of a FIPS 140-1 cryptographic module security policy. More
information is available on the Contivity™ Extranet Switch 4500 and the entire line of
Contivity™ products from the following sources:
•The Nortel Networks web site contains information on the full line of Contivity
products at www.nortelnetworks.com.
•For answers to technical or sales related questions please refer to the contacts listed
on the Nortel Networks web site at www.nortelnetworks.com.
1.3 Terminology
In this document the Nortel Contivity™ Extranet Switch 4500 is referred to as the switch, the
Contivity™ Switch, module, or system.
1.4 Document Organization
The Security Policy document is part of the complete FIPS 140-1 Submission Package. In
addition to this document, the complete Submission Package contains:
♦Vendor Evidence document
♦Finite State Machine
♦Module Software Listing
♦Other supporting documentation as additional references

© Copyright 2000 Nortel Networks. 4
This document provides an overview of the Contivity™ Switch and explains the secure
configuration and operation of the module. This introduction section is followed by Section 2,
which details the general features and functionality of the Contivity™ Switch. Section 3
specifically addresses the required configuration for the FIPS-mode of operation.
This Security Policy and other Certification Submission Documentation was produced by
Corsec Security, Inc. under contract to Nortel Networks. With the exception of this Non-
Proprietary Security Policy, the FIPS 140-1 Certification Submission Documentation is Nortel-
proprietary and is releasable only under appropriate non-disclosure agreements. For access to
these documents, please contact Nortel Networks.

© Copyright 2000 Nortel Networks. 5
2The Contivity Extranet 4500 Switch
The Nortel Networks Contivity Extranet Switch 4500 provides a scalable, secure, manageable
remote access server that meets FIPS 140-1 level 2 requirements. This section will describe
the general features and functionality provided by the Contivity Extranet Switch. Section 3 will
provide further details on how the Contivity Switch addresses FIPS 140-1 requirements.
2.1 Cryptographic Module
The Contivity Extranet Switch combines remote access protocols, security, authentication,
authorization, and encryption technologies into a single solution.
Figure 1– The Contivity Extranet 4500 Switch
The Switch can support up to 5,000 simultaneous user sessions, allowing each user to exercise
a variety of secure connections and services. The Switch supports a number of secure
network-layer and data-link-layer protocols including Internet Protocol Security (IPSec), Point-
to-Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol (L2TP), and Layer Two
Forwarding (L2F). The architecture for the Switch is user-centric, where an individual user or
group of users can be associated with a set of attributes that provide custom access to the
Extranet. In effect, you can create a personal Extranet based on the special needs of a user or
group.
2.2 Module Interfaces
The interfaces for the Switch are located on the rear panel as shown in Figure 2.

© Copyright 2000 Nortel Networks. 6
.
Figure 2– Physical Interfaces
The physical interfaces include the dual power plugs for the redundant power supplies, the
power and reset buttons, the serial port, the LAN Port RJ-45 connector, and up to six slots
containing additional network connectors. The power and reset buttons light up to indicate
power and hard disk activity respectively. Each RJ-45 connector is accompanied with Light
Emitting Diodes (LEDs), including green and orange LEDs on the LAN Port, and Link/Activity
and 10/100Mbps LEDs on the 10/100BASE-TX LAN ports.
Figure 3shows details of the LAN Port LEDs, with the green LED indicating 100Mbps activity,
and the orange LED indicating link status and activity. More information on these LEDs and the
LAN Port interface can be found in the Contivity Extranet Switch 4500 Getting Started
Guide, 1C.
Figure 3– LAN Port LEDs
Figure 4shows details of the 10/100BASE-TX LAN Port LEDs, with the link status LED
indicating connection to a hub, the activity LED indicating traffic being sent, and the 100TX
LED indicating 100Mbps operation. More information on these LEDs and the /100BASE-TX
LAN Port interface can be found in the manual “Getting Started with the Contivity Extranet
Switch 4500”.

© Copyright 2000 Nortel Networks. 7
Figure 4– 10/100BASE-TX LAN LEDs
These physical interfaces are separated into the logical interfaces from FIPS as described in the
following table:
Switch physical interface FIPS 140-1 Logical Interface
10/100BASE-TX LAN Port,
LAN Port,
Serial Port
Data Input Interface
10/100BASE-TX LAN Port,
LAN Port,
Serial Port
Data Output Interface
Power Button,
Reset Button,
Serial Port,
LAN Port
Control Input Interface
LAN Port LEDs,
10/100BASE-TX LAN PortLEDs
Serial Port
Power Button Light
Reset Button Light
Status Output Interface
Dual Power Plugs Power Interface
Table 1– FIPS 140-1 Logical Interfaces
2.3 Redundancy and Physical Security
With up to 5,000 simultaneous users accessing critical information, network managers can rest
assured that the Contivity Extranet Switch is designed for high availability. Auto switching
redundant power supplies and a redundant storage system protect against failure. Multilevel
authentication methods and automatic backup of all system and accounting data ensure
maximum reliability and management peace of mind. The Switch meets FCC requirements in
47 CFR Part 15 for personal computers and peripherals designated for business use (ClassA),
and is labeled in accordance with FCC requirements.
The Contivity™ Extranet Switch 4500 is entirely encased by a thick steel chassis. The system
has three removable portions: the front bezel, the top cover, and the I/O Panel. Removing the

© Copyright 2000 Nortel Networks. 8
front bezel allows access to the dual power supplies, hard drives, and floppy drive. Removing
the top cover or the I/O panel allows access to the motherboard, memory, and expansion slots.
Figure 5– The Steel Cover of the Extranet Switch 4500
Once the Extranet Switch 4500 has been configured in its FIPS 140-1 level 2 conformant
mode, the system cannot be accessed without signs of tampering. To seal the system, apply
serialized tamper-evident labels as follows:
1. Clean the cover of any grease, dirt, or oil before applying the tamper-evident labels.
Alcohol based cleaning pads are recommended for this purpose. The temperature
of the switch should be above 10°C.
2. Apply two (2) labels on the sides overlapping the top cover and the main chassis as
shown in Figure 6.
3. Apply two (2) labels on the top and bottom overlapping the bezel and the main
chassis as shown in Figure 6.
4. Apply one (1) label over the air holes on the rear I/O Panel as shown in Figure 7
5. Apply one (1) label over the keyboard button cover as shown in Figure 7
6. Apply one (1) label over the gap between the I/O Panel and the main chassis as
shown in Figure 7
7. Apply 2 labels over the AC filter input module screws as shown in Figure 7
8. Record the serial numbers of the labels applied to the module.
9. Allow 24 hours for the adhesive in the tamper-evident seals to completely cure.

© Copyright 2000 Nortel Networks. 9
(2) Top Cover
Labels
(2) Front
Bezel Labels
Figure 6– Tamper-Evident Labels Applied to Switch Front Bezel and Top Cover
(2) AC Filter
InputLabels
(1) Air Hole
Label
(1) I/O Panel
Label
(1)Keyboard
Connector
Label
Figure 7– Tamper Evident Labels Applied to Rear Panel
The tamper-evident seals are produced from a special thin gauge white vinyl with self-adhesive
backing. Any attempt to open the switch will damage or destroy the tamper-evident seals, or
the painted surface and metal of the module cover. Since the tamper-evident labels have non-
repeated serial numbers, the labels may be inspected for damage and compared against the
applied serial numbers to verify that the module has not been tampered with. An intact label is
shown in Figure 8, with a visible serial number and no breaks.
FIPS 140-1 Level 2 Tamper Evident Label
Serial Number: 5673422
Contivity
Extranet
Switch
Figure 8– Tamper-Evident Label

© Copyright 2000 Nortel Networks. 10
Attempting to remove a label breaks it or continually tears off small fragments as depicted in
Figure 9. Other signs of tamper-evidence include a strong smell of organic solvents, warped or
bent cover metal, and scratches in the paint on the module.
FIPS 140-1 Level 2 Tamper Evident Label
Serial Number: 5673422
Contivity
Extranet
Switch
Figure 9– Damaged Tamper-Evident Label
2.4 Roles and Services
The Switch supports up to 5000 simultaneous users sending packets using Internet Protocol
Security (IPSec), Point-to-Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol
(L2TP), and Layer Two Forwarding (L2F). In addition, an administrator may securely
configure the switch either locally, or remotely.
The Switch employs role-based authentication of users, and stores user identity information in
an internal or an External Lightweight Directory Access Protocol (LDAP) database.
Authentication can optionally be performed against a variety of external servers using LDAP or
RADIUS (Novell NDS, Microsoft Windows NT Domains, Security Dynamics ACE Server,
Axent OmniGuard Defender)
There are two main roles in the Switch (as required by FIPS 140-1) that users may assume:
Crypto Officer role and User role. The administrator of the switch assumes the Crypto Officer
role in order to configure and maintain the switch using Crypto Officer services, while the Users
exercise only the User services. The Crypto Officer role is assumed with the following rights:
•Manage Switch rights: (either none, view switch, or manage switch). View
switch rights allow an administrator to view all the configuration and status
information on the switch. Manage switch rights allow an administrator to
configure the switch and actually change settings.
•Manage Users rights: (either none, view users, or manage users). View users
rights allow an administrator to review all user accounts and settings on the Switch
while manage users rights actually allow an administrator to create, modify, and
delete users.
A User authenticates and assumes the User role in order to have rights to access the following
services: