Symantec SSL Visibility SV3800 User manual

Symantec Corporation
SSL Visibility Appliance
Models: SV3800, SV3800B, and SV3800B-20
Hardware Versions: 090-03064,080-03563, 080-03679, 090-03550,080-03782, 080-
03787, 090-03551, 080-03783,and 080-03788withFIPSKit:FIPS-LABELS-SV
Firmware Versions: 3.8.2F build227, 3.8.4FC, 3.10 build 40
FIPS 140-2 Non-Proprietary Security Policy
FIPS Security Level: 2
Document Revision: 12/22/2016

SV3800, SV3800B, and SV3800B-20 Security Policy
2
COPYRIGHT NOTICE
2016 Symantec Corporation Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER,
CACHEFLOW, INTELLIGENCECENTER, CACHEOS, CACHEPULSE, CROSSBEAM, K9, DRTR, MACH5,
PACKETWISE, POLICYCENTER, PROXYAV, PROXYCLIENT, SGOS, WEBPULSE, SOLERA NETWORKS, DEEPSEE, DS
APPLIANCE, SEE EVERYTHING. KNOW EVERYTHING., SECURITY EMPOWERS BUSINESS, BLUETOUCH, the Blue
Coat shield, K9, and Solera Networks logos and other Symantec logos are registered trademarks or trademarks of
Symantec Corporation or its affiliates in the U.S. and certain other countries. This list may not be complete, and the
absence of a trademark from this list does not mean it is not a trademark of Symantec or that Symantec has stopped
using the trademark. All other trademarks mentioned in this document owned by third parties are the property of their
respective owners. This document is for informational purposes only.
SYMANTEC MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS
DOCUMENT. SYMANTEC PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA
REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS,
REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER
COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS,
AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER
APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT
AFTER DELIVERY TO YOU.
Americas: Rest of the World:
Symantec Corporation Symantec Corporation
384 Santa Trinita Ave. 3a Route des Arsenaux
Sunnyvale, CA 94085 1700 Fribourg, Switzerland
This document may be freely reproduced and distributed whole and intact including this copyright
notice.
Document Revision: 12/22/2016

1. Introduction................................................................................................................................................5
1.1 Purpose...............................................................................................................................................5
1.2 References ..........................................................................................................................................5
1.3 DocumentOrganization .......................................................................................................................5
1.4 Definitions and Acronyms ....................................................................................................................7
2. SV3800, SV3800B, and SV3800B-20.................................................................................................................9
2.1 Overview.............................................................................................................................................9
2.2 ModuleSpecification .........................................................................................................................13
2.3 Module Interfaces .............................................................................................................................18
2.4 Roles and Services .............................................................................................................................22
2.4.1 Management Interfaces............................................................................................................23
2.4.2 Authentication Mechanisms .....................................................................................................23
2.5 Services and CSP Access.....................................................................................................................25
2.6 Physical Security ................................................................................................................................31
2.7 Non-Modifiable Operational Environment ..........................................................................................32
2.8 Cryptographic Key Management ........................................................................................................32
2.9 Self Tests............................................................................................................................................41
2.10 Design Assurance...............................................................................................................................43
2.11 Mitigation of Other Attacks................................................................................................................43
3. Secure Operation ......................................................................................................................................44
3.1 Cryptographic Officer Guidance .........................................................................................................44
3.2 Tamper Evident Label Management and Application Instructions........................................................44
3.2.1 General Label Information ........................................................................................................45
3.2.2 Supplied Labels .........................................................................................................................46
3.2.3 Label Application.......................................................................................................................47
3.2.4 Label Inspection ........................................................................................................................49
3.3 Module Initialization..........................................................................................................................54
3.4 ModuleManagement ........................................................................................................................56
3.5 ModuleZeroization............................................................................................................................56
iii

SV3800, SV3800B, and SV3800B-20 Security Policy
4

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
5
1. Introduction
1.1 Purpose
This document is a non-proprietary Cryptographic Module Security Policy for the
SSL Visibility Appliance models SV3800, SV3800B, and SV3800B-20. The SV3800
should be operated with the 3.8.2F, 3.8.4FC, or 3.10 firmware version. The
SV3800B and SV3800B-20 require the latest 3.10 firmware version to operate. This
policy was prepared as part of the Level 2 FIPS 140-2 validation of the module,
and may freely be reproduced and distributed in its entirety (without
modification).
Federal Information Processing Standards (FIPS) 140-2, Security Requirements for
Cryptographic Modules, specifies the U.S. and Canadian Governments’
requirements for cryptographic modules. The following pages describe how the
SSL Visibility Appliance meets these requirements and how to operate the device
in a mode compliant with FIPS 140-2.
More information about the FIPS 140-2 standard and validation program is
available on the National Institute of Standards and Technology (NIST)
Cryptographic Module Validation Program (CMVP) website at: http://
csrc.nist.gov/groups/STM/cmvp/index.html.
In this document, the SSL Visibility Appliance models SV3800, SV3800B, and
SV3800B-20 are referred to as the SV3800, SV3800B, and SV3800B-20, the
hardware module, the cryptographic module, or the module.
1.2 References
This document only deals with the operation and capabilities of the SV3800,
SV3800B, and SV3800B-20 within the technical terms of a FIPS 140-2
cryptographic module security policy. More information on the SV3800,
SV3800B, and SV3800B-20 is available from the following sources:
•The Symantec website, www.symantec.com, contains information on
the full line of products from Blue Coat.
•The Symantec customer website, https://bto.bluecoat.com, contains
product documentation, software downloads, and other information on
the full line of products from Blue Coat.
The CMVP website http://csrc.nist.gov/groups/STM/cmvp/index.html
contains contact information for answers to technical or sales-related questions
for the module.
1.3 DocumentOrganization
This Security Policy is one document in the FIPS 140-2 Submission Package. In
addition to this document, the Submission Package contains:
•Vendor Evidence
•Finite State Machine
•Other supporting documentation as additional references
•Validation Submission Summary

SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
6
With the exception of this non-proprietary Security Policy, the FIPS 140-2
Submission Package is proprietary to Symantec Corporation, and is releasable
only under appropriate non-disclosure agreements. For access to these
documents, please contact Symantec Corporation.

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
7
1.4 Definitions and Acronyms
Table 1–1 Definition of Terms and Acronyms
Term / Acronym Definition
Active-Inline An active security appliance processes traffic from the SSL Visibility
Appliance and returns it to the SSL Visibility Appliance .
ANSI American National Standards Institute
CA Certificate Authority
CLI Command line interface
Crypto Officer Crypto Officer as defined in FIPS 140-2
DES Data Encryption Standard
DLP
Data Loss Prevention
EMC ElectromagneticCompatibility
FIPS Federal Information Processing Standard
GigE Gigabit Ethernet interface.
HMAC Hash Message Authentication Code
HTTPS HTTP over TLS
iPass High density copper cable/connector for 10Gbps Ethernet link
KAT Known Answer Test
10Gig 10 Gigabit Ethernet interface
AES Advanced Encryption Standard
BTO Blue Touch Online
CBC Cipher Block Chaining
CMVP Cryptographic Module Validation Program
CSP Critical Security Parameter
DH Diffie-Hellman
DPI Deep Packet Inspection
EMI ElectromagneticInterference
FTW Fail To Wire –hardware network cut through
GUI Graphical User Interface
HTTP Hypertext Transfer Protocol
IDS Intrusion Detection System
IPS Intrusion Prevention System
LCD Liquid Crystal Display

SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
8
Table 1–1 Definition of Terms and Acronyms
Term / Acronym Definition
LED Light Emitting Diodes
MD5 Message Digest #5
Netmod Network I/O Module –plug-able –defines network interface
used
NFP Netronome Flow Processor
NMI Non Maskable Interrupt
NSM Netronome SSL Module
Passive-Inline Inline SV3800 acting as a tap for a passive security appliance
PIN Personal Identification Number
POST Power On Self Test
PSU
Power Supply Unit
SHA Secure Hash Algorithm
SSH Secure Shell
TAP Device providing a copy of traffic flowing through the network
TRNG True Random Number Generator
MAC Message Authentication Code
NDRNG Non-deterministic Random Number Generator
NFE Netronome Flow Engine
NIST National Institute of Standards and Technology
NPU Network Processing Unit
OS Operating System
SV3800 connected to a network tap acting as a tap for a passive
security appliance
PKCS Public Key Cryptography Standard
DRBG Pseudo Random Number Generator
Rivest Cipher 4
SPAN port
A switch port providing a copy of traffic flowing through the
network
SSL Secure Socket Layer
TLS Transport Layer Security protocol

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
9
2. SV3800, SV3800B, and SV3800B-20
2.1 Overview
The SSL Visibility Appliance products provide two main functions when
deployed within a network:
• They enable other security appliances to see a non encrypted version of
SSL/TLS traffic that is crossing the network. This is called SSL Inspection.
• They can act as a policy control point enabling explicit control over what
SSL/TLS traffic is and is not allowed across the network.
The SSL Visibility Appliance is designed to work alongside existing security
devices such as Intrusion Prevention Systems (IPS), Intrusion Detection Systems
(IDS), Data Loss Prevention systems (DLP), Network Forensic appliance and
others. It provides a non-encrypted version of SSL/TLS traffic to the associated
appliances while maintaining an end-to-end SSL/TLS connection between the
client and server involved in the session.
There are three basic connectivity modes that define how the
SV3800/SV3800B/SV3800B-20 and the associated security appliance are
connected to each other and to the network. These modes are identified as:
• Active-Inline
• Passive-Inline
• Passive-Tap
The Active/Passive designation refers to the associated security appliance and
how it behaves while the Inline/Tap designation refers to how the
SV3800/SV3800B/SV3800B-20 is connected to the network. An “Active”
associated appliance processes traffic from the SV3800 and then returns the traffic
to the SV3800/SV3800B/SV3800B-20, while a “Passive” appliance simply
consumes traffic from the SV3800/SV3800B/SV3800B-20.
The SV3800/SV3800B/SV3800B-20 can be either “Inline,” or a TAP, which is
connected to a network span or tap port. The following figures show these three
modes of operation.

SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
10
Figure 2–1 Active-Inline Configuration
In Active-Inline mode (Figure 2-1) network traffic flows through both the
SV3800/SV3800B/SV3800B-20 and the attached security appliance. A typical
example of this type of deployment would be an IPS attached to the
SV3800/SV3800B/SV3800B-20. This mode of operation supports both SSL
Inspection and SSL policy control.
In Passive-Inline mode (Figure 2-2), network traffic flows through the
SV3800/SV3800B/SV3800B-20 only, a copy of the network traffic (some of which
may be decrypted) is sent to the attached security appliance. A typical example of
this type of deployment would be an IDS or Forensic appliance attached to the
SV3800/SV3800B/SV3800B-20. This mode of operation supports both SSL
Inspection and SSL policy control.

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
11
Figure 2–2 Passive-Inline Configuration
In Passive-Tap mode (Figure 2-3), network traffic does not flow through the
SV3800/SV3800B/SV3800B-20 or the attached security appliance. The
SV3800/SV3800B/SV3800B-20 receives a copy of traffic in the network from a
TAP device and this traffic (possibly decrypted) is sent to the attached security
appliance. A typical example of this type of deployment would be an IDS or
Forensic appliance attached to the SV3800/SV3800B/SV3800B-20, which is in
turn attached to a TAP or SPAN port. This mode of operation supports SSL
Inspection only and cannot act as an SSL policy control point.

SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
12
Figure 2–3 Passive-Tap Configuration
By allowing the attached security appliance to view a decrypted version of SSL/
TLS traffic, the SSL Visibility Appliance enables the security appliance to detect/
block threats that are hidden within encrypted SSL/TLS flows. As the percentage
of SSL/TLS traffic in networks is growing significantly with increasing use of Web
2.1 applications and Cloud based applications, it is increasingly important that
network security appliances can do their job even when the traffic is sent over
SSL/TLS connections.
Detecting, intercepting, decrypting and re-encrypting SSL/TLS traffic is a
complex and computationally intense activity. Providing SSL/TLS inspection
capabilities in a device that can be placed in-line in either a Gigabit Ethernet or 10
Gigabit Ethernet network link and which will not cause a performance bottleneck
requires hardware acceleration. In the case of the SV3800/SV3800B/SV3800B-20,
this acceleration is provided by a Netronome Network Flow Engine (NFE) card
that contains two of Netronome’s NFP-3240 flow processor chips. Each NFP-
3240 contains 40 cores optimized for processing network traffic and provides
significant acceleration and offload for the standard CPUs used on the
SV3800/SV3800B/SV3800B-20 motherboards.

2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
13
The SV3800/SV3800B/SV3800B-20 software provides the ability to inspect both
incoming and outgoing SSL/TLS traffic and detects SSL/TLS traffic by deep
packet inspection (DPI) so no matter what port the SSL/TLS traffic is using it will
be detected. Once an SSL/ TLS flow has been detected the
SV3800/SV3800B/SV3800B-20 policy engine determines what to do with the
flow:
• it can be inspected providing a decrypted version to the attached
appliance(s)
• it can be cut through, allowing the attached appliance(s) to see the original
encrypted flow
• it can be blocked such that the flow is terminated and cannot continue.
The policy engine allows policy to be based on a wide range of parameters such
as:
• the source/destination IP address of the flow
• the Distinguished Name (DN) of the subject or issuer contained in the
SSL/TLS server certificate sent by the server
• the cipher suite being used for the flow
This allows for fine grained control over which SSL/TLS traffic is inspected, and,
when the SV3800/SV3800B/SV3800B-20 is deployed in-line, enables fine grained
policy control over what SSL/TLS traffic is allowed in the network.
All SSL/TLS traffic seen by the SV3800/SV3800B/SV3800B-20, whether it is
using approved or non- approved algorithms, will be processed to a degree. At a
minimum the SSL/TLS handshake will be observed in order to collect
information that the policy engine will use to determine how the flow should be
handled. Using the policy rules it is possible to cause the following actions to be
applied to a flow:
• block the SSL/TLS flow
• allow the SSL/TLS flow without any inspection
• allow the SSL/TLS flow with the flow being inspected
The policy engine is aware of the cipher suite that the SSL/TLS flow is using, and
can base its decision on that. So, it is possible to configure policy settings that will
prevent any SSL/TLS flows using non-approved algorithms from being
established through the SV3800 if that is desired. If SSL/TLS flows using non-
approved algorithms are allowed by the policy engine then they should be
considered as being “clear text” due to the use of non-approved algorithms.
2.2 ModuleSpecification
The hardware version numbers in Table 2-2 provides a mapping between the
hardware versions and the appliance types available. All appliance types, for a
given model, have the exact same hardware and firmware, and are exactly the
same from a cryptographic functionality and boundary perspective.

SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
14
Table2–2SV3800/SV3800B/SV3800B-20 Appliance Configurations
Appliance Model
ApplianceType
HardwareVersion
SV3800
HardwareAppliance
090-03064
SV3800
Try-and-Buy
Appliance
080-03563
SV3800
Cold Standby
Appliance
080-03679
SV3800B
HardwareAppliance
090-03550
SV3800B
Try-and-Buy
Appliance
080-03782
SV3800B
Cold Standby
Appliance
080-03787
SV3800B-20
HardwareAppliance
090-03551
SV3800B-20
Try-and-Buy
Appliance
080-03783
SV3800B-20
Cold Standby
Appliance
080-03788
The Crypto Officer and User services of the module are identical for both
appliance types. A Try-And-Buy appliance varies from the Hardware Appliance
only in that the firmware that is provided with the appliance is valid for 60 days,
after which the full license must be purchased or the hardware appliance must be
returned to Symantec. A Cold Standby appliance varies only in there is no valid
license. For the Cold Standby Appliance to become active, a license must be
acquired to convert the Cold Standby to an active Hardware Appliance. For each
appliance model, the hardware is the same for all appliance types. The Crypto
Officer and User services of the module are identical for all appliance types.
The SV3800/SV3800B/SV3800B-20 is a high performance transparent SSL/TLS
proxy that can be deployed in both Gigabit Ethernet and 10G Ethernet networks.
The SV3800/SV3800B/SV3800B-20 is a 2U high rack mountable device.
The SV3800/SV3800B/SV3800B-20 has seven front facing modular I/O bays that
allow for flexibility in the number of network interfaces and in the type of media
supported. Network I/O Modules (Netmods) are installed in the seven bays to
configure the desired combination of interfaces.
All of the Netmod interfaces and the switching module that plug into the front of
the SV3800/SV3800B/SV3800B-20 connect to the network segments on which
traffic is being monitored/ inspected. These ports are only used to access the
network data that is being processed by the SV3800/SV3800B/SV3800B-20; they
are not associated with any cryptographic processes, keys, critical security
parameters (CSP) or any FIPS relevant data.
These ports do not allow access to the management services of the SV3800 and
cannot be used to input or output cryptographic keys, CSPs or any FIPS relevant
data. The Netmods and associated switch are therefore deemed to be outside the
logical cryptographic boundary.

2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
15
Figure 2-4 shows an SV3800/SV3800B/SV3800B-20 device with four Netmods
installed. In this example, of the Netmods each support 4 x GigE fiber interfaces,
and the other two 4 x GigE copper interfaces. Available Netmod options are listed
below, other Netmod types may become available in the future:
• 4 x GigE copper (4 ports of 10/100/1000Base-T with FTW)
• 4 x GigE fiber (4 ports of 1000Base-SX with FTW)
• 2 x 10Gig fiber (2 ports of 10GBase-SR with FTW)
• 2 x 10Gig fiber (2 ports of 10GBase-LR with FTW)
Fail to wire (FTW) hardware allows pairs of network ports to be physically
connected to each other in the event that the system is powered off or that a
failure is detected. Depending on how the network is connected to the SV3800,
this allows network traffic to continue flowing even when the system is powered
off or in a failure state. When FTW is active, traffic is passed between ports on a
Netmod and never enters the module.
Note: Netmods are NOT hot swappable. The system must be powered
off before removal or installation of Netmods.
Figure 2–4 SV3800/SV3800B/SV3800B-20, Front View with Netmods Installed
Figure 2-5 shows the SV3800/SV3800B/SV3800B-20 with all Netmods removed.
Figure 2–5 SV3800/SV3800B/SV3800B-20 Front view with Netmods Removed
From left to right, the front panel includes status LEDs, NMI button, reset
button, ID button, power button, USB connector, LCD display and keypad.
Figure 2-6 shows the front panel display area in detail.

SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
16
Figure 2–6 SV3800/SV3800B/SV3800B-20 Front Panel Controls and Display
The combination of Netmods installed in an SV3800/SV3800B/SV3800B-20 is not
important for FIPS 140-2 validation as the Netmods are all outside of the logical
cryptographic boundary (see "2.3 Module Interfaces" on page 18).
The back of the SV3800 is shown in Figure 2-7 and has the following elements
going from left to right:
• 2 x hot swappable power supply bays
• Serial port (RJ45 connector)
• VGA display connector
• 2 x USB 2.0 and 2 x USB 3.0 ports
• 2 x GigE ports each with two built in LEDs –port 1 is used for
management, port 2 is unused
Figure 2–7.1 SV3800 Back Panel
The back of the SV3800B/SV3800B-20 differs slightly (serial port location only)
from the SV3800 and is shown in Figure 2-7.2 and has the following elements
going from left to right:
• 2 x hot swappable power supply bays
• VGA display connector
• 2 x USB 2.0 and 2 x USB 3.0 ports
• 2 x GigE ports each with two built in LEDs –port 1 is used for
management, port 2 is unused
• Serial port (RJ45 connector)

2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
17
Figure 2–7.2 SV3800B/SV3800B-20 Back Panel
Three covers on the upper surface of the SV3800/SV3800B/SV3800B-20 can be
removed to gain access to the interior of the unit. These covers should not be
removed by end users, and may require removal by trained field engineers when
maintaining a system.
The three covers can be seen fitted in Figure 2-8, and are shown removed in
Figure 2-9. These panels need to be sealed with tamper evident labels when
operating in FIPS 140-2 mode.
Section "3.2 Tamper Evident Label Management and Application Instructions"
provides guidance on how and where tamper evident labels need to be applied to
the SV3800/SV3800B/SV3800B-20.
Figure 2–8 SV3800/SV3800B/SV3800B-20 Front/Top, covered, with Netmods Installed
Figure 2–9 SV3800/SV3800B/SV3800B-20 Front/Top, covered, without Netmods Installed
For FIPS 140-2 Level 2 validation the SV3800 was tested with the following
configuration:
• SV3800 chassis with 2 x NFE acceleration card installed
• 2 x Intel 5645 hex core CPUs and 48GB of memory
This configuration is model number SV3800.
For FIPS 140-2 Level 2 validation the SV3800B was tested with the following
configuration:
• SV3800B chassis with 2 x NFE acceleration card installed
• 1 x Intel E5-2640 V3, 8 core CPU and 64GB of memory
This configuration is model number SV3800B.

SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
18
For FIPS 140-2 Level 2 validation the SV3800B-20 was tested with the following
configuration:
• SV3800B chassis with 2 x NFE acceleration card installed
2 x Intel E5-2640 V3, 8 core CPU and 128GB of memory
This configuration is model number SV3800B-20.
The module is a multi-chip standalone module that meets overall FIPS 140-2 Level
2 requirements. The module is validated to the following FIPS 140-2 section levels:
Table2–3Security Levels Per FIPS 140-2 Section
FIPS 140-2 Section
Section Title
Validated Level
1
Cryptographic Module Specification
2
2
Cryptographic Module Ports and Interfaces
2
3
Roles, Services and Authentication
2
4
Finite State Model
2
5
Physical Security
2
6
Operational Environment
Not applicable
7
Cryptographic Key Management
2
8
Electromagnetic Interference /
ElectromagneticCompatibility
2
9
Self-Tests
2
10
Design Assurance
3
11
Mitigation of Other Attacks
Not applicable
2.3 ModuleInterfaces
The logical cryptographic boundary of the module is shown in the following
pictures and diagrams. All of the Netmod interfaces and the switching module
that plug into the front of the SV3800/SV3800B/SV3800B-20 connect to the
network segments on which traffic is being monitored/inspected. These ports
are only used to access the network data that is being processed by the
SV3800/SV3800B/SV3800B-20; they do not allow access to the management
services of the SV3800/SV3800B/SV3800B-20. The Netmods and associated
switch are therefore outside the logical cryptographic boundary. Data
input/output to the module from the Netmods and associated switch is via four
internal 10Gbps Ethernet connections carried over iPass connectors/cables.
The two pluggable power supply units and the bays that they plug into are not
associated with any cryptographic processes, keys, critical security parameters
(CSP), or any FIPS relevant data, and are therefore deemed to be outside of the
cryptographic boundary.

2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
19
Note: Netmods are NOT hot-swappable. Power off the system before you
remove or install Netmod.
Figure 2-10 shows the physical cryptographic boundary as a yellow line with the
module being everything contained within the yellow boundary line. The
physical boundary is defined by the exterior surfaces of the appliance.

SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may befreely reproduced & distributed whole & intact including this copyright
notice.
20
Figure 2–10 SV3800 Cryptographic Boundary Definition
The front panel display and input devices do not connect to the mid-plane and are
connected directly to elements within the logical cryptographic boundary.
Therefore the LCD display and keypad, status LEDs, power button and USB
connector located on the front panel are considered to be within the logical
cryptographic boundary.
As noted in Section "2.2 Module Specification" , the SV3800/SV3800B/SV3800B-
20 has a number of connectors located on the front and back panels. These
physical interfaces are listed below with details of the FIPS 140-2 logical
interfaces they correspond to.
Table2–4SV3800/SV3800B/SV3800B-20 FIPS 140-2 FIPS Logical Interfaces
FIPS 140-2 logical
interface
SV3800port/interface
Panel
Usedin
FIPS
mode?
Data input
4 iPass connectors each carrying
a 10Gbps Ethernet link
Internal
Y
Data output
4 iPass connectors each carrying
a 10Gbps Ethernet link
Internal
Y
Data output
USB port
Front
Y
Data output
USB ports
Back
Y
Control input/Status
output
Keypad
Front
Y
Control input
NMI button
Front
Y
Control input
Reset button
Front
Y