(Cat2K/3K). This Operational User Guidance with Preparative Procedures addresses the administration of the TOE software and hardware and describes how to install, configure, and maintain the TOE in the Common Criteria evaluated configuration.



2013 Cisco Systems

1. Introduction

This Operational User Guidance with Preparative Procedures documents the administration of the Cisco Catalyst Switches (2960S, 2960C, 3560V2 and 3750V2)

(Cat2K/3K) TOE certified under Common Criteria. The TOE may be referenced below as the Cat2K/3K, TOE, or simply Catalyst Switch.

1.1 Audience

This document is written for administrators configuring the TOE, specifically the IOS software. This document assumes that you are familiar with the basic concepts and terminologies used in internetworking, understand your network topology and the protocols that the devices in your network can use, that you are a trusted individual, and that you are trained to use IOS software and the various operating systems on which you are running your network. For using the IOS command-line interface refer to [3] Using the Command-Line Interface and [4] Using the Command-Line Interface in the Cisco

IOS Software -> Using the CLI.

1.2 Purpose

This document is the Operational User Guidance with Preparative Procedures for the

Common Criteria evaluation. It was written to highlight the specific TOE configuration and administrator functions and interfaces that are necessary to configure and maintain the TOE in the evaluated configuration. The evaluated configuration is the configuration of the TOE that satisfies the requirements as defined in the Security Target (ST). This document covers all of the security functional requirements specified in the ST and as summarized in Section 3 of this document. This document does not mandate configuration settings for the features of the TOE that are outside the evaluation scope, such as information flow polices and access control, which should be set according to your organizational security policies.

This document is not meant to detail specific actions performed by the administrator but rather is a road map for identifying the appropriate locations within Cisco documentation to get the specific details for configuring and maintaining Cat2K/3K operations. It is recommended that you read all instructions in this document and any references before performing steps outlined and entering commands. Section 7 of this document provides information for obtaining assistance in using IOS.

1.3 Document References

This document makes reference to several Cisco Systems documents. The documents used are shown below. The various documents identified the functionality available on the product. The documents identify each function, such as configuring the VLANs and

ACLs to mediate the traffic and the administrator privilege level required to enter the commands and to configure the policies.

Link Reference number

[1]

Document Name

Release Notes for Catalyst (2960S, 2960C,

3560V2 and 3750V2) Switches, Cisco IOS

Release 15.0(2)SE4 http://www.cisco.com/en/US/pr od/collateral/iosswrel/ps8802/p s6969/ps5012/product_bulletin

Reference number

[2]

[3]

[4]

[5]

[6]

Document Name Link

Catalyst 2960S, and 2960C, 3560V2 and

3750V2Hardware Installation Guide

Cisco IOS Software Configuration Guide Cisco

IOS Release 15.0(1)SE1

Cisco IOS Security Configuration Guide:

Securing User Services, Release 15.0

Cisco IOS Network Management Configuration

Guide, Release 15.0

Catalyst 2960S, and 2960C, 3560V2 and

3750V2Software Configuration Guide, Release

_c25-

716485_ps10744_Products_Bul letin.html

– http://www.cisco.com/en/US/prod ucts/hw/switches/ps5023/prod_rele ase_notes_list.html

– http://www.cisco.com/en/US/prod ucts/hw/switches/ps5528/prod_rele ase_notes_list.html

– http://www.cisco.com/en/US/prod ucts/ps6406/prod_release_notes_lis t.html

http://www.cisco.com/en/US/d ocs/switches/lan/catalyst2960/h ardware/installation/guide/higo ver.html

http://www.cisco.com/en/US/d ocs/switches/lan/catalyst2960c_

3560c/hardware/installation/gui de/higtrouble.html

http://www.cisco.com/en/US/d ocs/switches/lan/catalyst3560/h ardware/installation/guide/hgsp ecs.html

http://www.cisco.com/en/US/d ocs/switches/lan/catalyst3750/h ardware/installation/guide/HIG

OVERV.html http://www.cisco.com/en/US/d ocs/switches/lan/catalyst3750x

_3560x/software/release/15.0_1

_se/configuration/guide/swcns.

html http://www.cisco.com/en/US/d ocs/ios/sec_user_services/confi guration/guide/15_0/sec_user_s ervices_15_0_book.pdf

http://www.cisco.com/en/US/d ocs/ios/netmgmt/configuration/ guide/15_0s/nm_15_0s_book.ht

ml http://www.cisco.com/en/US

/docs/switches/lan/catalyst29

Reference number

[7]

[8]

[9]

[10]

[11]

[12]

Document Name Link

15.0(1)SE

60/software/release/15.0_1_s

e/configuration/guide/2960_ scg.pdf

Cisco IOS Security Command Reference A to Z http://www.cisco.com/en/US/d ocs/ios-xml/ios/security/a1/seca1-cr-book.html

( http://www.cisco.com/en/US/d ocs/ios-xml/ios/security/d1/secd1-cr-book.html

http://www.cisco.com/en/US/d ocs/iosxml/ios/security/m1/sec-m1-crbook.html

http://www.cisco.com/en/US/d ocs/ios-xml/ios/security/s1/secs1-cr-book.html

http://csrc.nist.gov/groups/STM

/cmvp/documents/140-

1/1401val2013.htm#1940

Cisco Catalyst 2960S, and 2960C, 3560V2 and

3750V2Switches

FIPS Certificate 1940/IOS Common

Cryptographic Module (IC2M)

(Firmware Versions: Rel 1(1.0.0), Rel 1(1.0.1) and Rel 1(1.0.2))

FIPS 140-2 Level 2

Non-Proprietary Security Policy

Cisco IOS IP Routing Protocols Configuration

Guides (multiple documents for supported routing protocols)

Internet Key Exchange for IPsec VPNs

Configuration Guide, Cisco IOS Release 15.0SY

Cisco IOS Configuration Fundamentals

Command Reference

Loading and Managing System Images

Configuration Guide, Cisco IOS Release

15S http://www.cisco.com/en/US/pr oducts/ps11845/products_instal lation_and_configuration_guide s_list.html

http://www.cisco.com/en/US/d ocs/iosxml/ios/sec_conn_ikevpn/confi guration/15-0sy/sec-ike-foripsec-vpns-15-0sy-book.html

http://www.cisco.com/en/US/d ocs/iosxml/ios/fundamentals/comman d/show_protocols_through_sho wmon.html http://www.cisco.com/en/US/d ocs/ios-xml/ios/sys-imagemgmt/configuration/15s/sysimgmgmt-15-s-book.pdf

1.4 Supported Hardware and Software

Only the following hardware and software listed below is compliant with the Common

Criteria Catalyst Cat2K/3K Switch NDPP evaluation. Using hardware not specified

invalidates the secure configuration. Likewise, using any software version other than the evaluated software listed below will invalidate the secure configuration.

1.4.1 Supported Configurations

Cisco Catalyst Switches (2960S, and 2960C, 3560V2 and 3750V2) running IOS

15.0(2)SE4. Each Switch is running the same version of the IOS 15.0(2)SE4 (FIPS

Validated) software which enforces the security functions being claimed regardless of the model.

The Cisco Catalyst 2960S are fixed-configuration switches offering Fast Ethernet and

Gigabit Ethernet connectivity LAN services for mid-market and branch office networks.

There primary features are:



Standalone fixed-configuration switches



Layer 2 switching with intelligent Layer 2 – 4 services



Fast Ethernet and Gigabit Ethernet connectivity



Up to 48 10/100 ports or 10/100/1000 ports



AC power supply failure protection with external power supply



Compact Fast Ethernet and Gigabit



Ethernet switches with no fan

They also offer Cisco FlexStack stacking with a hot-swappable module. The Cisco

FlexStack provides a unified data plane, unified configuration, and single IP address management for a group of switches.

The Cisco Catalyst 2960C Series are small-factor; fixed configuration switches offering

Fast Ethernet and Gigabit Ethernet connectivity for extending Cisco Catalyst wired switching infrastructure and wireless LAN networks. The main features are:



Fixed-configuration switches.



Layer 2 switching with intelligent Layer 2 – 4 services for voice, video and wireless LAN services.



Fast Ethernet and Gigabit Ethernet connectivity.



Power over Ethernet (PoE) pass-through enables the compact switch to draw power from the wiring closet and pass it to end devices (selected models)



Fanless operation.

The Cisco Catalyst 3560V2 and 3750V2 are energy-efficient Layer-3 fast Ethernet switches that are mainly used in enterprise, retail and branch-office environments. Some of the primary features of these switches are:



Lower power consumption than its predecessors



EnergyWise support to monitor energy consumption of network infrastructure and implement energy saving programs to reduce energy costs



Open Shortest path First (OSPF) routing with IP Base feature set



Compatible with Cisco Redundant Power System (RPS) 2300



Uniform depth of 11.9 inches on all units for better cable management



IPv6 routing included in the IP Services feature set

Cisco IOS is a Cisco-developed highly configurable proprietary operating system that provides for efficient and effective routing and switching.

For detailed information about Software Activation, visit http://www.cisco.com/go/sa.

1.5 Operational Environment

1.5.1 Required software for the operational environment

Component

Management

Workstation

Usage/Purpose Description for TOE performance

This includes any IT Environment Management workstation that is used by the TOE administrator to support TOE administration through protected channels (e.g. IPsec).

Audit (syslog)

Server

AAA Server

The syslog audit server is used for remote storage of audit records that have been generated by and transmitted from the TOE. The syslog server will need to act as an IPsec endpoint or the use if IPsec client software such as strongSwan (free VPN software, works with Linux http://www.strongswan.org/) where there would be a direct connection from the TOE to the syslog/AAA servers. Other software [free] to consider includes: n2n, Openswan, OpenVPN, Social VPN, tcpcrypt, tinc and Cloudvpn.

This includes any authentication server (RADIUS RFC 2865, 2866,

2869 and RFC 3162 (IPv6) and TACACS+ RFC 1492)) that can be leveraged for remote user authentication. The AAA server will need to act as an IPsec endpoint or the use if IPsec client software such as strongSwan (free VPN software, works with Linux http://www.strongswan.org/) where there would be a direct connection from the TOE to the syslog/AAA servers. Other software [free] to consider includes: n2n, Openswan, OpenVPN, Social VPN, tcpcrypt, tinc and Cloudvpn.

1.5.2 Optional software for the operational environment:

Component

NTP Server

Usage/Purpose Description for TOE performance

The TOE supports communications with an NTP server to synchronize time.

1.6 Excluded Functionality

Excluded

Functionality

HTTP for management purposes.

Exclusion Rationale

HTTP Server for web user interface management sends authentication data in the clear and does not enforce the required privilege levels. This feature is enabled by default. The HTTP Server needs to be disabled and should not be configured for use. Not including this feature does not

Excluded

Functionality

IEEE 802.11

Wireless

Standards

SNMP for management purposes

Telnet for management purposes.

VPN

TrustSec

Smart Install

Exclusion Rationale

interfere with the management of TOE as defined in the Security Target.

For example:

Command Purpose

Step 1 - enable

Router>enable

En ables privileged EXEC mode.

Enter your password if prompted.

Step 2 - configure terminal

Router# configure terminal Enters global configuration mode.

Step 3 - no ip http server Disables the HTTP server on the router.

Router# no ip http server

The IEEE 802.11 Wireless Standards of Catalyst Switches requires additional hardware beyond what is included in the evaluated configuration

SNMP does not enforce the required role privilege levels. This feature is disabled by default and cannot be configured for use in the evaluated configuration. Including this feature would not meet the security policies as defined in the Security Target. The exclusion of this feature has no effect on the operation of the TOE.

Telnet sends authentication data in the clear. This feature is enabled by default and must be disabled in the evaluated configuration. Including this feature would not meet the security policies as defined in the Security

Target. The exclusion of this feature has no effect on the operation of the

TOE.

VPN requires additional licenses beyond what is included in the evaluated configuration.

TrustSec - is only relevant to this ST to a limited degree, for RADIUS

KeyWrap, which is being represented with other cryptographic methods, such as AES and IPSec. This feature is disabled by default and should remain disabled in the evaluated configuration. Not including this feature does not interfere with the enforcement of the security policies as defined in the Security Target.

Smart Install is a feature to configure IOS Software and switch configuration without user intervention. The Smart Install uses dynamic

IP address allocation to facilitate installation providing transparent network plug and play. This feature is available by default and must be disabled as it could result in settings/configurations that may interfere with the enforcement of the security policies as defined in the Security

Target.

The commands to disable Smart Install can be found in section 3.6.1of

this document.

2. Secure Acceptance of the TOE

In order to ensure the correct TOE is received, the TOE should be examined to ensure that that is has not been tampered with during delivery.

Verify that the TOE software and hardware were not tampered with during delivery by performing the following actions:

Step 1 Before unpacking the TOE, inspect the physical packaging the equipment was delivered in. Verify that the external cardboard packing is printed with the Cisco Systems logo and motifs. If it is not, contact the supplier of the equipment (Cisco Systems or an authorized Cisco distributor/partner).

Step 2 Verify that the packaging has not obviously been opened and resealed by examining the tape that seals the package. If the package appears to have been resealed, contact the supplier of the equipment (Cisco Systems or an authorized Cisco distributor/partner).

Step 3 Verify that the box has a white tamper-resistant, tamper-evident Cisco Systems bar coded label applied to the external cardboard box. If it does not, contact the supplier of the equipment (Cisco Systems or an authorized Cisco distributor/partner). This label will include the Cisco product number, serial number, and other information regarding the contents of the box.

Step 4 Note the serial number of the TOE on the shipping documentation. The serial number displayed on the white label affixed to the outer box will be that of the device.

Verify the serial number on the shipping documentation matches the serial number on the separately mailed invoice for the equipment. If it does not, contact the supplier of the equipment (Cisco Systems or an authorized Cisco distributor/partner).

Step 5 Verify that the box was indeed shipped from the expected supplier of the equipment (Cisco Systems or an authorized Cisco distributor/partner). This can be done by verifying with the supplier that they shipped the box with the courier company that delivered the box and that the consignment note number for the shipment matches that used on the delivery. Also verify that the serial numbers of the items shipped match the serial numbers of the items delivered. This verification should be performed by some mechanism that was not involved in the actual equipment delivery, for example, phone/FAX or other online tracking service.

Step 6 Once the TOE is unpacked, inspect the unit. Verify that the serial number displayed on the unit itself matches the serial number on the shipping documentation and the invoice. If it does not, contact the supplier of the equipment (Cisco Systems or an authorized Cisco distributor/partner). Also verify that the unit has the following external identification:

Table 1: Evaluated Products and their External Identification

Product Name

Cisco Catalyst 2960S

Cisco Catalyst 2960C

External Identification

Catalyst 2960S

Catalyst 2960C

Product Name

Cisco Catalyst 3560V2

Cisco Catalyst 3750V2

External Identification

Catalyst 3560V2

Catalyst 3750V2

Step 7 Approved methods for obtaining a Common Criteria evaluated software images:



Download the Common Criteria evaluated software image file from

Cisco.com onto a trusted computer system. The reason to download to a trusted system within your organization, such as the management workstation, is to ensure the file has not been tampered with prior to securely copying to to the TOE for installation.



Software images are available from Cisco.com at the following: http://www.cisco.com/cisco/web/download/index.html.



The TOE ships with the software images installed, however this may not be the evaluated version.

Step 8 Once the file is downloaded, verify that it was not tampered with by using an

MD5 utility to compute an MD5 hash for the downloaded file and comparing this with

the MD5 hash for the image listed in Table 2: Evaluated Software Images below. Refer to

Part 8 Loading and Maintaining System Images  MD5 File Validation [4] Image

Verification. If the MD5 hashes do not match, contact Cisco Technical Assistance

Center (TAC) http://tools.cisco.com/ServiceRequestTool/create/launch.do

As noted in [4] you may choose to not use MD5 digest verification because it is 128-bits long and the verification itself is manual; such as running a MD5 utility of your choice to compute the MD5 hash for the downloaded image file and then comparing the results against the image MD5 hash listed below. Therefore you can follow the steps to verify the image following Image Verification  Information About Image Verification 

How To Use Image Verification [4]. It is recommended using the verification method, as these steps are performed on the TOE, after the file has been verified (MD5) and copied.

Step 9 Copy (via tftp) the downloaded and verified software image from the trusted system as described in [12].

Once the file has been copied, it is recommended that you read and familiarize yourself with the Part 2: Configuration Using Setup and Autoinstall  Overview – Basic

Configuration of a Cisco Networking Device before proceeding with the install [12].

You may also want to familiarize yourself with [11] basic commands and [6] fundamental Cat3K and IOS concepts before proceeding with the installation and configuration of the TOE.

To Install and configure your Cat2K/3K switch follow the instructions as described in [3]

Overview, then following Using the Command-Line Interface and then follow

Configuring Cisco IOS Configuration Engine, Assigning the Switch IP Address and

Default Gateway and Administering the Switch.

Start your Cat2K/3K switch as described in [3]. Confirm that your Cat2K/3K switch loads the image correctly, completes internal self-checks and displays the cryptographic export warning on the console.

Step 10 The end-user must confirm once the TOE has booted that they are indeed running the evaluated version. Use the “show version” command [11] show protocols through showmon to display the currently running system image filename and the system software release version. See below for the detailed hash value that must be checked to ensure the software has not been modified in anyway. It is also recommended the license level be verified and activated as described in [1]. It is assumed the end-user has acquired a permanent license is valid for the lifetime of the system on which it is installed.

Table 2: Evaluated Software Images

Software

Version

IOS

15.0(2)SE4

Image Name

[model identifier]-universalk9mz.150-2.SE4.bin; the ‘k9’ version is the FIPS validated version

MD5 hash

On CCO (Cisco download) hover over the MD5 hash for the model acquired, then follow the steps above to verify the hash

When updates, including psirts (bug fixes) to the evaluated imagine are posted, customers are notified that updates are available (if they have purchased continuing support), information provided how to download updates and how to verify the updates is the same as described above.

3. Secure Installation and Configuration

3.1 Physical Installation

Follow the Catalyst 2960S, 2960C, 3560V2 and 3750V2) (Cat2K/3K) Hardware

Installation Guide [2] for preparation of the physical site, and hardware installation.

3.2 Initial Setup via Direct Console Connection

The 2960S, 2960C, 3560V2 and 3750V2) (Cat2K/3K) must be given basic configuration via console connection prior to being connected to any network.

3.2.1 Options to be chosen during the initial setup of the

Cat2K/3K Switch

When you run the “setup” command, or after initially turning on the switch you are free to choose answers that fit your policies with the exception of the following values [3].

It should be noted the person that initial installs the TOE is considered the privileged administrator and has been granted access to all commands on the TOE (privilege level

15). The privilege levels are not necessarily hierarchical. Privilege levels 0 and 1 are defined by default, while levels 2-14 are undefined by default. Levels 0-14 can be set to include any of the commands available to the level 15 administrators, and are considered the semi-privileged administrator.

The privilege level determines the functions the user can perform; hence the authorized administrator with the appropriate privileges. Furthermore, all users of the TOE are considered administrators and that the number of administrators created and their various levels of access are based on organizational requirements and policies.

Refer to the IOS Command Reference Guide for available commands, associated roles and privilege levels [3] [4] [7] [11].

1 – Enable Secret – Must adhere to the password complexity requirements. Note that this setting can be confirmed after “setup” is complete by examining the configuration file for

“enable secret 5 …” in Cisco IOS Security Command Reference: Commands D to L -> select E -> select enable secret ->[7]

2 – Enable Password - Must adhere to the password complexity requirements. Note that this must be set to something different than the enable secret during “setup”, however after setup this will not be used within the evaluated configuration. In Cisco IOS Security

Command Reference: Commands D to L -> select E -> select enable password [7]

3 – Virtual Terminal Password - Must adhere to the password complexity requirements.

Note that securing the virtual terminal (or vty) lines with a password in the evaluated configuration is suggested. This password allows access to the device through only the console port. Later in this guide steps will be given to allow ssh into the vty lines.

Reference password (line configuration) In Cisco IOS Security Command Reference:

Commands M to R -> select pac key through port-misuse -> select password (line configuration) [7]

4 – Configure SNMP Network Management – NO (this is the default). Note that this setting can be confirmed after “setup” is complete by examining the configuration file to ensure that there is no “snmp-server” entry. To ensure there is no snmp server agent running, use the “no snmp-server’ command as described in [6] select Configuring

SNMP. Note, in the evaluated configuration, SNMP should remain disabled,

3.2.2 Saving Configuration

IOS uses both a running configuration and a starting configuration. Configuration changes affect the running configuration, in order to save that configuration the running configuration (held in memory) must be copied to the startup configuration. Reference

Working with the Cisco IOS File System, Configuration Files, and Software Images [3].

This may also be achieved by either using the write memory command [11] test cablediagnostics through xmodem or the copy system:running-config nvram:startup-config command in [4] Using the Command-Line Interface in Cisco IOS Software ->Saving

Changes to a Configuration. These commands should be used frequently when making changes to the configuration of the Switch. If the Switch reboots and resumes operation when uncommitted changes have been made, these changes will be lost and the Switch will revert to the last configuration saved. To see the current configuration, use the show

running-config command in [7] Cisco IOS Security Commands Reference: Commands S to Z -> show parameter-map type consent through show users -> show running-config.

3.3 Secure Remote Management

The TOE provides SSH-protected communications through an IPsec tunnel for remote management sessions.

The Initial TOE Configuration section, step 7, above includes the base configuration for the evaluated TOE. This configuration enables SSH management on the TOE, crypto

key generate rsa in [7] Commands A to C -> crypto isakmp aggressive-mode disable -> crypto key generate rsa, and ip ssh version 2 in [7] Commands D to L -> ip source-track through ivrf -> ip ssh version commands, and restricts remote access with the line

console (or vty) 0 10 and transport input ssh commands. Note that these settings are not to be changed, although the crypto key generate rsa command can be used to generate new rsa keys of 3072 bits or larger [3], [6], [7].

For additional information on configuring SSH see the applicable sections in [3], [6], [7].

3.3.1 FIPS Mode

To be in the evaluated configuration, the TOE must be in the FIPS approved mode of operation. To set the secure operation and apply the opacity shields, refer to the Secure

Operation section of [8].

The Common Criteria certification evaluated the following cryptographic functionality, all of which must be configured as described in this guide:



SSHv2 must be used instead of SSHv1 with minimum RSA modulus sizes as described in this document. Note, the Common Criteria certification did not evaluate SSH functionality.



IPsec must be used to secure connections to remote syslog (audit) server, AAA servers, and may be used to secure other traffic that originates from the TOE

(Cat2K/3K), or terminates at the TOE (Cat2K/3K) such as remote administration and NTP syncronization, but the evaluated configuration does not require using

IPsec to secure traffic flows through the TOE (Cat2K/3K). o IKEv1 and IKEv2 may be used, but must be configured as described in this document. However only IKEv1 was evaluated and tested in the evaluated configuration. o ESP must be used as described in this document.

The Common Criteria certification did not evaluate any of the following cryptographic functionality:



MD5 may be used, such as in authentication of routing protocols.



RADIUS and TACACS+ may be used, but only when tunneled in IPsec.



AH may be used in IPsec, but use of ESP is mandatory.



Any other cryptographic functions not listed above as evaluated.

3.4 Administration of Cryptographic Self-Tests

The TOE provides self-tests consistent with the FIPS 140-2 requirements. These self-test for the cryptographic functions in the TOE are run automatically during power-on as part of the POST. These self-test include the following:

Power-on Self-Tests:



Route Processor o Known Answer Tests: AES KAT, SHS KAT, HMAC KAT, Triple-DES,

RNG KAT, RSA KAT o Firmware Integrity Test



Embedded Services Processor o Known Answer Tests: AES KAT, SHS KAT, HMAC KAT, Triple-DES,

RNG KAT, RSA KAT o Firmware Integrity Test

Conditional Self-Tests:



Route Processor o Continuous Random Number Generator test for the FIPS-approved RNG o Continuous Random Number Generator test for the non-approved RNG o Pair-Wise Consistency Test o Conditional Bypass Test



Embedded Services Processor

o Continuous Random Number Generator test for the FIPS-approved RNG o Continuous Random Number Generator test for the non-approved RNG o Conditional Bypass Test

The TOE provides the ability to invoke Cryptographic Self-Tests on-demand.



This functionality is available to the privileged administrator or a semiprivileged administrator with a specific privilege level.



This functionality is facilitated using the test crypto self-test command

The command is test crypto self-test as described in [7] Commands S to Z -> tacacsserver administration through title-color -> test crypto self-test. Additional information regarding Administration of Cryptographic Self-Tests review can be found in Self-Test section of [8].

3.5 Administration of Non-Cryptographic Self-Tests

The TOE provides self-tests to verify the correct image is running on the TOE. This functionality is available to all administrators and can be executed on demand by reloading the TOE via the reload /verify command and observing the following output:

Calculating SHA-1 hash...done validate_package: SHA-1 hash:

calculated [hash value]

expected [same hash value as above]

Image validated

This functionality cannot be disabled by any administrator [4] Using the Command-Line

Interface in Cisco IOS Software ->CLI Command Modes.

The privileged administrator can also run the show diagnostic command to display the online diagnostic test results and the supported test suites [6] Configuring Online

Diagnostics.

3.5.1 Access Control and Lockout

The Cat2K/3K must be configured to use a username and password for each administrator and one password for the enable command. Ensure all passwords are stored encrypted by using the following command [7]:

Commands S to Z -> sa ipsec through sessions maximum ->service password-encryption:

service password-encryption

When creating administrator accounts, all individual accounts are to be set to a privilege level of one. This is done by using the following commands:

Commands S to Z -> traffic-export through zone security -> username (with parameters listed below)

username <name> password <password>

to create a new username and password combination, and

username <name> privilege 1

to set the privilege level of <name> to 1.

Also note to prevent administrators from choosing insecure passwords, each password must be at least 15 characters long. Use the following command to set the minimum length to 15 or greater.

Switch (config)#security passwords min-length length [7] Cisco IOS Security

Commands Reference: Commands S to Z -> sa ipsec through sessions maximum -

> security passwords min-length

To ensure the passwords meet the complexity requirements for a secure password, refer to Section 4.2 Passwords in this document.

To ensure the plain text password is securely stored, use the password encryption aes command [7] Cisco IOS Security Commands Reference: Commands M to R -> password encryption aes

Note, read the command description before entering the command for its understanding and the related password/master key usage.

Administrator account access is to be restricted to a specified number of authentication attempts before the administrator account in question is locked out. The account then requires unlocking by an authorized administrator before it can be used again. The evaluated configuration requires that the lockout occurs after a specified threshold for unsuccessful authentication attempts. Use the following command, with ‘<x>’ being the required number of attempts before lockout, to set the authentication failure threshold

(the authentication threshold must be non zero):

Commands A to C -> aaa accounting -> aaa local authentication attempts max-fail (with parameters listed below)

aaa local authentication attempts max-fail <x>

A locked user account may be unlocked by a privileged administrator by using the following command:

Commands A to C -> ca trust-point -> clear aaa local user lockout (with parameters listed below)

clear aaa local user lockout <username>

3.6 Network Protocols and Cryptographic Settings

The switch provides secure transmission when TSF data is transmitted between separate parts of the TOE. All TOE administration must be performed through an IPsec tunnel.

However, it is recommended that the interactive interface be over SSHv2. The following method is used to configure SSHv2 for use in a secure manner.

The switch also supports the use of a remote AAA server (RADIUS and TACACS+), provided by the environment that is used as the enforcement point for identifying and authenticating users, including login and password dialog, challenge and response, and

messaging support. Encryption of the packet body is provided through the use of

RADIUS (note RADIUS only encrypts the password within the packet body), while

TACACS+ encrypts the entire packet body except the header). This AAA server should be on an internal protected network, such as a network isolated behind a VPN gateway, through which the Cat2K/3K can reach the AAA server using an IPsec tunnel.

The switch provides the capability to support the following routing protocols BGPv4,

EIGRP, EIGRPv6 for IPv6, PIM-SMv2, and OSPFv2, OSPFv3 for IPv6 and RIPv2. The routing protocols, BGPv4, EIGRP, EIGRPv6 for IPv6, PIM-SMv2, and OSPFv2,

OSPFv3 for IPv6 supports routing updates with IPv4 or IPv6, while RIPv2 routing protocol support routing updates for IPv4 only.

3.6.1 Remote Administration Protocols

To only allow SSHv2 for remote administrator sessions, use the transport input ssh command. This command disables telnet by only allowing ssh connections for remote administrator access. For Common Criteria compliance an IPsec session must be established either peer to peer or IPsec client to the switch for the SSHv2 session to go over. Section 3.6.4 provides an example peer to peer IPsec configuration steps.



Telnet for management purposes is disabled by default and must remain disabled in the evaluated configuration.



SSHv2 must be used. To enable sshv2, use the “ip ssh version 2” command

[7] Commands D to L -> ip source-track through ivrf -> ip ssh version. Note before SSH is configured, the rsa keys need to be generated for the SSH server using the following command, with an RSA key size of 2048 bits.

crypto key generate rsa [7] Commands A to C -> crypto isakmp aggressivemode disable -> crypto key generate



When configured to use SSHv2, the following two encryption options are available for use in IOS, and all are permitted in the evaluated configuration: aes128-cbc, aes256-cbc. IOS does not provide an option to restricting which algorithm is negotiated for inbound SSHv2 connections, though the following command option can be used to select which algorithm(s) to use for SSHv2 connections outbound from IOS

[7]

ssh -v 2 -c {aes128-cbc | aes256-cbc} –m {hmac-sha1}

Commands S to Z -> show vlan group through switchport port-security violations - > ssh (with the parameters listed above)



To secure and control SSH sessions, the evaluated configuration requires that the SSHv2 session timeout period and maximum number of failed login attempts to be set. This is done by using the following command:

ip ssh timeout <seconds> (note in the evaluated configuration this is set to

120 seconds. The default and maximum is 120 seconds) [7]. Commands D to

L -> ip source-track through ivrf (with the parameters listed above

ip ssh authentication-retries <integer> (note in the evaluated configuration is limited to 3. The default is 3, with a maximum of 5) [7]. Commands D to L

-> ip source-track through ivrf (with the parameters listed above

The evaluated configuration also requires the TOE to re-key before 2

. This can be initiated by the client of by issuing the following command [7].

ip ssh rekey { time time | volume volume }



HTTP server was not evaluated and must be disabled:

no ip http server [4]. Securing User Services Overview



HTTPS server was not evaluated and must be disabled:

no ip http secure-server [4]. Securing User Services Overview



SNMP server was not evaluated and must be disabled:

no snmp-server as described in [6] select Configuring SNMP



Smart Install was not evaluated and must be disabled by issuing the following command:

hostname(config)# no vstack.

3.6.2 Authentication Server Protocols

RADIUS or TACACS+ (outbound) for authentication of TOE administrators to remote authentication servers are disabled by default but can be enabled by administrators in the evaluated configuration. Use best practice for selection and protection of a key to ensure that the key is not easily guessable and is not shared with unauthorized users.

For further information about configuring RADIUS and TACACS+, refer to Securing

User Services Overview -> RADIUS and TACACS+ Attributes and RADIUS and

TACAS+ Attributes [4], Cisco IOS Security Command Reference: Commands M to R -> radius attributes nas-port-type through rd -> radius server [7], Cisco IOS Security

Command Reference: Commands S to Z -> tacacs-server administration through titlecolor -> tacacs server [7] or Configuring Switch-Based Authentication -> Controlling

Switch Access with (selecting either TACACS+ or RADIUS) [6].

3.6.3 Routing Protocols

As noted above, The TOE provides MD5 hashing for authentication of neighbor routers via BGPv4, EIGRP, EIGRPv6 for IPv6, PIM-SMv2, and OSPFv2, OSPFv3 for IPv6 and

RIPv2 with shared passwords. The hash mechanism is implemented as specified in MD5

RFC 1321 and applied in OSPFv2 (RFC 2328), BGPv4 (RFC 2385), MSDP (RFC 3618) for PIM-SMv2 (RFC 4601), and EIGRP (Cisco proprietary).



OSPFv2 uses MD5 for authentication of routing updates, as defined in appendix

D of RFC 2328 (OSPF Version 2).



BGPv4 uses MD5 for authentication of routing updates as defined in RFC 2385

(Protection of BGP Sessions via the TCP MD5 Signature Option).



MSDP uses MD5 to secure and authenticate control messages for TCP connections between two Multicast Source Discovery Protocol (MSDP) peers across Protocol-Independent Multicast sparse-mode (PIM-SM) domains, as defined in RFC 3618 (Multicast Source Discovery Protocol).



EIGRP (Cisco proprietary) uses MD5 for authentication of routing updates.

Routing tables for IPv4 and IPv6 can be created and maintained manually using static routes configured by the administrator. The routing protocols, BGPv4, EIGRP, EIGRPv6 for IPv6, PIM-SMv2, and OSPFv2, OSPFv3 for IPv6 supports routing updates with IPv4 or IPv6, while RIPv2 routing protocol support routing updates for IPv4 only. Use of routing protocols in IPv4 or IPv6 is not required to support or enforce any TOE security functionality including filtering of IPv4 or IPv6 traffic.

The routing protocols are used to maintain routing tables, though with any of the IP routing protocols, you must create the routing process, associate networks with the routing process, and customize the routing protocol for your particular network. You will need to perform some combination of the tasks before routing activities can begin, such as specifying interior (routing networks that are under a common network administration) and exterior (used to exchange routing information between networks that do not share a common administration) gateway protocols. There are other routing configurations such as multiple routing protocols in a single router to connect networks that use different routing protocols, however by default the internal and external (if applicable) need to be configured. Refer to the applicable sections in [9] for configuration of the routing protocol.

Note: When operating the TOE in accordance with the FIPS Security Policy, use of MD5 is not permitted, so neighbor router authentication would not be permitted unless the routing protocols are being transmitted through one or more IPsec tunnels.

3.6.4 Configuration of IPsec

IPsec tunnels must be used for transmission of audit messages, and whenever connecting to AAA servers (RADIUS or TACACS+). Refer to [10] for detailed guidance to configure IPsec tunnels. To ensure the IPsec tunnels will be consistent with the evaluated configuration, use parameters as described in this section. Configuring IPsec tunnels requires configuration of the following elements:



Layer-3 Interfaces: IP-enabled interfaces that can be local tunnel endpoints.



Crypto Access Lists: Any access lists that will be applied to Crypto Maps.



Crypto Maps: An association of a crypto access list (a “match address”), one or more IPsec peers (accessible from a valid local layer-3 interface), and with one or more transforms or transform sets.



IKEv1 Transforms: Administratively-specified parameters to be permitted during IKE SA negotiation (see tables below for permitted parameters).



IKEv1 Transform Sets: Administratively named sets of IKEv1 Transforms that can be applied within crypto maps instead of assigning parameters individually.



IPsec Transforms: Administratively-specified parameters to be permitted during

IPsec SA negotiation (see tables below for permitted parameters).

3.6.4.1 Main Mode vs. Aggressive Mode for IKEv1

By default the IOS action will initiate IKE authentication (rsasig, rsa-encr, or preshared) negotiations in main mode. Do not configure IKE to initiate using aggressive mode. If the device has been configured with the crypto isakmp peer address and the “set aggressive-mode password” or “set aggressive-mode client-endpoint” commands the device will initiate aggressive mode. Do not use those commands or the “initiate mode aggressive” command.

To block all Internet Security Association and Key Management Protocol (ISAKMP) aggressive mode requests to and from a device, use the “crypto isakmp aggressive-

mode disable” [7] Cisco IOS Security Command Reference: Commands A to C, command in global configuration mode. If this command is not configured, Cisco IOS software will attempt to process all incoming ISAKMP aggressive mode security association (SA) connections.

See Sections 3.6.4.7.1 and 3.6.4.7.2 for example configurations using this command.

3.6.4.2 Lifetime Limits for IKEv1 Phase 1 SAs and Phase 2 SAs (IPsec

SAs)

IKEv1 Phase 1 SAs can be limited by time (in seconds) as set by the administrator. Any time limit is permitted, but the recommended limit is 24 hours.

IKEv1 Phase 2 SAs can be limited by time (in seconds) as set by the administrator. Any time limit is permitted, but the recommended limit is 8 hours.

IKEv1 Phase 2 SAs (IPsec SAs) can be limited by the amount of IPsec traffic transmitted.

Setting a limit is not required, and any limit is permitted within the supported range of

100-200 MB (100,000 to 200,000 Kilobytes) of IPsec traffic.

To set the phase 1 SA lifetime, use the following command in isakmp configuration mode:

lifetime {seconds} where the range of seconds is between 60 to 86,400 seconds, and

86,400 (24 hours) is the default value.

See Sections 3.6.4.7.1 and 3.6.4.7.2 for example configurations using this command.

To set the phase 1 and 2 SA lifetime for either time or amount of traffic, use the following command:

crypto ipsec security-association lifetime {seconds seconds | kilobytes kilobytes |

kilobytes disable}[7] Cisco IOS Security Command Reference: Commands A to C -> crypto aaa attribute list

See Sections 3.6.4.7.1 and 3.6.4.7.2 for example configurations using this command.

3.6.4.3 Using Pre-Shared Keys for Authentication

When using pre-shared keys to secure IPsec tunnels, the keys must be entered by an administrator via the CLI. If the remote VPN peer is not administered by the same people, the preshared keys must be exchanged securely, ensuring the keys are never stored or transmitted in unencrypted form. Pre-shared keys can be composed of any

combination of upper and lower case letters, numbers, and special characters (including:

“!”, “@”, “#”, “$”, “%”, “^”, “&”, “*”, “(“, and “)”). Pre-shared keys can be up to 128 characters, with a recommended minimum length of 22 characters from all character sets.

The password complexity is not automatically enforced by the TOE and must be mandated in a policy.

Crypto isakmp key {enc-type-digit | keystring} address {peer-address} [7]

To ensure the preshared key is stored in encrypted form (AES encrypted) in the configuration file, enable the storing of encrypted keys:

key config-key password-encryption [text] [7] Cisco IOS Security Command

Reference: Commands D to L -> K through L -> key config-key password-encryption

password encryption aes [7] Cisco IOS Security Command Reference: Commands M to R -> pac key through port-misue -> password encryption aes



If an encryption key is not present, you will be prompted for the following: New key and Confirm key.

If an encrypted key already exists, you will be prompted for the following: Old key, New key, and Confirm key.

If you want to remove the password that is already encrypted, you will see the following prompt: "WARNING: All type 6 encrypted keys will become unusable.

Continue with master key deletion? [yes/no]:".

To set the key for a tunnel, use the following command after configuring that tunnel to authenticate using a pre-shared key instead of RSA:

crypto isakmp key <enc-type-digit> <keystring>

To enter the keystring in encrypted form (AES encrypted), specify 6 as the enc-type-digit.

[7]

Cisco IOS Security Command Reference: Commands A to C -> crypto isakmp aggressive-mode disable -> crypto isakmp key (with parameters as noted above).

See Sections 3.6.4.7.1 and 3.6.4.7.2 for example configurations using this command.

3.6.4.4 Tunnel Mode vs. Transport Mode

Use tunnel mode whenever possible. Tunnel mode is the preferred mode to use in the evaluated configuration. Tunnel mode is the default mode for all IKE connections. The mode setting is applicable only to traffic whose source and destination addresses are the

IPsec peer addresses; the mode setting is ignored for all other traffic.

Tunnel mode can be specified with the following command in crypto ipsec transform set mode:

mode tunnel

See Sections 3.6.4.7.1 and 3.6.4.7.2 for example configurations using this command.

3.6.4.5 IKEv1 Parameters Permitted in the Evaluated Configuration

IKEv1

Transform

Types

IKEv1

Transform

Options

Permitted in the

Evaluated Configuration

Required in the

Evaluated Configuration

Yes. Authentication rsa-sig (default) rsa-encr

Encryption pre-share des (default)

3des aes aes 192 aes 256

Group

Hash

Lifetime

Any. aes 256

1, 2, 5, 14, 15, 16,

19, 20, 24

14 sha (default) sha256

Any. sha384 number of seconds Yes.

Yes.

Any time limit is acceptable. The recommended limit for

IKEv1 SA (IKE Phase 1

SA) lifetimes is 24 hours

(86,400 seconds).

3.6.4.6 IPsec Parameters Permitted in the Evaluated Configuration

IPsec Transform

Types

IPsec Transform

Options

Permitted in the

Evaluated Configuration

Required in the

Evaluated Configuration

AH Transform ah-md5-hmac ah-sha-hmac

Yes. No.

Use of AH is irrelevant to evaluated security functionality.

ESP Encryption

Transform

ESP

Authentication esp-3des esp-aes esp-des esp-null esp-seal esp-md5-hmac esp-sha-hmac esp-aes esp-sha-hmac

Yes.

AES must be used in the evaluated configuration.

Yes.

Not specifying an ESP

IPsec Transform

Types

Transform

IPsec Transform

Options

Permitted in the

Evaluated Configuration

comp-lzs Yes.

Required in the

Evaluated Configuration

Authentication Transform would equate to using ESP in “confidentiality only” mode, which is not permitted in the evaluated configuration.

No. IP Compression

Transform

Mode

Lifetime tunnel (default) transport

Seconds and/or kilobytes

Yes.

Tunnel mode is always preferred.

IPsec SAs (IKEv1 Phase 2

SAs) can be restricted within the range of 100 to

200 MB (100,000 to

200,000 Kilobytes).

The recommended time limit for IKEv1 Phase 2

SAs is no more than 8 hours (28,800 seconds).

3.6.4.7 Session Protection

TOE communications with the AAA server (RADIUS and/or TACACS+) and the syslog server must be secured using IPsec. If an authorized administrator wants to authenticate using a RADIUS and/or TACACS+ server, then the session between the TOE and AAA server must be protected to ensure the authentication data is not passed in the clear. If an authorized administrator wants to back-up the audit logs to a syslog server, then protection must be provided for the syslog server communications so that audit data is protected.

This session protection can be provided in one of two ways:

1. With a syslog/AAA server acting as an IPsec peer of the TOE and the records tunneled over that connection, or

2. With a syslog server is not directly co-located with the TOE, but is adjacent to an

IPsec peer within a trusted facility, and the records are tunneled over the public network.

The syslog/AAA servers will need to act as an IPsec peer or as an IPsec endpoint where there would be a direct connection from the TOE to the syslog/AAA servers. See Section

3.6.4.7.1 below for more information on this deployment.

If the syslog/AAA server is not capable of acting as an endpoint, then the syslog/AAA server must be located in a physically protected facility and connected to a router capable of establishing an IPsec tunnel with the TOE. To continue the protection of the data,

VLANs [3], [5], [11] or other isolated means will need to be established to protect the data to the syslog/AAA server. See Section 3.6.4.7.2 below for more information on this deployment.

3.6.4.7.1 Syslog Server Running on an IPsec Endpoint

For deployments where the syslog/AAA server is able to operate as an IPsec peer of the

TOE, the IPsec tunnel will protect events as they are sent to the server. Examples of free

VPN endpoint products that can be installed on a syslog server to allow it to be an IPsec peer include the Racoon tool that is part of the IPsec Tools on many Linux systems, strongSwan, Openswan, FreeS/WAN, OpenVPN, Social VPN, tcpcrypt, tinc and

Cloudvpn.

Following are sample instructions to configure the TOE to support an IPsec tunnel with aes encryption, with 10.1.1.10 as the IPsec peer, 10.1.1.2 (on gibabitEthernet 1/1/2 part of vlan 111) and 10.99.1.1 (on Loopback 99) as the local IPs, and the syslog server running on 172.16.1.30 (a separate interface on the IPsec peer).

Switch #configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)#crypto isakmp aggressive-mode disable

Switch (config)#crypto isakmp policy 1

Switch (config-isakmp)#encryption aes

Switch (config-isakmp)#authentication preshare

Switch (config-isakmp)#group 14

Switch (config-isakmp)#lifetime 86400

Switch (config)#crypto ipsec transform-set sampleset esp-aes esp-sha-hmac

Switch (cfg-crypto-trans)#mode tunnel

Switch (cfg-crypto-trans)#exit

Switch (config)#crypto map sample 1 ipsec-isakmp

Switch (config-crypto-map)#set peer 10.1.1.10

Switch (config-crypto-map)#set transform-set sampleset

Switch (config-crypto-map)#match address 120

Switch (config-crypto-map)#exit

Switch (config)#crypto isakmp key {keystring} address 10.1.1.10

Switch (config)#crypto isakmp key {keystring} address 172.16.1.30

Switch (config)#key config-key password-encrypt

New key: {master-key}

Confirm key: {master-key}

Switch (config)#password encryption aes

Switch (config)#crypto ipsec security-association lifetime {seconds 28800 |

kilobytes 100000}

Select either seconds or kilobytes option.

Switch (config)#vlan 111

Switch (config)#interface gigabitEthernet1/1/2

Switch (config-if)#switchport access vlan 111

Switch (config-if)#no shut

Switch (config-if)#exit

Switch (config)#interface vlan 111

Switch (config-if)#ip address 10.1.1.2 255.255.255.0

Switch (config-if)#no ip route-cache

Switch (config-if)#crypto map sample

Switch (config-if)#interface loopback 99

Switch (config-if)#ip address 10.99.1.1 255.255.255.0

Switch (config-if)#exit

Switch (config)#logging source-interface loopback99

Switch (config)#logging host 172.16.1.30

Switch (config)#ip radius source-interface loopback99

Switch (config)#ip tacacs source-interface loopback99

Switch (config)#ip route 172.16.1.0 255.255.255.0 10.1.1.10

Switch (config)#access-list 120 permit ip host 10.99.1.1 host 172.16.1.30 log

Note you should also set a default route to mitigate potential problems with sending

RADIUS traffic out one interface using a source address of another interface.

Switch (config)#ip route 0.0.0.0 0.0.0.0 10.1.1.10

3.6.4.7.2 Syslog Server Adjacent to an IPSec Peer

Following are sample instructions to configure the TOE to support an IPsec tunnel with an IPSec peer adjacent to the syslog server using AES encryption, with 99.0.0.10 as the peer router, 99.0.0.1 (on gibabitEthernet 1/1/10 part of vlan 20) and 10.99.1.1 (on

Loopback 99) as the local IPs, and the syslog server on the 172.16.1.30 /28 subnet. Note changes to the IP addressing scheme and routing policies may need to be changed to support the organization network

Switch #configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)#crypto isakmp aggressive-mode disable

Switch (config)#crypto isakmp policy 1

Switch (config-isakmp)#encryption aes

Switch (config-isakmp)#authentication preshare

Switch (config-isakmp)#group 14

Switch (config-isakmp)#lifetime 86400

Switch (config)#crypto ipsec transform-set sampleset esp-aes esp-sha-hmac

Switch (cfg-crypto-trans)#mode tunnel

Switch (config)#crypto map sample 1 ipsec-isakmp

Switch (config-crypto-map)#set peer 99.0.0.10

Switch (config-crypto-map)#set transform-set sampleset

Switch (config-crypto-map)#match address 115

Switch (config-crypto-map)#exit

Switch (config)#crypto isakmp key {keystring} address 99.0.0.10

Switch (config)#key config-key password-encrypt

New key: {master-key}

Confirm key: {master-key}

Switch (config)#password encryption aes

Switch (config)#crypto ipsec security-association lifetime {seconds 28800 |

kilobytes 100000}

Select either seconds or kilobytes option.

Switch (config)#vlan 20

Switch (config)#interface gigabitEthernet1/1/10

Switch (config-if)#switchport access vlan 20

Switch (config-if)#no shut

Switch (config-if)#exit

Switch (config)#interface vlan 20

Switch (config-if)#ip address 99.0.0.1 255.255.255.0

Switch (config-if)#no ip route-cache

Switch (config-if)#crypto map sample

Switch (config-if)#interface loopback 99

Switch (config-if)#ip address 10.99.1.1 255.255.255.0

Switch (config-if)#exit

Switch (config)#logging source-interface loopback99

Switch (config)#logging host 172.16.1.30

Switch (config)#ip radius source-interface loopback99

Switch (config)#ip tacacs source-interface loopback99

Switch (config)#ip route 172.16.1.0 255.255.255.0 99.0.0.10

Switch (config)#access-list 115 permit ip host 10.99.1.1 host 172.16.1.30 log

Note you should also set a default route to mitigate potential problems with sending

RADIUS traffic out one interface using a source address of another interface.

Switch (config)#ip route 0.0.0.0 0.0.0.0 99.0.0.10

3.7 Logging Configuration

The switch is required to generate an audit record whenever an audited event occurs. The types of events that cause audit records to be generated include events related to the enforcement of information flow policies, identification and authentication related events, and administrative events.

To ensure audit records are generated for the required auditable events, the TOE must be configured in its evaluated configuration as specified in this document. This is to ensure that auditing is enabled so that the audit records are being generated for the required auditable events. If the command ‘no logging on’ is entered the TOE is deemed no longer in the evaluated configuration.



Logging of command execution must be enabled [6] [7] [11]:

Switch(config)#archive

Switch(config-archive)#log config

Switch(config-archive-log-cfg)#logging enable

Switch(config-archive-log-cfg)#hidekeys (this ensures that keys and passwprds are not displayed in the clear)

Switch(config-archive-log-cfg)#logging size entires (number of entries to be retained in the configuration log. The range is from 1 to 1000; the default is

100)

* Optonal - Switch(config-archive-log-cfg)#notify syslog (this enables the sending of notifications of configuration changes to a remote syslog server if configured. See Remote Logging below for configuring the syslog server)

Switch(config-archive-log-cfg)#end

Switch(config-archive)#exit



Timestamps, including the year must be enabled for the audit records:

Switch(config)#service timestamps log datetime year



To protect against audit data loss if the switch fails, the audit records can be saved to flash memory by using the global configuration command

logging file flash: filename.



To view the audit records after they have been saved, use the privileged

EXEC command to display its contents

more flash: filename



Set the size logging file size. The range is 4096 to 2147483647:

logging file filesystem:filename (alias for a flash file system. Contains the path and name of the file that contains the log messages) max-file-size

(Specify the maximum logging file size)



To generate logging messages for failed and successful login attempts in the evaluated configuration, issue the login on-failure and login on-success commands:

Switch(config)#login on-failure log

Switch(config)#login on-success log



Enable radius or tacacs and ssh debugging:

Switch(config)#debug radius authentication or Switch(config)#debug tacacs authentication

Switch(config)#debug ssh authentication



Enable IPsec related debugging

Switch(config)#debug crypto isakmp

Switch(config)#debug crypto ipsec

Switch(config)#debug crypto ikev2



Enable Network Time Protocol (NTP) debugging

Switch(config)#debug ntp all



Syslog (outbound) for transmission of syslog events to a remote syslog server is disabled by default. To configure syslog, refer to the instructions below in

‘Remote Logging

Note, debug level auditing is required for specific protocols and events to ensure the audit records with the level of information are generated to meet the requirements in the

Security Target. When that level of auditing is required, it is annotated as such throughout this AGD document.

To view IPSec SA Creation and Deletion audit records, ensure that debugging of crypto as stated above is enabled. When debugging is disabled, the IPSec audit data will not be

logged. However, the evaluation configuration for the TOE includes enabling of this functionality.

When enabled, the debug logs for IPSec, ISAKMP, and IKEv2 provide information regarding the current state of the session as well as movement from one state to another.

With aggressive mode disabled in the evaluated configuration, the statement “Unable to initiate or respond to Aggressive Mode while disabled” will be presented to the user followed by “Cannot start Aggressive mode, trying Main mode.” Additional logs include negotiation of pre-shared keys and digital signatures as well as Security Association

Phase 1 and Phase 2 lifetimes. For more specific log information, see the table entry for

FCS_IPSEC_EXT.1 in Section 3.7.2.

3.7.1 Remote Logging

To protect against audit data loss the TOE can be configured to send the audit records to an external TCP syslog server. For instance all emergency, alerts, critical, errors, and warning message can be sent to the console alerting the administrator that some action needs to be taken as these types of messages mean that the functionality of the switch is affected. All notifications and information type message can be sent to the syslog server, whereas message is only for information and the switch functionality is not affected.

Since this functionality is not enabled by default the following command must be entered at the CLI to configure this option. Refer to Logging Messages to a UNIX Syslog

Daemon section of [6] [7] [11] for available settings and options.

Switch# configure terminal

Switch(config)#logging host (the IP address of the syslog server)

Switch(config)#logging trap level (you can limit the messages logged to the syslog server. By default syslog servers receive informational messages and lower)

Switch(config)#logging facility facility type (the UNIX system facilities supported; the default is local7)

Switch(config)#end

Configure IPsec tunnel(s) to transport the syslog messages to syslog server(s). Without using IPsec, the syslog connection would not have confidentiality and integrity of the audit data secured in transit. For guidance on configuration of IPsec tunnels, refer to

section 3.6.4. The set of logging messages sent to the remote syslog server, can be the

same or different from the set written to the local logging buffer. When connection to the remote audit server is down (either because the IPsec tunnel is down, or the syslog server is unavailable), Cat2K/3K will continue to logging messages to the logging buffer.

Messages in the logging buffer can be viewed with the “show logging buffer” command

[11] show gsr through show monitor event trace -> show logging. When the buffer is full, the oldest messages will be overwritten with new messages. The buffer size can be increased from the default using the command, “logging buffered [buffer size in

bytes]”.

3.7.2 Reviewing Audited Events

Cat2K/3K maintains logs in multiple locations: local storage of the generated audit records, and simultaneous offload of those events to the external syslog server. For the most complete view of audited events, across all devices, and to view the auditable events defined in the Security Target administrators should review the Audit Log on a regular basis.

Using the Cat2K/3K Command Line Interface (CLI) administrators can review audited events. The information provided in the audit records include the date and time of the event, the type of event, subject identity (if applicable), the outcome of the event, and additional information related to the event. To review locally stored audit records enter the command “show logging” [6] -> configuring System Message Logging and Smart

Logging or [11] -> show gsr through show monitor event trace -> show logging (*). Also to display logging information see [5] Troubleshooting and Fault Management ->

Logging System Messages -> Displaying Logging Information,

System log messages can contain up to 80 characters and a percent sign (%), which follows the optional sequence number or time-stamp information The part of the message preceding the percent sign depends on the setting of the service sequencenumbers, service timestamps log datetime, service timestamps log datetime [localtime]

[msec] [show-timezone], or service timestamps log uptime global configuration command. The following information is basic information that is included in an audit/log record.



Element - Description



seq no: - Stamps log messages with a sequence number only if the service sequence-numbers global configuration command is configured. For more information, see the "Enabling and Disabling Sequence Numbers in Log

Messages" section.



timestamp formats: o mm/dd hh:mm:ss or hh:mm:ss (short uptime) or d h (long uptime)



Date and time of the message or event. This information appears only if the service timestamps log [datetime | log] global configuration command is configured. For more information, see the "Enabling and Disabling Time Stamps on Log Messages" section.



Facility - The facility to which the message refers (for example, SNMP, SYS, and so forth). For a list of supported facilities, see Table 34-4.



severity - Single-digit code from 0 to 7 that is the severity of the message. For a description of the severity levels, see Table 34-3.



MNEMONIC - Text string that uniquely describes the message.



description - Text string containing detailed information about the event being reported.



hostname-n - Hostname of a stack member and its switch number in the stack.

Though the stack master is a stack member, it does not append its hostname to system messages.

Below is a sample of audit records for various events; note these records are a sample and not meant as an exact record for a particular event. In addition, for some cryptographic

failures producing an audit record would require extensive manipulation and therefore snippets of source code is provided to illustrate what would be displayed in an audit record.

Requirement

Auditable

Events

FAU_STG_EXT.3 Loss of connectivity.

FCS_CKM.1 Failure on invoking functionality

FCS_CKM_EXT.4 Failure on invoking functionality

Additional

Audit

Record

Contents

Sample Record

AUDIT: See logs provided by

FCS_IPSEC_EXT.1.

CRYPTO-3-RSA_SELFTEST_FAILED:

Generated RSA key failed self test

Hardware testing error may also include:

RNG self test fail : 0

Invalid Key : 0 const static uint8 gs_predefined_zeroization_pattern[256] = {

0x0D,0x0D,0x0D,0x0D,0x0D,0x0D,0x0D,0x0D

}; void sesa_clear_key(uint8 *keyloc, size_t kbl)

{

int32 idx;

if((keyloc != NULL)&&(kbl > 0)){ for(idx = 0; idx < kbl; idx++){

*((volatile uint8 *)&keyloc[idx]) = 0xA5;

*((volatile uint8 *)&keyloc[idx]) = 0x5A;

*((volatile uint8 *)&keyloc[idx]) = 0x0D;

} if(0 != memcmp(keyloc,gs_predefined_zeroization_patt ern,kbl)){

/**

* Print a zeroization warning

errmsg(&msgsym(ZEROIZATION_FAIL,

SESA),

Requirement

FCS_COP.1*

Auditable

Events

Failure on invoking functionality

Additional

Audit

Record

Contents

Sample Record

hrpc_get_box_number());

}

Bootup and hardware testing error would include:

Hash Miscompare : 0 (if this was have failed, the counter would be greater than zero)

Decrypt Failure : 0 (if this was have failed, the counter would be greater than zero)

Invalid Key : 0 (if this was have failed, the counter would be greater than zero)

The following example displays the output of the test crypto self-test command. Note if any the crypto test fails, a SELF_TEST_FAILURE system log would be generated.

Router# test crypto self-test

*Apr 23 01:48:49.678: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (Self test ac)

*Apr 23 01:48:49.822: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (DH self test)

*Apr 23 01:48:49.954: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (Software

Cry)

*Apr 23 01:48:50.054: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (Software che)

*Apr 23 01:48:50.154: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (DES encrypti)

Router#

*Apr 23 01:48:50.254: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (3DES encrypt)

*Apr 23 01:48:50.354: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (SHA hashing )

*Apr 23 01:48:50.454: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (Random

Requirement

FCS_RBG_EXT.1

Auditable

Events

Failure on invoking functionality

FCS_IPSEC_EXT.1 Failure to establish an

IPsec Session.

Establishment/

Termination of an IPsec

Session.

Additional

Audit

Record

Contents

Sample Record

Reason for failure.

Non-TOE endpoint of connection

(IP address) for both successes and failures.

KAT t)

*Apr 23 01:48:50.674: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (AES encrypti)

*Apr 23 01:48:50.774: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (HMAC-

SHA )

Router#

*Apr 23 01:48:50.874: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (SHA256 hashi)

*Apr 23 01:48:50.974: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (SHA512 hashi)

*Apr 23 01:48:50.974: %CRYPTO-6-

SELF_TEST_RESULT: Self test info: (ALL

TESTS PA)

Bootup and hardware testing error would include:

RNG self test fail : 0 (if this was have failed, the counter would be greater than zero)

Also note that unless there is a failure in the bootup testing and/or upon generation of keys you will not receive an audit record. If there is a failure during operation, the TOE will crash and attempt to reboot.



Initiation of IPSEC session (outbound):

Jun 20 07:42:26.823: ISAKMP (0): received packet from 100.1.1.5 dport 500 sport 500

Global (N) NEW SA

Jun 20 07:42:26.823: ISAKMP: Created a peer struct for 100.1.1.5, peer port 500

Jun 20 07:42:26.823: ISAKMP: New peer created peer = 0x89C3879C peer_handle =

0x8000000C

Jun 20 07:42:26.823: ISAKMP: Locking peer struct 0x89C3879C, refcount 1 for crypto_isakmp_process_block

Jun 20 07:42:26.823: ISAKMP: local port 500, remote port 500

Jun 20 07:42:26.823: ISAKMP:(0):insert sa successfully sa = 8C1C1FD4

Requirement

Auditable

Events

Additional

Audit

Record

Contents

Sample Record

Jun 20 07:42:26.823: ISAKMP:(0):Input =

IKE_MESG_FROM_PEER, IKE_MM_EXCH

Jun 20 07:42:26.823: ISAKMP:(0):Old State =

IKE_READY New State

= IKE_R_MM1 …

Jun 20 07:42:26.823: ISAKMP:(0):found peer pre-shared key matching 100.1.1.5

Jun 20 07:42:26.823: ISAKMP:(0): local preshared key found

Jun 20 07:42:26.823: ISAKMP : Scanning profiles for xauth ...

Jun 20 07:42:26.823: ISAKMP:(0):Checking

ISAKMP transform 1 against priority 1 policy

Jun 20 07:42:26.827: ISAKMP: encryption

AES-CBC

Jun 20 07:42:26.827: ISAKMP: keylength of

128

Jun 20 07:42:26.827: ISAKMP: hash SHA

Jun 20 07:42:26.827: ISAKMP: default group

Jun 20 07:42:26.827: ISAKMP: auth preshare…

Jun 20 07:42:26.843: ISAKMP (0): received packet from 100.1.1.5 dport 500 sport 500

Global (R) MM_SA_SETUP

Jun 20 07:42:26.843: ISAKMP:(0):Input =

IKE_MESG_FROM_PEER, IKE_MM_EXCH

Jun 20 07:42:26.843: ISAKMP:(0):Old State =

IKE_R_MM2 New State = IKE_R_MM3

Jun 20 07:42:26.843: ISAKMP:(0): processing

KE payload. message ID = 0

Jun 20 07:42:27.055: ISAKMP:(0): processing

NONCE payload. message ID = 0

Jun 20 07:42:27.059: ISAKMP:(0):found peer pre-shared key matching 100.1.1.5



Termination of IPSEC session (outboundinitiated)

sa_lifetime(k/sec)= (4608000/28800),

(identity) local= 100.1.1.1:0, remote=

100.1.1.5:0,

Requirement

Auditable

Events

Additional

Audit

Record

Contents

Sample Record

local_proxy= 10.1.1.0/255.255.255.0/256/0,

remote_proxy= 12.1.1.0/255.255.255.0/256/0

.Jun 19 21:10:37.575: ISAKMP:(2034):purging node -506111676

.Jun 19 21:10:39.615: ISAKMP:(2034):purging node -22679511

.Jun 20 04:46:14.789: IPSEC(lifetime_expiry):

SA lifetime threshold reached, expiring in 1412 seconds

.Jun 20 04:46:44.485:

IPSEC(update_current_outbound_sa): updated peer 100.1.1.5 current outbound sa to SPI

C926860E



Failure of an established IPSEC session (outbound-initiated)

Jun 19 11:12:33.905: %CRYPTO-5-

IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled

Additional IPSec Log Examples:

Session Establishment:

Jan 24 15:30:58.640: ISAKMP: Found a peer struct for 172.16.110.102, peer port 500

Jan 24 15:30:58.640: ISAKMP: Locking peer struct 0x599CF54, refcount 1 for isakmp_initiator

Jan 24 15:30:58.640: ISAKMP: local port 500, remote port 500

Jan 24 15:30:58.640: ISAKMP: set new node 0 to QM_IDLE

Jan 24 15:30:58.640: ISAKMP: Find a dup sa in the aconf ting isadb_insert sa = 5AD62F8

Jan 24 2014 15:30:58: %CRYPTO-5-

IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled

Jan 24 15:30:58.640: ISAKMP:(0):Can not start

Aggressive mode, trying Main mode.

Jan 24 15:30:58.640: ISAKMP:(0):found peer pre-shared key matching 172.16.110.102

Jan 24 15:30:58.640: ISAKMP:(0):Input =

IKE_MESG_FROM_IPSEC,

IKE_SA_REQ_MM

Requirement

Auditable

Events

Additional

Audit

Record

Contents

Sample Record

Jan 24 15:30:58.640: ISAKMP:(0):Old State =

IKE_READY New State = IKE_I_MM1

Jan 24 15:30:58.640: ISAKMP:(0): beginning

Main Mode exchange

Jan 24 15:30:58.640: ISAKMP:(0): sending packet to 172.16.110.102 my_port 500 peer_port

500 (I) MM_NO_STATE

Jan 24 15:30:58.648: ISAKMP:(0):Sending an

IKE IPv4 Packet.

Jan 24 15:30:58.673: ISAKMP (0): received packet from 172.16.110.102 dport 500 sport 500

Global (I) MM_NO_STATE

Jan 24 15:30:58.673: ISAKMP:(0):Input =

IKE_MESG_FROM_PEER, IKE_MM_EXCH

Jan 24 15:30:58.673: ISAKMP:(0):Old State =

IKE_I_MM1 New State = IKE_I_MM2

Jan 24 15:30:58.682: ISAKMP:(0): processing

SA payload. message ID = 0

Jan 24 15:30:58.682: ISAKMP:(0): processing vendor id payload

Jan 24 15:30:58.682: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch

Jan 24 15:30:58.682: ISAKMP (0): vendor ID is

NAT-T RFC 3947

Jan 24 15:30:58.682: ISAKMP:(0):found peer pre-shared key matching 172.16.110.102

Jan 24 15:30:58.682: ISAKMP:(0): local preshared key found

Jan 24 15:30:58.682: ISAKMP : Scanning profiles for xauth ...

Jan 24 15:30:58.682: ISAKMP:(0):Checking

ISAKMP transform 1 against priority 1 policy

Jan 24 15:30:58.682: ISAKMP: encryption

AES-CBC

Jan 24 15:30:58.682: ISAKMP: keylength of

256

Jan 24 15:30:58.682: ISAKMP: hash SHA

Jan 24 15:30:58.682: ISAKMP: default group

Jan 24 15:30:58.682: ISAKMP: auth preshare

Jan 24 15:30:58.682: ISAKMP: life type in seconds

Jan 24 15:30:58.682: ISAKMP: life duration

(basic) of 60

Requirement

Auditable

Events

Additional

Audit

Record

Contents

Sample Record

Jan 24 15:30:58.682: ISAKMP:(0):atts are acceptable. Next payload is 0

Authentication Example of Pre-shared Key:

Jan 24 15:29:29.679: ISAKMP:(1008):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR

Jan 24 15:29:29.679: ISAKMP (1008): ID payload

next-payload : 8

type : 1

address : 172.16.110.101

protocol : 17

port : 500

length : 12

Jan 24 15:29:29.679: ISAKMP:(1008):Total payload length: 12

Successful Authentication:

Jan 24 15:29:29.746: ISAKMP:(0):: peer matches *none* of the profiles

Jan 24 15:29:29.746: ISAKMP:(1008): processing HASH payload. message ID = 0

Jan 24 15:29:29.746: ISAKMP:(1008):SA authentication status:

authenticated

Jan 24 15:29:29.746: ISAKMP:(1008):SA has been authenticated with 172.16.110.102

Jan 24 15:29:29.746: ISAKMP:(1008):Input =

IKE_MESG_FROM_PEER, IKE_MM_EXCH

Jan 24 15:29:29.746: ISAKMP:(1008):Old State

= IKE_I_MM5 New State = IKE_I_MM6

Phase 1 Complete

Jan 24 15:30:59.806: ISAKMP:(1009):Old State

= IKE_I_MM6 New State =

IKE_P1_COMPLETE

Jan 24 15:30:59.806: ISAKMP:(1009):beginning

Quick Mode exchange, M-ID of 3178261321

Jan 24 15:30:59.806: ISAKMP:(1009):QM

Initiator gets spi

Jan 24 15:30:59.806: ISAKMP:(1009): sending packet to 172.16.110.102 my_port 500 peer_port

500 (I) QM_IDLE

Jan 24 15:30:59.806: ISAKMP:(1009):Sending an IKE IPv4 Packet.

Jan 24 15:30:59.806: ISAKMP:(1009):Node

3178261321, Input = IKE_MESG_INTERNAL,

Requirement

Auditable

Events

Additional

Audit

Record

Contents

Sample Record

IKE_INIT_QM

Jan 24 15:30:59.806: ISAKMP:(1009):Old State

= IKE_QM_READY New State =

IKE_QM_I_QM1

Jan 24 15:30:59.806: ISAKMP:(1009):Input =

IKE_MESG_INTERNAL,

IKE_PHASE1_COMPLETE

Jan 24 15:30:59.806: ISAKMP:(1009):Old State

= IKE_P1_COMPLETE New State =

IKE_P1_COMPLETE

ESP Traffic Transform:

Jan 24 15:30:59.848: ISAKMP: transform 1,

ESP_AES

Jan 24 15:30:59.848: ISAKMP: attributes in transform:

Jan 24 15:30:59.856: ISAKMP: encaps is 1

(Tunnel)

Jan 24 15:30:59.856: ISAKMP: SA life type in seconds

Jan 24 15:30:59.856: ISAKMP: SA life duration (basic) of 120

Jan 24 15:30:59.856: ISAKMP: SA life type in kilobytes

Jan 24 15:30:59.856: ISAKMP: SA life duration (VPI) of 0x0 0x1 0x90 0x0

Jan 24 15:30:59.856: ISAKMP: authenticator is HMAC-SHA

Jan 24 15:30:59.856: ISAKMP: key length is

128

Jan 24 15:30:59.856: ISAKMP:(1009):atts are acceptable.

Jan 24 15:30:59.856: ISAKMP:(1009): processing NONCE payload. message ID =

3178261321

Jan 24 15:30:59.856: ISAKMP:(1009): processing ID payload. message ID =

3178261321

Jan 24 15:30:59.856: ISAKMP:(1009): processing ID payload. message ID =

3178261321

Phase Lifetime Started:

Jan 24 15:30:58.682: ISAKMP:(0)::Started lifetime timer: 60.

Phase Lifetime Reached:

Jan 24 15:30:28.516: ISAKMP:(1008):deleting

SA reason "IKE SA Lifetime Exceeded" state (I)

Requirement

FIA_UIA_EXT.1

FIA_UAU_EXT.5

FIA_UAU.6

Auditable

Events

All use of the identification and authentication mechanism.

All use of the authentication mechanism.

Attempt to reauthenticate.

Additional

Audit

Record

Contents

Sample Record

QM_IDLE (peer 172.16.110.102)

Jan 24 15:30:28.516: ISAKMP: Unlocking peer struct 0x599CF54 for isadb_mark_sa_deleted(), count 0

Jan 24 15:30:28.516: ISAKMP:(1008):Input =

IKE_MESG_FROM_PEER, IKE_MM_EXCH

Jan 24 15:30:28.516: ISAKMP:(1008):Old State

= IKE_DEST_SA New State = IKE_DEST_SA

Provided user identity, origin of the attempt (e.g.,

IP address).

Also see Audit events in FIA_UAU_EXT.5

Origin of the attempt (e.g.,

IP address).



Username: auditperson

Password:

ASR-SL-491>?

000278: *Apr 23 07:11:56: %SEC_LOGIN-5-

LOGIN_SUCCESS: Login Success [user: auditperson] [Source: 0.0.0.0] [localport: 0] at

07:11:56 UTC Thu Apr 23 2009?



Failed login via the console does not allow any actions

Username: auditperson

Password:

% Authentication failed

Origin of the attempt (e.g.,

IP address).

Username:

000254: *Apr 26 00:45:43.340: %SEC_LOGIN-

4-LOGIN_FAILED: Login failed [user: auditperson] [Source: 0.0.0.0] [localport: 0]

[Reason: Login Authentication Failed] at

23:45:43 a Sat Apr 25 2009

See FCS_SSH_EXT.1 for remote login audit events. bash-3.00$ CD1

Trying 10.106.21.191...

Connected to 10.106.21.191.

Escape character is '^]'.

Requirement

FPT_RPL.1

Auditable

Events

Additional

Audit

Record

Contents

Sample Record

Detected replay attacks

Origin of the attempt (e.g.

IP address)

User Access Verification

Username: bjatti

Password:>>>>>entered old password

New Password:>>>entered new password

New Password:

CD1>exit

*Jun 1 10:48:54.795 MST: SW1: SSH0: sent protocol version id SSH-2.0-Cisco-1.25

*Jun 1 10:48:54.795 MST: SW1: SSH0: protocol version id is - SSH-2.0-

OpenSSH_5.3p1 Debian-3ubuntu7

*Jun 1 10:48:55.131 MST: %SSH-SW1-5-

SSH2_SESSION: SSH2 Session request from

105.13.4.73 (tty = 0) using crypto cipher

'aes128-cbc', hmac 'hmac-md5' Succeeded

*Jun 1 10:49:02.739 MST: %SEC_LOGIN-

SW1-5-LOGIN_SUCCESS: Login Success

[user: admin] [Source: 105.13.4.73] [localport:

22] at 10:49:02 MST Fri Jun 1 2012

*Jun 1 10:49:02.739 MST: %SSH-SW1-5-

SSH2_USERAUTH: User 'admin' authentication for SSH2 Session from 105.13.4.73 (tty = 0) using crypto cipher 'aes128-cbc', hmac 'hmacmd5' Succeeded

*Jun 1 10:49:08.331 MST: %PARSER-SW1-5-

CFGLOG_LOGGEDCMD: User:admin logged command:!exec: enable

*Jun 1 10:49:20.883 MST: %PARSER-SW1-5-

CFGLOG_LOGGEDCMD: User:admin logged command:interface GigabitEthernet1/6/3

*Jun 1 10:49:23.011 MST: %PARSER-SW1-5-

CFGLOG_LOGGEDCMD: User:admin logged command:shutdown

*Jun 1 10:49:23.027 MST: %LINK-SW1-5-

CHANGED: Interface GigabitEthernet1/6/3, changed state to administratively down

*Jun 1 10:49:24.487 MST: %PARSER-SW1-5-

CFGLOG_LOGGEDCMD: User:admin logged command:no shutdown

*Jun 1 10:49:24.527 MST: %LINK-SW1-3-

Requirement

FPT_STM.1

FPT_TUD_EXT.1

Auditable

Events

Changes to the time.

Initiation of update.

FTA_SSL_EXT.1 Any attempts at unlocking of an

[local] interactive session.

Additional

Audit

Record

Contents

Sample Record

UPDOWN: Interface GigabitEthernet1/6/3, changed state to down

*Jun 1 10:49:33.319 MST: %SYS-SW1-5-

CONFIG_I: Configured from console by admin on vty0 (105.13.4.73)

*****Tcpreplay attack run*****

**Check interface counters**

The old and new values for the time.

Origin of the attempt (e.g.,

IP address).

No additional information.

*No additional logs created although counters increased.



Note: If the logs had to record details of this attack a Denial of Service/ Buffer

Overflow Attack could result in a flood scenario



Local Clock Update: CLOCKUPDATE:

System clock has been updated from

06:11:37 EDT Mon Dec 20 2010 to

06:10:00 EDT Tue Dec 20 2011, configured from console by user on console.



One audit record for NTP changing the time:

Jun 20 09:52:39.622: NTP Core(NOTICE):

Clock is synchronized.



Use of the “upgrade” command.

*Jul 10 11:04:09.179: %PARSER-5-

CFGLOG_LOGGEDCMD: User:cisco logged command:upgrade

No additional information.

*Jul 10 11:04:09.179: %PARSER-5-

CFGLOG_LOGGEDCMD: User:cisco logged command:copy tftp ….

*Jul 10 11:04:09.179: %PARSER-5-

CFGLOG_LOGGEDCMD: User:cisco logged command:reload

In the TOE this is represented by login attempts that occur after the timeout of a local administrative user.

001383: May 10 18:06:34.091: %SYS-6-

EXEC_EXPIRE_TIMER: (tty 0 (0.0.0.0)) exectimeout timer expired for user securityperson

001384: May 10 18:06:34.091: %SYS-6-

EXIT_CONFIG: User securityperson has exited tty session 0(0.0.0.0)

Requirement

FTA_SSL.3

Auditable

Events

The termination of a remote session by the session locking mechanism.

Additional

Audit

Record

Contents

No additional information.

Sample Record

Audit record generated when SSH session is terminated because of idle timeout:

May 29 2012 15:18:00 UTC: %SYS-6-

TTY_EXPIRE_TIMER: (exec timer expired, tty

0 (0.0.0.0)), user admin

FTP_ITC.1(1) (2) Initiation of the trusted channel.

Termination of the trusted channel.

Failure of the trusted channel functions.

Identificatio n of the initiator and target of failed trusted channels establishmen t attempt.

See logs provided by FCS_SSH_EXT.1 and

FCS_IPSEC_EXT.1.

See logs provided by FCS_SSH_EXT.1 FTP_TRP.1(1) (2) Initiation of the trusted channel.

Termination of the trusted channel.

Failures of the trusted path functions.

Identificatio n of the claimed user identity.

3.7.3 Deleting Audit Records

The TOE provides the privileged administrator the ability to delete audit records stored within the TOE. This is done with the “clear logging” command [11] C commands -> clear logging.

3.8 Information Flow Policies-ACL

The TOE is initially configured with a permissive default setting that allows all traffic to pass through the TOE.

Access lists should be configured on the TOE to prevent spoofing of external or internal addresses through the opposite interface and also to block broadcast source address and loopback source address traffic.

Note, these access lists should be integrated with the defined security policy for

your TOE switch. Enabling just these access lists with no permits will result in traffic being dropped.

A privileged authorized administrator may manipulate the ACLs using the commands ip inspect, access-list and access-group as described [7] and Configuring Network Security with ACLs in [6].

In this example, we are assuming that interface GigabitEthernet0/0 is the external interface, and is assigned an IP address of 10.200.1.1. Interface GigabitEthernet0/1 is the internal interface and is assigned an IP address of 10.100.1.1.

To prevent the passing of traffic with an internal source address on the external Interface, apply the following access control list to the external interface:

Switch# configure terminal

Switch(config)# access-list 199 deny ip 10.100.0.0 0.0.255.255 any log-

input

To prevent the passing of traffic with an external source address on the internal Interface, apply the following access control list to the internal interface:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# access-list 100 deny ip 10.200.0.0 0.0.255.255 any log-

input

To prevent the passing of traffic with a broadcast or loopback address on either interface, apply the following access control list to both interfaces:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# access-list 100 deny ip 224.0.0.0 15.255.255.255 any log-

input

Switch(config)# access-list 100 deny ip 255.255.255.255 0.0.0.0 any log-

input

Switch(config)# access-list 100 deny ip 127.0.0.0 0.255.255.255 any log-

input

Switch(config)# access-list 199 deny ip 224.0.0.0 15.255.255.255 any log-

input

Switch(config)# access-list 199 deny ip 255.255.255.255 0.0.0.0 any log-

input

Switch(config)# access-list 199 deny ip 127.0.0.0 0.255.255.255 any log-

input

If remote administration is required, ssh has to be explicitly allowed through either the internal or external interfaces.

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# access-list 199 permit tcp host 10.200.0.1 host 10.200.0.1

eq 22 log-input

To close ports that don’t need to be open and may introduce additional vulnerabilities, implement the following acl:.

Switch(config)# access-list 100 deny 132 any any log-input

Switch(config)# access-list 199 deny 132 any any log-input

To apply the acls to the interfaces:

Switch(config)# interface GigabitEthernet0/0

Switch(config-if)# ip access-group 199 in

Switch(config)# interface GigabitEthernet0/1

Switch(config-if)# ip access-group 100 in

4. Secure Management

4.1 User Roles

The Cat2K/3K maintains administrative privilege level and non-administrative access.

Non-administrative access is granted to authenticated neighbor routers for the ability to receive updated routing tables per the information flow rules. There is no other access or functions associated with non-administrative access. The administrative privilege levels include:



Administrators are assigned to privilege levels 0 and 1. Privilege levels 0 and 1 are defined by default and are customizable. These levels have a very limited scope and access to CLI commands that include basic functions such as login, show running system information, turn on/off privileged commands, logout.



Semi-privileged administrators equate to any privilege level that has a subset of the privileges assigned to level 15; levels 2-14. These levels are undefined by default and are customizable.



Privileged administrators are equivalent to full administrative access to the CLI, which is the default access for IOS privilege level 15.

Refer to the IOS Command Reference Guide for available commands and associated roles and privilege levels [3] [4] [7] [11].

4.2 Passwords

To prevent users from choosing insecure passwords, password must meet the following requirements:



At least 15 characters long



Does not contain more than three consecutive characters, such as abcd



Does not contain more than two repeating characters, such as aaabbb



Does not contain dictionary words



Does not contain common proper names

This requirement applies to the local password database and on the password selection functions provided by the TOE, but remote authentication servers may have preconfigured passwords which do not meet the quality metrics. The above quality metrics are guidelines to follow, not necessarily enforceable.

The Cat2K/3K can enforce the use of strong passwords by using options listed below with the “aaa common-criteria policy” command. To view the current policy use,

Switch(config)# show aaa common-criteria policy.

The following options are available:



char-change--Number of changed characters between old and new passwords.

The range is from 1 to 64.



lifetime--Configure the maximum lifetime of a password by providing the configurable value in years, months, days, hours, minutes, and seconds. If the lifetime parameter is not configured, the password will never expire.



lower-case--Number of lowercase characters. The range is from 0 to 64.



upper-case--Number of uppercase characters. The range is from 0 to 64.



min-length--Minimum length of the password. The range is from 1 to 64.



max-length--Maximum length of the password. The range is from 1 to 64.



numeric-count--Number of numeric characters. The range is from 0 to 64.



special-case--Number of special characters. The range is from 0 to 64.

Following is an example command to set username, password and policy username <username> common-criteria-policy <policy> password <password>

To store passwords in encrypted form in the configuration file, use the “service

password-encryption” command [7] Cisco IOS Security Command Reference:

Commands S to Z -> sa ipsec through sessions maximum and [6] Configuring Switch-

Based Authentication -> Protecting Enable and Enable Secret Passwords with

Encryption. The actual encryption process occurs when the current configuration is written or when a password is configured. Password encryption is applied to all passwords, including username passwords, authentication key passwords, the privileged command password, console and virtual terminal line access passwords. This command is primarily useful for keeping unauthorized individuals from viewing your password in your configuration file.

4.3 Clock Management

Clock management is restricted to the privileged administrator.

The NTP server, if configured, is provided by the IT environment. Without authentication or access control, Network Time Protocol (NTP) is insecure and can be used by an attacker to send NTP packets to attempt to crash or overload the switch. If

NTP is to be used, configure NTP authentication using Message Digest 5 (MD5) and the

“ntp access-group” command. If NTP is enabled globally, disable it on all interfaces on which it is not needed.

For further details refer to Administering the Switch -> Managing the System Time and

Date in [6].

4.4 Identification and Authentication

Configuration of Identification and Authentication settings is restricted to the privileged administrator.

The Cat2K/3K can be configured to use local authentication and authorization (SSH),

TACACS+, or RADIUS. Refer to “Configuring Switch-Based Authentication”. The

section contains information to set the following identification and authentication controls on the Switch [6]



Preventing Unauthorized Access to Your Switch



Protecting Access to Privileged EXEC Commands



Controlling Switch Access with TACACS+



Controlling Switch Access with RADIUS



Configuring the Switch for Local Authentication and Authorization



Configuring the Switch for Secure Shell

4.5 Administrative Banner Configuration

The TOE provides the authorized administrator the ability to configure a banner that displays on the CLI management interface prior to allowing any administrative access to the TOE.



This functionality is available to the privileged administrator.

This functionality is facilitated using the “banner login” command

Information regarding banner configuration can be found in the “Administrating the

Switch”  “Creating a Banner”  “Configuring a Login Banner” in section of [6].

4.6 Use of Administrative Session Lockout and Termination

The TOE allows the privileged administrator to configure the length of time that an inactive administrative session remains open. After the configured period of time, the administrative session is locked and the screen is flushed. No further activity is allowed to until the administrator has successfully re-authenticated to the Switch. The administrator is required to re-authenticate after the session becomes locked and the screen is cleared.

The exec-timeout command is used to configure this locking of the session after the administrator is inactive for the specified number of minutes and seconds on the console

(or vty) lines:

Switch(config)# line console

Switch(config-line)# exec-timeout 0 10

The example above sets the console time interval of 10 seconds. Use the no form of this command (no exec-timeout) to remove the timeout definition [11] D through E.

The TOE allows each administrative user of the TOE to locally lock their administrative sessions. After the session is locked, the screen is flushed. No further activity is allowed to until the administrator has successfully re-authenticated to the TOE.

The exit command is used for this on-demand locking of administrator sessions [11] D through E.

5. Modes of Operation

An IOS switch has several modes of operation, these modes are as follows:

Booting – while booting, the switches drop all network traffic until the switch image and configuration has loaded. This mode of operation automatically progresses to the Normal mode of operation. During booting, a user may press the break key on a console connection within the first 60 seconds of startup to enter the ROM Monitor mode of operation. This Booting mode is referred to in the IOS guidance documentation as “ROM

Monitor Initialization”. Additionally if the Switch does not find a valid operating system image it will enter ROM Monitor mode and not normal mode therefore protecting the switch from booting into an insecure state.

Normal - The IOS switch image and configuration is loaded and the switch is operating as configured. It should be noted that all levels of administrative access occur in this mode and that all switch based security functions are operating. Once in the normal operating mode and fully configured, there is little interaction between the switch and the administrator. However, the configuration of the switch can have a detrimental effect on security, therefore adherence to the guidelines in this document should be followed.

Misconfiguration of the switch could result in the unprotected network having access to the internal/protected network

ROM Monitor – This mode of operation is a maintenance, debugging and disaster recovery mode. While the switch is in this mode, no network traffic is routed between the network interfaces. In this state the switch may be configured to upload a new boot image from a specified TFTP server, perform configuration tasks and run various debugging commands. It should be noted that while no administrator password is required to enter

ROM monitor mode, physical access to the switch is required, therefore the switch should be stored in a physically secure location to avoid unauthorized access which may lead to the switch being placed in an insecure state.

Following operational error the switch reboots (once power supply is available) and enters booting mode. The only exception to this is if there is an error during the Power on

Startup Test (POST) during bootup, then the TOE will shutdown or reboot to try to correct the issues. If any component reports failure for the POST, the system crashes and appropriate information is displayed on the screen, and saved in the crashinfo file.

All ports are blocked from moving to forwarding state during the POST. Only when all components of all modules pass the POST is the system placed in FIPS PASS state and ports are allowed to forward data traffic.

5.1 Network Processes Available During Normal Operation

The following network-based processes are running, or can be run in the evaluated configurations of the Cat2K/3K, except where restricted by ACLs, or VLAN ACLs.:



ICMP is supported inbound and outbound for detection and troubleshooting of network connectivity.



IPsec including ESP and IKE is supported for encryption of syslog traffic to an external audit server, and potentially to secure other traffic to/from external entities.



RADIUS is supported for authentication of administrative connections to the console and/or via SSH.



Routing protocols: The evaluated configuration supports use of BGPv4, EIGRP,

EIGRPv6 for IPv6, PIM-SMv2, and OSPFv2, OSPFv3 for IPv6 and RIPv2. The routing protocols, BGPv4, EIGRP, EIGRPv6 for IPv6, PIM-SMv2, and OSPFv2,

OSPFv3 for IPv6 supports routing updates with IPv4 or IPv6, while RIPv2 routing protocol support routing updates for IPv4 only. All these routing protocols support authentication of neighbor routers using MD5. Neither the authentication functions of those protocols, nor the use of MD5 were evaluated under Common Criteria.



SSHv2 is supported inbound and outbound for remote administrative access to the

Cat3K, or to initiate administrative access to an external network device or other device/server running SSH. However this must be run through an IPsec tunnel.



Syslog is supported outbound for transmission of audit records to a remote syslog server (syslog connections must be tunneled through IPsec).



TACACS+ is supported for authentication of administrative connections to the console and/or via IPsec.

6. Security Measures for the Operational Environment

Proper operation of the TOE requires functionality from the environment. It is the responsibility of the authorized users of the TOE to ensure that the TOE environment provides the necessary functions. The following identifies the requirements and the associated security measures of the authorized users.

Security Objective for the

Operational Environment

(from the Security Target)

Definition of the Security

Objective

(from the Security Target)

OE.NO_GENERAL_PURPOSE There are no general-purpose computing capabilities (e.g., compilers or user applications) available on the TOE, other than those services necessary for the operation, administration and support of the TOE.

OE.PHYSICAL Physical security, commensurate with the value of the TOE and the data it contains, is provided by the environment.

OE.TRUSTED_ADMIN TOE Administrators are trusted to follow and apply all administrator guidance in a trusted manner.

Responsibility of the

Administrators

None. IOS is a purpose-built operating system that does not allow installation of additional software.

The Cat2K/3K must be installed to a physically secured location that only allows physical access to authorized personnel.

Administrators must read, understand, and follow the guidance in this document to securely install and operate the

Cat2K/3K and maintain secure communications with components of the operational environment.

7. Obtaining Documentation and Submitting a Service

Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation at:

With CCO login: http://www.cisco.com/en/US/partner/docs/general/whatsnew/whatsnew.html

Without CCO login: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What's New in Cisco Product Documentation as a Really Simple

Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.

You can access the most current Cisco documentation on the World Wide Web at the following sites:

 http://www.cisco.com

 http://www-china.cisco.com

 http://www-europe.cisco.com

7.1 Documentation Feedback

If you are reading Cisco product documentation on the World Wide Web, you can submit technical comments electronically. Click Feedback in the toolbar and select

Documentation. After you complete the form, click Submit to send it to Cisco.

You can e-mail your comments to [email protected].

To submit your comments by mail, for your convenience many documents contain a response card behind the front cover. Otherwise, you can mail your comments to the following address:

Cisco Systems, Inc., Document Resource Connection

170 West Tasman Drive

San Jose, CA 95134-9883

We appreciate your comments.

7.2 Obtaining Technical Assistance

Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain documentation, troubleshooting tips, and sample configurations from online tools. For Cisco.com registered users, additional troubleshooting tools are available from the TAC website.

Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information and resources at anytime, from anywhere in the world. This highly integrated Internet application is a powerful, easy-to-use tool for doing business with Cisco.

Cisco.com provides a broad range of features and services to help customers and partners streamline business processes and improve productivity. Through Cisco.com, you can find information about Cisco and our networking solutions, services, and programs. In addition, you can resolve technical issues with online technical support, download and test software packages, and order Cisco learning materials and merchandise. Valuable online skill assessment, training, and certification programs are also available.

Customers and partners can self-register on Cisco.com to obtain additional personalized information and services. Registered users can order products, check on the status of an order, access technical support, and view benefits specific to their relationships with

Cisco.

To access Cisco.com, go to the following website: http://www.cisco.com

ನಮಸ್ಕಾರ! Cisco 2960S ನೊಂದಿಗೆ ನಿಮಗೆ ಸಹಾಯ ಮಾಡಲು ನಿರ್ದಿಷ್ಟವಾಗಿ ತರಬೇತಿ ಪಡೆದ AI ಚಾಟ್‌ಬಾಟ್ ನಾನು. ನಾನು ಡಾಕ್ಯುಮೆಂಟ್ ಅನ್ನು ಸಂಪೂರ್ಣವಾಗಿ ಪರಿಶೀಲಿಸಿದ್ದೇನೆ ಮತ್ತು ನಿಮಗೆ ಅಗತ್ಯವಿರುವ ನಿಖರವಾದ ಮಾಹಿತಿಯನ್ನು ಪತ್ತೆಹಚ್ಚಲು ಅಥವಾ ವಿಷಯವನ್ನು ಸ್ಪಷ್ಟ ಮತ್ತು ಸರಳ ಪದಗಳಲ್ಲಿ ವಿವರಿಸಲು ನಾನು ನಿಮಗೆ ಸಹಾಯ ಮಾಡಬಹುದು. ನಿರ್ದಿಷ್ಟ ವೈಶಿಷ್ಟ್ಯಗಳು, ದೋಷನಿವಾರಣೆ ಹಂತಗಳು ಅಥವಾ ಸಾಮಾನ್ಯ ಬಳಕೆಯ ಕುರಿತು ನೀವು ಮಾರ್ಗದರ್ಶನವನ್ನು ಹುಡುಕುತ್ತಿರಲಿ, ನಿಮ್ಮ ಪ್ರಶ್ನೆಗಳನ್ನು ಕೇಳಲು ಮುಕ್ತವಾಗಿರಿ. ನಿಮ್ಮ ಕಾಳಜಿಗಳು ಅಥವಾ ಅಗತ್ಯಗಳ ಬಗ್ಗೆ ನೀವು ಹೆಚ್ಚು ವಿವರಗಳನ್ನು ಒದಗಿಸಿದರೆ, ನಾನು ಹೆಚ್ಚು ನಿಖರವಾಗಿ ಮತ್ತು ಪರಿಣಾಮಕಾರಿಯಾಗಿ ನಿಮಗೆ ಸಹಾಯ ಮಾಡಬಹುದು!

ಸಹಾಯಕ ಟೈಪ್ ಮಾಡುತ್ತಿದ್ದಾರೆ

ಸಹಾಯಕ ಕೀಬೋರ್ಡ್‌ನಿಂದ ಹೊರಗಿದ್ದಾರೆ. ದಯವಿಟ್ಟು, ನಂತರ ಮತ್ತೆ ಪ್ರಯತ್ನಿಸಿ.

ವಿಷಯಗಳ ಕೋಷ್ಟಕ

ಬಹು ಭಾಷೆಗಳಲ್ಲಿ ಬರೆಯಲಾದ ಡಾಕ್ಯುಮೆಂಟ್ ಅನ್ನು ನೀವು ತಲುಪಿದಂತೆ ಕಾಣುತ್ತದೆ, ನಿಮ್ಮ ಸ್ಥಳೀಯ ಭಾಷೆಯಲ್ಲದ ಒಂದು ಭಾಷೆಯೂ ಸೇರಿದಂತೆ. ನೀವು ಇಷ್ಟಪಡದ ಭಾಷೆಯಿಲ್ಲದ ಪುಟಗಳನ್ನು ತಾತ್ಕಾಲಿಕವಾಗಿ ಮರೆಮಾಡಲು ನೀವು ಕೆಳಗಿನ ಲಿಂಕ್‌ಗಳನ್ನು ಬಳಸಬಹುದು.

ಜಾಹಿರಾತು

EDCS-1326081

Cisco Catalyst 2960S, 2960C, 3560V2 and 3750V2 Switches

Common Criteria

Operational User Guidance and

Preparative Procedures

Version 1.5

31 January 2014

Table of Contents

1.

Introduction

1.1 Audience

1.2 Purpose

1.3 Document References

1.4 Supported Hardware and Software

1.5 Operational Environment

1.6 Excluded Functionality

2.

Secure Acceptance of the TOE

3.

Secure Installation and Configuration

3.1 Physical Installation

3.2 Initial Setup via Direct Console Connection

3.2.1 Options to be chosen during the initial setup of the

Cat2K/3K Switch

3.2.2 Saving Configuration

3.3 Secure Remote Management

3.3.1 FIPS Mode

3.4 Administration of Cryptographic Self-Tests

3.5 Administration of Non-Cryptographic Self-Tests

3.5.1 Access Control and Lockout

3.6 Network Protocols and Cryptographic Settings

3.6.3 Routing Protocols

3.6.4 Configuration of IPsec

3.6.4.1 Main Mode vs. Aggressive Mode for IKEv1

3.6.4.2 Lifetime Limits for IKEv1 Phase 1 SAs and Phase 2 SAs (IPsec

SAs)

3.6.4.3 Using Pre-Shared Keys for Authentication

3.6.4.4 Tunnel Mode vs. Transport Mode

3.6.4.5 IKEv1 Parameters Permitted in the Evaluated Configuration

3.6.4.6 IPsec Parameters Permitted in the Evaluated Configuration

3.6.4.7 Session Protection

3.6.4.7.1 Syslog Server Running on an IPsec Endpoint

3.6.4.7.2 Syslog Server Adjacent to an IPSec Peer

3.7 Logging Configuration

3.7.1 Remote Logging

3.7.2 Reviewing Audited Events

3.7.3 Deleting Audit Records

3.8 Information Flow Policies-ACL

4.

Secure Management

4.1 User Roles

4.2 Passwords

4.3 Clock Management

4.4 Identification and Authentication

4.5 Administrative Banner Configuration

4.6 Use of Administrative Session Lockout and Termination

5.

Modes of Operation

5.1 Network Processes Available During Normal Operation

6.

Security Measures for the Operational Environment

7.

Obtaining Documentation and Submitting a Service

Request

7.1 Documentation Feedback

7.2 Obtaining Technical Assistance

ಸಂಬಂಧಿತ

Cisco IKE: Initiate Aggressive Mode Configuration Guide

Cisco Cloud Services Router 1000V Configuration Guide

Cisco Router Syslog Manual | AI Chat & PDF Download

Cisco CSR 1000V Configuration Guide: AI Chat & PDF

Beijer ELECTRONICS CloudVPN Gateway Ethernet User Guide

OSPFv2 Cryptographic Authentication Configuration Guide

Cisco Catalyst 2K/3K Wired Access Switches Operational User Guidance

Cisco Crypto Conditional Debug Support: AI Chat & PDF Access

Cisco Catalyst 3K/4K Wired Access Switches Operational User Guide

Universal Electronics Hashi User Manual

Cisco MS320 250W AC Datasheet