Symantec SV1800-C User manual

Symantec Corporation
SSL Visibility Appliance
Models: SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, SV2800B
Hardware Versions: 090-03061,080-03560, 080-03676,090-03547,080-03779,080-
03784,090-03062,080-03561, 080-03677, 090-03548,080-03780,080-03785, 090-
03063, 080-03562, 080-03678, 090-03549,080-03781, 080-03786 with FIPS Kit:
FIPS-LABELS-SV
Firmware Versions: 3.8.2Fbuild 227, 3.8.4FC, 3.10 build 40
FIPS 140-2 Non-Proprietary Security Policy
FIPS Security Level 2
Document Revision: 12/22/2016

2
COPYRIGHT NOTICE
2016 Symantec Corporation All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW,
INTELLIGENCECENTER, CACHEOS, CACHEPULSE, CROSSBEAM, K9, DRTR, MACH5, PACKETWISE,
POLICYCENTER, PROXYAV, PROXYCLIENT, SGOS, WEBPULSE, SOLERA NETWORKS, DEEPSEE, DS APPLIANCE,
SEE EVERYTHING. KNOW EVERYTHING., SECURITY EMPOWERS BUSINESS, BLUETOUCH, the Blue Coat shield, K9,
and Solera Networks logos and other Symantec logos are registered trademarks or trademarks of Symantec Corporation
or its affiliates in the U.S. and certain other countries. This list may not be complete, and the absence of a trademark from
this list does not mean it is not a trademark of Symantec or that Symantec has stopped using the trademark. All other
trademarks mentioned in this document owned by third parties are the property of their respective owners. This
document is for informational purposes only.
SYMANTEC MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS
DOCUMENT. SYMANTEC PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA
REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS,
REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER
COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS,
AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER
APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT
AFTER DELIVERY TO YOU.
Americas:
Rest of the World
Symantec Corporation
Symantec Corporation
384 Santa Trinita Ave.
3a Route des Arsenaux
Sunnyvale, CA 94085
1700 Fribourg, Switzerland
This document may be freely reproduced and distributed whole and intact including this copyright
notice.
Document Revision: 12/22/2016

1. Introduction................................................................................................................................................5
1.1 Purpose...............................................................................................................................................5
1.2 References ..........................................................................................................................................5
1.3 DocumentOrganization .......................................................................................................................5
1.4 Definitions and Acronyms ....................................................................................................................7
2. SV1800-C,SV1800B-C,SV1800-F, SV1800B-F,SV2800, and SV2800B ...........................................................................9
2.1 Overview.............................................................................................................................................9
2.2 ModuleSpecification .........................................................................................................................13
2.3 ModuleInterfaces .............................................................................................................................20
2.4 Roles and Services .............................................................................................................................25
2.4.1 Management Interfaces............................................................................................................26
2.4.2 Authentication Mechanisms .....................................................................................................26
2.5 Services and CSP Access.....................................................................................................................28
2.6 Physical Security ................................................................................................................................36
2.7 Non-Modifiable Operational Environment ..........................................................................................36
2.8 Cryptographic Key Management ........................................................................................................36
2.9 Self Tests............................................................................................................................................45
2.10 Design Assurance...............................................................................................................................47
2.11 Mitigation of Other Attacks................................................................................................................47
3. SecureOperation ......................................................................................................................................48
3.1 Cryptographic Officer Guidance .........................................................................................................48
3.2 Tamper Evident Label Management and Application Instructions........................................................48
3.2.1 General Label Information ........................................................................................................49
3.2.2 Supplied Labels .........................................................................................................................49
3.2.3 SV2800/SV2800B Label Application ..........................................................................................50
3.2.4 SV1800-C/SV1800B-C/SV1800-F/SV1800B-F Label Application .................................................52
3.2.5 Label Inspection ........................................................................................................................54
3.3 Module Initialization..........................................................................................................................62
3.4 ModuleManagement ........................................................................................................................64
3.5 ModuleZeroization............................................................................................................................64

SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
4

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
5
1. Introduction
1.1 Purpose
This document is a non-proprietary Cryptographic Module Security Policy for the
SSL Visibility Appliance models SV1800-C, SV1800B-C, SV1800-F, SV1800B-F,
SV2800, and SV2800B. The non-B models can operate with the 3.8.2F, 3.8.4FC, or
3.10 firmware version. The B-models require the 3.10 firmware version to operate.
This policy was prepared as part of the Level 2 FIPS 140-2 validation of the
module, and may freely be reproduced and distributed in its entirety (without
modification).
Federal Information Processing Standards (FIPS) 140-2, Security Requirements for
Cryptographic Modules, specifies the U.S. and Canadian Governments’
requirements for cryptographic modules. The following pages describe how the
SSL Visibility Appliance meets these requirements and how to operate the device
in a mode compliant with FIPS 140-2.
More information about the FIPS 140-2 standard and validation program is
available on the National Institute of Standards and Technology (NIST)
Cryptographic Module Validation Program (CMVP) website at: http://
csrc.nist.gov/groups/STM/cmvp/index.html.
In this document, the SSL Visibility Appliance models SV1800-C, SV1800B-C,
SV1800-F, SV1800B-F, SV2800, and SV2800B are referred to as the hardware
modules, the cryptographic modules, or the modules.
1.2 References
This document only deals with the operation and capabilities of the SV1800-C,
SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B within the technical
terms of a FIPS 140-2 cryptographic module security policy. More information on
the SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B is
available from the following sources:
• The Symantec website, www.symantec.com, contains information on
the full line of products from Blue Coat.
• The Symantec customer website, https://bto.bluecoat.com, contains
product documentation, software downloads, and other information on
the full line of products from Symantec.
The CMVP website http://csrc.nist.gov/groups/STM/cmvp/index.html
contains contact information for answers to technical or sales-related questions
for the module.
1.3 DocumentOrganization
This Security Policy is one document in the FIPS 140-2 Submission Package. In
addition to this document, the Submission Package contains:
• Vendor Evidence
• Finite State Machine
• Other supporting documentation as additional references
• Validation Submission Summary

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
6
SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
With the exception of this non-proprietary Security Policy, the FIPS 140-2
Submission Package is proprietary to Symantec Corporation, and is releasable
only under appropriate non-disclosure agreements. For access to these
documents, please contact Symantec Corporation.

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
7
1.4 Definitions and Acronyms
Table1–1 Definition of Terms and Acronyms
Term / Acronym Definition
Active-Inline An active security appliance processes traffic from the SSL Visibility
Appliance and returns it to the SSL Visibility Appliance
ANSI American National Standards Institute
CA Certificate Authority
CLI Command line interface
Crypto Officer Crypto Officer as defined in FIPS 140-2
DES Data Encryption Standard
DLP
Data Loss Prevention
EMC ElectromagneticCompatibility
FIPS Federal Information Processing Standard
GigE Gigabit Ethernet interface.
HMAC Hash Message Authentication Code
HTTPS HTTP over TLS
iPass High density copper cable/connector for 10Gbps Ethernet link
KAT Known Answer Test
10Gig 10 Gigabit Ethernet interface
AES Advanced Encryption Standard
BTO Blue Touch Online
CBC Cipher Block Chaining
CMVP Cryptographic Module Validation Program
CSP Critical Security Parameter
DH Diffie-Hellman
DPI Deep Packet Inspection
EMI Electromagnetic Interference
FTW Fail To Wire –hardware network cut through
GUI Graphical User Interface
HTTP Hypertext Transfer Protocol
IDS Intrusion Detection System
IPS Intrusion Prevention System
LCD Liquid Crystal Display

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
8
SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
Table1–1 Definition of Terms and Acronyms
Term / Acronym Definition
LED Light Emitting Diodes
MD5 MessageDigest #5
Netmod Network I/O Module –plug-able –defines network interface
used
NFP Netronome Flow Processor
NMI Non Maskable Interrupt
NSM Netronome SSL Module
Passive-Inline Inline module acting as a tap for a passive security appliance
PIN Personal Identification Number
POST Power On Self Test
PSU
Power Supply Unit
SHA Secure Hash Algorithm
SSH Secure Shell
TAP Device providing a copy of traffic flowing through the network
TRNG True Random Number Generator
MAC Message Authentication Code
NDRNG Non-deterministic Random Number Generator
NFE Netronome Flow Engine
NIST National Institute of Standards and Technology
NPU Network Processing Unit
OS Operating System
Module connected to a network tap acting as a tap for a
passive
security appliance
PKCS Public Key Cryptography Standard
DRBG Pseudo Random Number Generator
Rivest Cipher 4
SPAN port
A switch port providing a copy of traffic flowing through the
network
SSL Secure Socket Layer
TLS Transport Layer Security protocol

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
9
2. SV1800-C,SV1800B-C,SV1800-F,SV1800B-F,SV2800,andSV2800B
2.1 Overview
SSL Visibility Appliance products provide two main functions when deployed
within a network:
• They enable other security appliances to see a non encrypted version of
SSL/TLS traffic that is crossing the network. This is called SSL Inspection.
• They can act as a policy control point enabling explicit control over what
SSL/TLS traffic is and is not allowed across the network.
The SSL Visibility Appliance is designed to work alongside existing security
devices such as Intrusion Prevention Systems (IPS), Intrusion Detection Systems
(IDS), Data Loss Prevention systems (DLP), Network Forensic appliance and
others. It provides a non-encrypted version of SSL/TLS traffic to the associated
appliances while maintaining an end-to-end SSL/TLS connection between the
client and server involved in the session.
There are three basic connectivity modes that define how the SSL Visibility
Appliance and the associated security appliance are connected to each other
and to the network. These modes are identified as:
• Active-Inline
• Passive-Inline
• Passive-Tap
The Active/Passive designation refers to the associated security appliance and
how it behaves while the Inline/Tap designation refers to how the SSL Visibility
Appliance is connected to the network. An “Active” associated appliance
processes traffic from the SSL Visibility Appliance and then returns the traffic to
the SSL Visibility Appliance, while a “Passive” appliance simply consumes traffic
from the SSL Visibility Appliance.
The SSL Visibility Appliance can be either “Inline,” or a TAP, which is connected
to a network span or tap port. The following figures show these three modes of
operation.

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
10
SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
Figure 2–1 Active-Inline Configuration
In Active-Inline mode (Figure 2-1) network traffic flows through both the SSL
Visibility Appliance and the attached security appliance. A typical example of this
type of deployment would be an IPS attached to the SSL Visibility Appliance.
This mode of operation supports both SSL Inspection and SSL policy control.
In Passive-Inline mode (Figure 2-2), network traffic flows through the SSL
Visibility Appliance only, a copy of the network traffic (some of which may be
decrypted) is sent to the attached security appliance. A typical example of this
type of deployment would be an IDS or Forensic appliance attached to the SSL
Visibility Appliance. This mode of operation supports both SSL Inspection and
SSL policy control.

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
11
Figure 2–2 Passive-Inline Configuration
In Passive-Tap mode (Figure 2-3), network traffic does not flow through the
SSL
Visibility Appliance or the attached security appliance. The SSL Visibility
Appliance receives a copy of traffic in the network from a TAP device and this
traffic (possibly decrypted) is sent to the attached security appliance. A typical
example of this type of deployment would be an IDS or Forensic appliance
attached to the SSL Visibility Appliance, which is in turn attached to a TAP or
SPAN port. This mode of operation supports SSL Inspection only and cannot act
as an SSL policy control point.

SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
12
Figure 2–3 Passive-Tap Configuration
By allowing the attached security appliance to view a decrypted version of SSL/
TLS traffic, the SSL Visibility Appliance enables the security appliance to detect/
block threats that are hidden within encrypted SSL/TLS flows. As the percentage
of SSL/TLS traffic in networks is growing significantly with increasing use of Web
2.1 applications and Cloud based applications, it is increasingly important that
network security appliances can do their job even when the traffic is sent over
SSL/TLS connections.
Detecting, intercepting, decrypting and re-encrypting SSL/TLS traffic is a
complex and computationally intense activity. Providing SSL/TLS inspection
capabilities in a device that can be placed in-line in either a Gigabit Ethernet or 10
Gigabit Ethernet network link and which will not cause a performance bottleneck
requires hardware acceleration. In the case of the SSL Visibility Appliance this
acceleration is provided by a Netronome Network Flow Engine (NFE) card that
contains one of Netronome’s NFP-3240 flow processor chips. The NFP-3240
contains 40 cores optimized for processing network traffic and provides
significant acceleration and offloads for the standard CPUs used on the SV1800-
C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B motherboards.
The SSL Visibility Appliance software provides the ability to inspect both
incoming and outgoing SSL/TLS traffic and detects SSL/TLS traffic by deep
packet inspection (DPI) so no matter what port the SSL/TLS traffic is using it will
be detected. Once an SSL/ TLS flow has been detected the SSL Visibility
Appliance policy engine determines what to do with the flow:
• it can be inspected providing a decrypted version to the attached
appliance(s)

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
13
• it can be cut through, allowing the attached appliance(s) to see the original
encrypted flow
• it can be blocked such that the flow is terminated and cannot continue.
The policy engine allows policy to be based on a wide range of parameters such
as:
• the source/destination IP address of the flow
• the Distinguished Name (DN) of the subject or issuer contained in the
SSL/TLS server certificate sent by the server
• the cipher suite being used for the flow
This allows for fine grained control over which SSL/TLS traffic is inspected, and,
when the SSL Visibility Appliance is deployed in-line, enables fine grained policy
control over what SSL/TLS traffic is allowed in the network.
All SSL/TLS traffic seen by the SSL Visibility Appliance, whether it is using
approved or non- approved algorithms will be processed to a degree. At a
minimum the SSL/TLS handshake will be observed in order to collect
information that the policy engine will use to determine how the flow should be
handled. Using the policy rules it is possible to cause the following actions to be
applied to a flow:
• block the SSL/TLS flow
• allow the SSL/TLS flow without any inspection
• allow the SSL/TLS flow with the flow being inspected
The policy engine is aware of the cipher suite that the SSL/TLS flow is using, and
can base its decision on that. So, it is possible to configure policy settings that will
prevent any SSL/TLS flows using non-approved algorithms from being
established through the SSL Visibility Appliance if that is desired. If SSL/TLS
flows using non-approved algorithms are allowed by the policy engine then they
should be considered as being “clear text” due to the use of non-approved
algorithms.
2.2 ModuleSpecification
The hardware version numbers in the tables below provides a mapping between
the hardware versions and the appliance types available. All appliance types, for
a given model, have the exact same hardware and firmware, and are exactly the
same from a cryptographic functionality and boundary perspective.
Table2–2SV2800/2800B Appliance Configurations
Appliance Model
ApplianceType
HardwareVersion
SV2800
HardwareAppliance
090-03063
SV2800
Try-and-Buy
Appliance
080-03562
SV2800
Cold Standby
Appliance
080-03678
SV2800B
HardwareAppliance
090-03549

SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
14
Appliance Model
ApplianceType
HardwareVersion
SV2800B
Try-and-Buy
Appliance
080-03781
SV2800B
Cold Standby
Appliance
080-03786
Table2–2.1 SV1800-C/SV1800B-C Appliance Configurations
Appliance Model
ApplianceType
HardwareVersion
SV1800-C
HardwareAppliance
090-03061
SV1800-C
Try-and-Buy
Appliance
080-03560
SV1800-C
Cold Standby
Appliance
080-03676
SV1800B-C
HardwareAppliance
090-03547
SV1800B-C
Try-and-Buy
Appliance
080-03779
SV1800B-C
Cold Standby
Appliance
080-03784
Table2–2.2 SV1800-F/SV1800B-F Appliance Configurations
Appliance Model
ApplianceType
HardwareVersion
SV1800-F
HardwareAppliance
090-03062
SV1800-F
Try-and-Buy
Appliance
080-03561
SV1800-F
Cold Standby
Appliance
080-03677
SV1800B-F
HardwareAppliance
090-03548
SV1800B-F
Try-and-Buy
Appliance
080-03780
SV1800B-F
Cold Standby
Appliance
080-03785
The Crypto Officer and User services of the module are identical for both
appliance types. A Try-And-Buy appliance varies from the Hardware Appliance
only in that the license that is provided with the appliance is valid for 60 days,
after which the full license must be purchased or the hardware appliance must be
returned to Symantec. A Cold Standby appliance varies only in there is no valid
license. For the Cold Standby to become active, a license must be acquired to
convert the Cold Standby to an active Hardware Appliance. For each appliance
model, the hardware is the same for all appliance types. The Crypto Officer and
User services of the module are identical for all appliance types.

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
15
The SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B are high
performance transparent SSL/TLS proxies that can be deployed in Gigabit
Ethernet networks, and the SV2800 and SV2800B can also be deployed in 10G Ethernet
networks. The SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B are
1U high rack mountable devices.
The SV2800/SV2800B have three front facing modular I/O bays that allow for
flexibility in the number of network interfaces and in the type of media
supported. Network I/O Modules (Netmods) are installed in the three bays to
configure the desired combination of interfaces.
All of the Netmod interfaces and the switching module that plug into the front of
the SV2800/SV2800B connect to the network segments on which traffic is being
monitored/inspected. These ports are only used to access the network data that is
being processed by the SV2800/SV2800B; they are not associated with any
cryptographic processes, keys, critical security parameters (CSP) or any FIPS
relevant data.
These ports do not allow access to the management services of the
SV2800/SV2800B and cannot be used to input or output cryptographic keys,
CSPs or any FIPS relevant data. The Netmods and associated switch are
therefore deemed to be outside the logical cryptographic boundary.
Figure 2-4.1 shows an SV2800/SV2800B device with three Netmods installed while
figure 2-4.2 shows an SV2800/SV2800B device without any Netmods installed. In
this example, the Netmods each support 4 x 1Gig copper interfaces. Available
Netmod options are listed below, other Netmod types may become available in
the future:
• 4 x GigE copper (4 ports of 10/100/1000Base-T with FTW)
• 4 x GigE fiber (4 ports of 1000Base-SX with FTW)
• 2 x 10Gig fiber (2 ports of 10GBase-SR with FTW)
• 2 x 10Gig fiber (2 ports of 10GBase-LR with FTW)
Fail to wire (FTW) hardware allows pairs of network ports to be physically
connected to each other in the event that the system is powered off or that a
failure is detected. Depending on how the network is connected to the SV2800,
this allows network traffic to continue flowing even when the system is powered
off or in a failure state. When FTW is active, traffic is passed between ports on a
Netmod and never enters the module.
Note: Netmods are NOT hot swappable. The system must be powered
off before removal or installation of Netmods.
Figure 2–4.1 SV2800/SV2800B, Front View with Netmods Installed
Figure 2-4.2 shows the SV2800/SV2800B with all Netmods removed.

SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
16
Figure 2–4.2 SV2800/SV2800B Front view with Netmods Removed
Figure 2-5.1 and Figure 2-5.2 shows the front of the SV1800-F/SV1800B-F and
SV1800-C/SV1800B-C devices
Figure 2–5.1 SV1800-C/SV1800B-C Front View
Figure 2–5.2 SV1800-F/SV1800B-F Front View
From left to right, the front panel includes an LCD display, keypad, status LEDs,
NMI button, reset button, ID button, power button and a USB connector.
Figure 2-6 shows the SV2800/SV2800B front panel display area in detail. Note that
this unit has a 4 x GigE fiber Netmod installed in the right hand bay.
Figure 2–6 SV2800 Front Panel Controls and Display
Figure 2-6.1 shows the SV1800-C, SV1800B-C, SV1800-F, and SV1800B-F front panel
display area in detail.
Figure 2–6.1 SV1800-C, SV1800B-C, SV1800-F, and SV1800B-F Front Panel Controls and
Display
The combination of Netmods installed in an SV2800/SV2800B is not important for

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
17
FIPS 140-2 validation as the Netmods are all outside of the logical cryptographic
boundary (see "2.3 Module Interfaces" on page 20).
The back of the SV2800 is shown in Figure 2-7 and has the following elements
going from left to right:
• Serial port (RJ45 connector)
• VGA display connector
• 2 sets of 2 x USB 2.0 ports
• 2 x GigE ports each with two built in LEDs –port 1 is used for
management, port 2 is unused
• 2 x hot swappable power supply bays
Figure 2–7 SV2800 Back Panel
The back of the SV2800B differs slightly (serial port location only) from the
SV2800 and is shown in Figure 2-7.1 and has the following elements going from
left to right:
• VGA display connector
• 2 x USB 2.0 and 2 x USB 3.0 ports
• 2 x GigE ports each with two built in LEDs –port 1 is used for
management, port 2 is unused
• Serial port (RJ45 connector)
• 2 x hot swappable power supply bays
Figure 2–7.1 SV2800B Back Panel
The back of the SV1800-C, SV1800B-C, SV1800-F and SV1800B-F is shown in
Figure 2-7.2 and has the following elements going from left to right:
• 2 x GigE ports each with two built in LEDs –port 1 is used for
management, port 2 is unused
• 1 sets of 2 x USB 2.0 ports
• VGA display connector
• Serial port
• 2 x hot swappable power supply bays

SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
18
Figure 2–7.2 SV1800-C, SV1800B-C, SV1800-F and SV1800B-F Back Panel
Covers on the upper surface of the SV1800-C, SV1800B-C, SV1800-F,
SV1800B-F, SV2800, and SV2800B can be removed to gain access to the
interior of the unit. These covers should not be removed by end users, and
may require removal by trained field engineers when maintaining a system.
These covers need to be sealed with tamper evident labels when operating
in FIPS 140-2 mode. Figures 2-8, 2-8.1, and 2-8.2
Figure 2–8 SV2800 and SV2800B Front/Top, Top Cover Placed
Figure 2–8.1 SV1800-C and SV1800B-C Front/Top, Top Cover Placed
Figure 2–8.2 SV1800-F and SV1800B-F Front/Top, Top Cover Placed
Section "3.2 Tamper Evident Label Management and Application Instructions"
provides guidance on how and where tamper evident labels need to be applied to
the SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B.

2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
19
For FIPS 140-2 Level 2 validation the SV2800 was tested with the following
configuration:
• SV2800 chassis with 1 x NFE acceleration card installed
• 2 x Intel 5620 quad core CPUs and 24GB of memory
This configuration is Symantec model number SV2800.
For FIPS 140-2 Level 2 validation the SV2800B was tested with the following
configuration:
• SV2800B chassis with 1 x NFE acceleration card installed
• 1 x Intel E5-2618L V3 octa-core CPUs and 32GB of memory
This configuration is Symantec model number SV2800B.
For FIPS 140-2 Level 2 validation the SV1800-C and SV1800-F were tested with
the following configurations:
• SV1800 chassis with 1 x NFE acceleration card installed
• 1 x Intel 3450 quad core CPU and 16GB of memory
These configurations are Symantec model numbers SV1800-C and SV1800-F.
For FIPS 140-2 Level 2 validation the SV1800B-C and SV1800B-F were tested
with the following configurations:
• SV1800B chassis with 1 x NFE acceleration card installed
• 1 x Intel E3 1225 V3 quad core CPU and 16GB of memory
These configurations are Symantec model numbers SV1800B-C and SV1800B-F.
The SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B are multi-
chip standalone modules that meet overall FIPS 140-2 Level 2 requirements. The
modules are validated to the following FIPS 140-2 section levels:
Table2–3Security Levels Per FIPS 140-2 Section
FIPS 140-2 Section
Section Title
Validated Level
1
Cryptographic Module Specification
2
2
Cryptographic Module Ports and Interfaces
2
3
Roles, Services and Authentication
2
4
Finite State Model
2
5
Physical Security
2
6
Operational Environment
Not applicable
7
Cryptographic Key Management
2

SV1800-C, SV1800B-C, SV1800-F, SV1800B-F, SV2800, and SV2800B Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
20
8
Electromagnetic Interference /
ElectromagneticCompatibility
2
9
Self-Tests
2
10
Design Assurance
3
11
Mitigation of Other Attacks
Not applicable
2.3 ModuleInterfaces
The logical cryptographic boundary of each module is shown in the following
pictures and diagrams. All of the Netmod interfaces and the switching module
that plug into the front of the SV2800/SV2800B connect to the network segments
on which traffic is being monitored/inspected. These ports are only used to
access the network data that is being processed by the SV2800/SV2800B; they
do not allow access to the management services of the SV2800/SV2800B. The
Netmods and associated switch are therefore outside the logical cryptographic
boundary. Data input/output to the module from the Netmods and associated
switch is via two internal 10Gbps Ethernet connections carried over iPass
connectors/cables.
The two pluggable power supply units and the bays that they plug into are not
associated with any cryptographic processes, keys, critical security parameters
(CSP), or any FIPS relevant data, and are therefore deemed to be outside of the
cryptographic boundary.
Note: Netmods are NOT hot-swappable. Power off the system before you
remove or install Netmod.
Figure 2-10 shows the SV2800/SV2800B physical cryptographic boundary as a
yellow line with the module being everything contained within the yellow
boundary line. The physical boundary is defined by the exterior surfaces of the
appliance. Figures 2-10.1 and 2-10.2 show the cryptographic boundary for the
SV1800-C/SV1800B-C and SV1800-F/SV1800B-F, as the exterior surfaces of the
appliances.