Nortel 4600 User manual

© Copyright 2001 Nortel Networks.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
Contivity™ Extranet Switch 4600
FIPS 140-1 Non-Proprietary
Cryptographic Module Security Policy
Level 2 Validation
June 2001

2
Table of Contents
1Introduction .............................................................................................................. 3
1.1 Purpose................................................................................................................. 3
1.2 References............................................................................................................ 3
1.3 Document Organization....................................................................................... 3
2The Contivity Extranet 4600 Switch....................................................................... 5
2.1 Cryptographic Module......................................................................................... 5
2.2 Module Interfaces ................................................................................................ 5
2.3 Physical Security.................................................................................................. 7
2.4 Roles and Services............................................................................................. 10
2.4.1 Crypto Officer Services............................................................................... 11
2.4.2 User Services............................................................................................... 12
2.5 Key Management............................................................................................... 13
2.6 Self-tests............................................................................................................. 14
3Secure Operation of the Contivity Switch............................................................ 15

3
1 Introduction
1.1 Purpose
This is a non-proprietary cryptographic module security policy for the Contivity™
Extranet Switch 4600. This security policy describes how the Contivity™ Extranet
Switch 4600 meets the security requirements of FIPS 140-1, and how to operate the
Contivity™ Extranet Switch 4600 in a secure FIPS 140-1 compliant mode of operation.
This policy was prepared as part of the FIPS 140-1 Level 2 multi-chip stand alone
certification of the Contivity™ Extranet Switch 4600.
FIPS 140-1 (“Federal Information Processing Standards Publication 140-1 -- Security
Requirements for Cryptographic Modules”) details the U.S. Government requirements
for cryptographic modules. More information about the FIPS 140-1 standard and
validation program is available on the NIST web site at http://csrc.nist.gov/cryptval/.
1.2 References
This document deals only with operations and capabilities of the Contivity™ Extranet
Switch 4600 in the technical terms of a FIPS 140-1 cryptographic module security policy.
More information is available on the Contivity™ Extranet Switch 4600 and the entire line
of Contivity™ products from the following sources:
• The Nortel Networks web site contains information on the full line of
Contivity products at www.nortelnetworks.com.
• For answers to technical or sales related questions please refer to the contacts
listed on the Nortel Networks web site at www.nortelnetworks.com.
1.3 Document Organization
This document is part of the complete FIPS 140-1 submission package. In addition to this
document, the complete submission package contains the following:
♦ Vendor evidence document
♦ Finite state machine
♦ Source code listing
♦ Other supporting documentation
This document provides an overview of the Contivity™ Switch and explains the secure
configuration and operation of the module. Section 1 provides introductory material,
section 2 details the general features and functionality of the Contivity™ Switch and
section 3 addresses configuration of the switch for FIPS-compliant mode of operation,
henceforth referred to as FIPS mode.
Corsec Security, Inc. produced this security policy and other certification submission
documentation under contract to Nortel Networks. With the exception of this non-

4
proprietary security policy, the FIPS 140-1 certification submission documentation is
Nortel-proprietary and is releasable only under appropriate non-disclosure agreements.
Please contact Nortel Networks for access to these documents.

5
2 The Contivity Extranet 4600 Switch
The Nortel Networks Contivity Extranet Switch 4600 (referred to as the module, or
Switch in this document) provides a scalable, secure, manageable remote access server
that meets FIPS 140-1 level 2 requirements for a multiple-chip standalone module. The
following sections describe how the Switch addresses FIPS 140-1 requirements.
2.1 Cryptographic Module
The Contivity Extranet Switch combines remote access protocols, security,
authentication, authorization, and encryption technologies in a single solution.
Figure 1 – The Contivity Extranet 4600 Switch
The Switch can support up to 5000 simultaneous user sessions, allowing each user to
exercise a variety of secure services. The Switch supports a number of secure network-
layer and data-link-layer protocols including Internet Protocol Security (IPSec), Point-to-
Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol (L2TP), and Layer Two
Forwarding (L2F). The architecture for the Switch is user-centric, where an individual
user or group of users can be associated with a set of attributes that provide custom access
to the Extranet. In effect, you can create a personalized extranet based on the specific
needs of a user or group. The unique Quality of Service (QoS) features include call
administration and packet forwarding priorities, and support for Resource ReSerVation
Protocol (RSVP).
2.2 Module Interfaces
The interfaces for the Switch are located on the rear panel as shown in Figure 2.

6
Figure 2 – Physical Interfaces
The physical interfaces include a power plug, power and reset switches, a serial port, a
LAN Port RJ-45 connector and up to two additional network connectors. Each RJ-45
connector is accompanied by light emitting diodes (LEDs). The LAN Port LEDs, with
the green LED indicating 100Mbps activity and the orange LED indicating link status and
activity, are located on the back panel of the module. More information on the LEDs and
the LAN Port interface can be found in Getting Started with the Contivity Extranet Switch
4600.
The physical interfaces, the LAN port, the 10/100Base-TX ports, serials port and status
LEDs, map to the logical interfaces defined in FIPS 140-1 as described in Table 1.
Switch physical interface
FIPS 140-1 Logical Interface
10/100BASE-TX LAN Ports,
LAN Port Data Input Interface
10/100BASE-TX LAN Ports,
LAN Port Data Output Interface
Power Switch,
Reset Switch,
Serial Port,
LAN Port
Control Input Interface
LAN Port LEDs,
10/100BASE-TX LAN Port LEDs
Serial Port
Status Output Interface
Power Plug Power Interface
Table 1 – FIPS 140-1 Logical Interfaces

7
2.3 Physical Security
A thick steel case protects the Contivity™ Extranet Switch 4600. The switch meets FCC
requirements in 47 CFR Part 15 for personal computers and peripherals designated for
home use (ClassB). The case has two removable portions: the front bezel and the top
cover. Removing the front bezel allows access to the floppy drive. The following
diagram shows how to remove the front bezel.
Note: The steps required to remove the front bezel are the same whether or not the Switch
is rack mounted.
Figure 3 - Removing the front bezel

8
Figure 4 – Front view without front bezel
Once the Extranet Switch has been configured in its FIPS 140-1 level 2 mode, the cover
may not be removed without signs of tampering. To seal the cover, apply three serialized
tamper-evident labels as follows:
1. Clean the cover of any grease, dirt, or oil before applying the tamper-evident labels.
Alcohol based cleaning pads are recommended for this purpose. The temperature of
the switch should be above 10°C.
2. Apply two (2) labels on the top cover overlapping the side and the rear of the chassis
as shown in Figure 5.
3. Apply two (2) labels on the top and bottom overlapping the front bezel as shown in
Figure 5.
4. Apply one (1) label over the keyboard button cover as shown in Figure 5.
5. Record the serial numbers of the labels applied to the module.
6. Allow 24 hours for the adhesive in the tamper-evident seals to completely cure.

9
Figure 5 – Tamper-Evident Labels Applied to Switch
The tamper-evident seals are produced from a special thin gauge white vinyl with self-
adhesive backing. Any attempt to open the switch will damage or destroy the tamper-
evident seals or the painted surface and metal of the module cover. Since the tamper-
evident labels have non-repeated serial numbers, the labels may be inspected for damage
and compared against the applied serial numbers to verify that the module has not been
tampered. An intact label is shown in Figure 6, with a visible serial number and no
breaks.
FIPS 140-1 Level 2 Tamper Evident Label
A567422
Contivity Extranet Switch
Figure 6 – Tamper-Evident Label
Attempting to remove a label breaks it or continually tears off small fragments as
depicted in Figure 7. Other signs of tamper-evidence include a strong smell of organic
solvents, warped or bent cover metal, and scratches in the paint on the module.
FIPS 140-1 Level 2 Tamper Evident Label
A567422
Contivity Extranet Switch
Figure 7 – Damaged Tamper-Evident Label

10
2.4 Roles and Services
The switch supports up to 5000 simultaneous user sessions using Internet Protocol
Security (IPSec), Point-to-Point Tunneling Protocol (PPTP), Layer Two Tunneling
Protocol (L2TP), and Layer Two Forwarding (L2F). In addition, an administrator may
securely configure the switch either locally or remotely. Remote administration is secured
by one of the secure tunneling protocols supported by the box. The administrator selects
which protocols are used from the Services-Available menu.
The Switch employs role-based authentication of users, and stores user identity
information in an internal Lightweight Directory Access Protocol (LDAP) database.
Authentication can optionally be performed against a variety of external servers using
LDAP or RADIUS, including Novell NDS, Microsoft Windows NT Domains, Security
Dynamics ACE Server, and Axent OmniGuard Defender.
Service Crypto Officer User
Configure the Switch 
Create User Groups 
Create Users 
Modify User Groups 
Modify Users 
Delete User Groups 
Delete Users 
Define Rules and Filters 
Status Functions 
Manage the Switch 
Encrypted Traffic 
Change Password 
Table 2 – Matrix of Services
Users may assume one of two roles: Crypto Officer role or User role. An administrator of
the switch assumes the Crypto Officer role to configure and maintain the switch. The
Crypto Officer role may have the following rights:
• Switch management rights: (none, view switch, or manage switch). View
switch permits an administrator to view all the configuration and status
information on the switch. Manage switch permits an administrator to
configure the switch and change critical settings.
• User management rights: (none, view users, or manage users). View users
permits an administrator to review all user accounts and settings on the switch.
Manage users rights allows an administrator to create, modify, and delete
users.
A User authenticates and assumes the User role to access the following services: