Juniper QFX5100 Admin Guide

Below you will find brief information for QFX5100 Network Switch, EX4600 Network Switch. This guide provides instructions for configuring Junos OS on QFX5100 and EX4600 network switches to comply with the Common Criteria Network Device Protection Profile (NDPP). It covers securing connections, authorizing administrators, configuring system messages, logging events, and setting security settings.

PDF

Document

Junos ® OS

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Release

14.1X53-D30

Modified: 2015-11-09

Juniper Networks, Inc.

1133 Innovation Way

Sunnyvale, California 94089

USA

408-745-2000 www.juniper.net

Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United

States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.

Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

Junos

OS Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Releases 14.1X53-D30

The information in this document is current as of the date on the title page.

YEAR 2000 NOTICE

Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.

END USER LICENSE AGREEMENT

The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at http://www.juniper.net/support/eula.html

. By downloading, installing or using such software, you agree to the terms and conditions of that EULA.

Abbreviated Table of Contents

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Introduction to Common Criteria Network Device Protection

Profile

Common Criteria NDPP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Preparing Junos OS for Common Criteria NDPP

Preparing Junos OS for Common Criteria NDPP . . . . . . . . . . . . . . . . . . . . . . . . 7

Configuring Junos OS for Common Criteria NDPP

Securing Management Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Authorizing Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Configuring System Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Configuring Idle Timeout and Session Disconnection . . . . . . . . . . . . . . . . . . 27

Configuring Event Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Configuring Firewall Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Additional NDPP Guidance

Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Understanding Event Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Index

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

iii

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Documentation and Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Supported Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Using the Examples in This Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Merging a Full Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Merging a Snippet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

Documentation Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi

Requesting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi

Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi

Opening a Case with JTAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Introduction to Common Criteria Network Device Protection

Profile

Common Criteria NDPP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Understanding Common Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Common Criteria Terms and Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Preparing Junos OS for Common Criteria NDPP

Preparing Junos OS for Common Criteria NDPP . . . . . . . . . . . . . . . . . . . . . . . . 7

Identifying Secure Delivery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Downloading Software Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Installing Software Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Overview of the Software Installation Process . . . . . . . . . . . . . . . . . . . . . . . . . 9

Installing Software Upgrades on the Switch . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Verifying the Digital Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Configuring Junos OS for Common Criteria NDPP

Securing Management Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Using the Console Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Configuring SSH Service to Protect Remote Connections . . . . . . . . . . . . . . . . . . . 18

Default Management Service Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Disabling SNMP and DHCP Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Authorizing Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Authorized Administrator Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Configuring Common Criteria NDPP Authorized Administrator . . . . . . . . . . . . . . . 22

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Configuring System Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Configuring System Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Configuring Idle Timeout and Session Disconnection . . . . . . . . . . . . . . . . . . 27

Configuring Idle Timeout and Session Disconnection . . . . . . . . . . . . . . . . . . . . . . . 27

idle-timeout (System-Login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Configuring Event Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Event Logging Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Configuring Event Logging File Locations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring Event Logging to a Local File . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring Event Logging to a Remote Server . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring Event Logging to a Remote Server When Initiating the

Connection from the Remote Server . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring Event Logging to a Remote Server When Initiating the

Connection from the NDPP Device . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Configuring the Client Alive Mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Configuring the System Log Message Timestamp . . . . . . . . . . . . . . . . . . . . . . . . . 33

Setting the Date and Time Locally . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

time-format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

set date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Configuring Firewall Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Configuring Firewall Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Filtering Default Network Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Additional NDPP Guidance

Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Choosing and Using Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Understanding Event Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Interpreting Event Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Logging of Audit Startup and Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Logging Failure to Establish an SSH Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Logging Establishment or Termination of an SSH session . . . . . . . . . . . . . . . . . . . 45

Logging Changes to the System Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Logging Initiation of a System Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Logging Completion of a TSF Self-Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Logging Attempts at Unlocking an Interactive Session . . . . . . . . . . . . . . . . . . . . . 47

Logging Termination of a Remote Session by the Session Locking

Mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Logging Termination of an Interactive Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Logging Initiation of a Trusted Channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Logging Termination of a Trusted Channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Part 5

Table of Contents

Logging Failure of Trusted Channel or Trusted Path Functions . . . . . . . . . . . . . . . 49

System Log Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

SSHD_LOGIN_FAILED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

UI_AUTH_EVENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

UI_CFG_AUDIT_OTHER . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

UI_CLI_IDLE_TIMEOUT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

UI_CMDLINE_READ_LINE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

UI_LOGIN_EVENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

UI_LOGOUT_EVENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Index

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

vii

List of Tables

Part 4

Chapter 10

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Table 1: Supported Platforms and Install Images . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Table 2: Notice Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv

Table 3: Text and Syntax Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

Additional NDPP Guidance

Understanding Event Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Table 4: Fields in Event Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

About the Documentation

•

Documentation and Release Notes on page xi

•

Supported Platforms on page xi

•

Using the Examples in This Manual on page xii

•

Documentation Conventions on page xiii

•

Documentation Feedback on page xvi

•

Requesting Technical Support on page xvi

Documentation and Release Notes

To obtain the most current version of all Juniper Networks

® technical documentation, see the product documentation page on the Juniper Networks website at http://www.juniper.net/techpubs/ .

If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes.

Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at http://www.juniper.net/books .

Supported Platforms

For the features described in this document, and to operate in accordance with the NDPP certification,

Table 1 on page xi

shows the platforms that are supported and their install images.

Table 1: Supported Platforms and Install Images

Platform Install Image

EX4600

QFX5100 jinstall-ex-4600-junos14.1X53-D30.3-domestic-signed.tgz

jinstall-qfx-5-14.1X53-D30.3-domestic-signed.tgz

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Using the Examples in This Manual

If you want to use the examples in this manual, you can use the load merge or the load merge relative command. These commands cause the software to merge the incoming configuration into the current candidate configuration. The example does not become active until you commit the candidate configuration.

If the example configuration contains the top level of the hierarchy (or multiple hierarchies), the example is a full example . In this case, use the load merge command.

If the example configuration does not start at the top level of the hierarchy, the example is a snippet . In this case, use the load merge relative command. These procedures are described in the following sections.

Merging a Full Example

To merge a full example, follow these steps:

From the HTML or PDF version of the manual, copy a configuration example into a text file, save the file with a name, and copy the file to a directory on your routing platform.

For example, copy the following configuration to a file and name the file ex-script.conf

Copy the ex-script.conf

file to the /var/tmp directory on your routing platform.

system { scripts { commit { file ex-script.xsl;

}

} interfaces { fxp0 { disable; unit 0 { family inet { address 10.0.0.1/24;

}

Merge the contents of the file into your routing platform configuration by issuing the load merge configuration mode command:

[edit] user@host# load merge /var/tmp/ex-script.conf

About the Documentation

Merging a Snippet

To merge a snippet, follow these steps:

From the HTML or PDF version of the manual, copy a configuration snippet into a text file, save the file with a name, and copy the file to a directory on your routing platform.

For example, copy the following snippet to a file and name the file ex-script-snippet.conf

. Copy the ex-script-snippet.conf

file to the /var/tmp directory on your routing platform.

commit { file ex-script-snippet.xsl; }

Move to the hierarchy level that is relevant for this snippet by issuing the following configuration mode command:

[edit] user@host# edit system scripts

[edit system scripts]

Merge the contents of the file into your routing platform configuration by issuing the load merge relative configuration mode command:

[edit system scripts] user@host# load merge relative /var/tmp/ex-script-snippet.conf

load complete

For more information about the load command, see the CLI User Guide .

Documentation Conventions

Table 2 on page xiv

defines notice icons used in this guide.

xiii

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Table 2: Notice Icons

Icon Meaning

Informational note

Caution

Warning

Laser warning

Tip

Best practice

Description

Indicates important features or instructions.

Indicates a situation that might result in loss of data or hardware damage.

Alerts you to the risk of personal injury or death.

Alerts you to the risk of personal injury from a laser.

Indicates helpful information.

Alerts you to a recommended use or implementation.

The CLI has two modes, operational mode and configuration mode.

• Operational mode—This mode displays the current status of the device. In operational mode, you enter commands to monitor and troubleshoot the Junos OS, devices, and network connectivity. Operational mode is indicated by the > prompt—for example:

• user@switch> clear

Configuration mode—A Junos OS device configuration is stored as a hierarchy of statements. In configuration mode, you can define all properties of the Juniper Networks

Junos OS, including interfaces, VLANs, Virtual Chassis information, user access, and several system hardware properties. To enter configuration mode, enter the configure command. Configuration mode is indicated by the # prompt and includes the current location in the configuration hierarchy—for example:

[edit interfaces ge-0/0/12] user@switch#

In configuration mode, you are actually viewing and changing the candidate configuration file. The candidate configuration allows you to make configuration changes without causing operational changes to the current operating configuration, called the active configuration. When you commit the changes you added to the candidate configuration, the system updates the active configuration. Candidate configurations enable you to alter your configuration without causing potential damage to your current network operations.

To activate your configuration changes, enter the commit command.

Table 3 on page xv

defines the text and syntax conventions used in this guide.

About the Documentation

Table 3: Text and Syntax Conventions

Convention Description

Bold text like this

Fixed-width text like this

Italic text like this

Text like this

< > (angle brackets)

| (pipe symbol)

# (pound sign)

Examples

Represents text that you type.

To enter configuration mode, type the configure command: user@host> configure

Represents output that appears on the terminal screen.

user@host> show chassis alarms

No alarms currently active

•

• Introduces or emphasizes important new terms.

Identifies guide names.

Identifies RFC and Internet draft titles.

•

A policy term is a named structure that defines match conditions and actions.

Junos OS CLI User Guide

RFC 1997, BGP Communities Attribute

Represents variables (options for which you substitute a value) in commands or configuration statements.

Configure the machine’s domain name:

[edit] root@# set system domain-name domain-name

Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components.

•

To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level.

The console port is labeled CONSOLE .

Encloses optional keywords or variables.

stub <default-metric metric >;

Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity.

broadcast | multicast

( string1 | string2 | string3 )

Indicates a comment specified on the same line as the configuration statement to which it applies.

rsvp { # Required for dynamic MPLS only

[ ] (square brackets)

Indention and braces ( { } )

; (semicolon)

Encloses a variable for which you can substitute one or more values.

Identifies a level in the configuration hierarchy.

Identifies a leaf statement at a configuration hierarchy level.

community name members [ community-ids ]

[edit] routing-options { static { route default { nexthop address; retain;

}

GUI Conventions

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Table 3: Text and Syntax Conventions (continued)

Convention Description

Bold text like this

> (bold right angle bracket)

Examples

Represents graphical user interface (GUI) items you click or select.

•

In the Logical Interfaces box, select

All Interfaces .

To cancel the configuration, click

Cancel .

Separates levels in a hierarchy of menu selections.

In the configuration editor hierarchy, select Protocols>Ospf .

Documentation Feedback

We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods:

• Online feedback rating system—On any page at the Juniper Networks Technical

Documentation site at http://www.juniper.net/techpubs/index.html

, simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience. Alternately, you can use the online feedback form at http://www.juniper.net/techpubs/feedback/ .

• E-mail—Send your comments to [email protected]

. Include the document or topic name, URL or page number, and software version (if applicable).

Requesting Technical Support

Technical product support is available through the Juniper Networks Technical Assistance

Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC.

• JTAC policies—For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf

• Product warranties—For product warranty information, visit http://www.juniper.net/support/warranty/ .

• JTAC hours of operation—The JTAC centers have resources available 24 hours a day,

7 days a week, 365 days a year.

Self-Help Online Tools and Resources

For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: xvi Copyright © 2015, Juniper Networks, Inc.

About the Documentation

• Find CSC offerings: http://www.juniper.net/customers/support/

• Search for known bugs: http://www2.juniper.net/kb/

• Find product documentation: http://www.juniper.net/techpubs/

• Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/

• Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/

• Search technical bulletins for relevant hardware and software notifications: http://kb.juniper.net/InfoCenter/

• Join and participate in the Juniper Networks Community Forum: http://www.juniper.net/company/communities/

• Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/

To verify service entitlement by product serial number, use our Serial Number Entitlement

(SNE) Tool: https://tools.juniper.net/SerialNumberEntitlementSearch/

Opening a Case with JTAC

You can open a case with JTAC on the Web or by telephone.

• Use the Case Management tool in the CSC at http://www.juniper.net/cm/ .

• Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

For international or direct-dial options in countries without toll-free numbers, see http://www.juniper.net/support/requesting-support.html

xvii

PART 1

Introduction to Common Criteria Network

Device Protection Profile

•

Common Criteria NDPP Overview on page 3

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

CHAPTER 1

Common Criteria NDPP Overview

•

Understanding Common Criteria on page 3

•

Common Criteria Terms and Acronyms on page 4

Understanding Common Criteria

The Common Criteria for information security technology is an international agreement signed by 28 countries to permit the evaluation of security products against a common set of standards. In the Common Criteria Recognition Arrangement (CCRA) http://www.commoncriteriaportal.org/ccra/ , the signatories agree to mutually recognize evaluations of products performed in other countries. All evaluations are performed using a common methodology for Information Technology security evaluation.

The Common Criteria Network Device Protection Profile (NDPP) details the requirements to target several areas of threats and policies that are common to network devices. This guide provides details of how to administer and operate supported platforms running

Junos

® operating system (Junos OS) 14.1X53-D30 to be compliant with the requirements specified in the NDPP. The Junos OS targets several areas of threats and policies that are common to network devices to deliver a Common Criteria Network Device Protection

Profile (NDPP) for devices running Junos OS Release 14.1X53-D30. These areas include:

• Providing security functionality that addresses threats to the network device and implements policies that are imposed by law or regulation.

• Protecting communications with remote administrators and external system log servers using SSHv2.

• Offering identification and authentication services that support the composition of moderately complex passwords and that are available both through local login and remote login and support of public key-based authentication for remote login.

• Authorization of administrators, presenting an administrator-configured access consent banner.

• Auditing events associated with security-relevant activity on the target device and storing these events on a device distinct from the target device.

• Providing the ability to verify the source of updates to the device.

Other security functionality of the target device, such as the use of IPsec and firewall filters, is not covered by this evaluation. Likewise, use of cryptographic engines other than

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices those specified in this guidance is not supported for NDPP compliance, as these engines were not analyzed or tested as part of the evaluation activities.

For more information about Common Criteria, see http://www.commoncriteriaportal.org/ .

Documentation

•

Identifying Secure Delivery on page 7

Common Criteria Terms and Acronyms

EAL Evaluation Assurance Level. An assurance requirement defined by Common Criteria. For example, EAL2 is Evaluation Assurance Level 2, and EAL3 is Evaluation Assurance Level 3.

Higher levels have more stringent requirements.

ECC Elliptical Curve Cryptography. A public key algorithm technique applied over an elliptical curve

(a mathematical expression). Operations over an elliptical curve are known to be faster and more secure, and provide equivalent security using a smaller number of bits.

ECDH

ECDSA

FIPS

TOE

Elliptical Curve Diffie-Hellman. Applies the Diffie-Hellman algorithm over an elliptical curve.

Elliptical curve digital signature algorithm. Applies digital signatures over an elliptical curve.

Federal Information Processing Standard. FIPS 140-2 and FIPS 140-3 deal with security and cryptographic modules.

Target of Evaluation. Used to identify the component under evaluation for compliance.

PART 2

Preparing Junos OS for Common Criteria

NDPP

•

Preparing Junos OS for Common Criteria NDPP on page 7

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

CHAPTER 2

Preparing Junos OS for Common Criteria

NDPP

•

Identifying Secure Delivery on page 7

•

Downloading Software Packages on page 8

•

Installing Software Packages on page 9

Identifying Secure Delivery

There are several mechanisms provided in the delivery process to ensure that a customer receives a product that has not been tampered with. The customer should perform the following checks upon receipt of an appliance to verify the integrity of the platform:

• Shipping label—Ensure that the shipping label correctly identifies the correct customer name and address as well as the device.

• Outside packaging—Inspect the outside shipping box and tape. Ensure that the shipping tape has not been cut or otherwise compromised. Ensure that the box has not been cut or damaged to allow access to the device.

• Inside packaging—Inspect the plastic bag and seal. Ensure that the bag is not cut or removed. Ensure that the seal remains intact.

If the customer identifies a problem during the inspection, he or she should immediately contact the supplier. Provide the order number, tracking number, and a description of the identified problem to the supplier.

Additionally, there are several checks that can be performed to ensure that the customer has received a box sent by Juniper Networks and not a different company masquerading as Juniper Networks. The customer should perform the following checks upon receipt of a device to verify the authenticity of the device:

• Verify that the device was ordered using a purchase order. Juniper Networks devices are never shipped without a purchase order.

• When a device is shipped, a shipment notification is sent to the e-mail address provided by the customer when the order is taken. Verify that this e-mail notification was received.

Verify that the e-mail contains the following information:

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

• Purchase order number

• Juniper Networks order number used to track the shipment

• Carrier tracking number used to track the shipment

• List of items shipped including serial numbers

• Address and contacts of both the supplier and the customer

• Verify that the shipment was initiated by Juniper Networks. To verify that a shipment was initiated by Juniper Networks, perform the following tasks:

• Compare the carrier tracking number of the Juniper Networks order number listed in the Juniper Networks shipping notification with the tracking number on the package received.

• Log in to the Juniper Networks online customer support portal at https://www.juniper.net/customers/csc/management to view the order status.

Compare the carrier tracking number or the Juniper Networks order number listed in the Juniper Networks shipment notification with the tracking number on the package received.

Downloading Software Packages

In order to achieve the Common Criteria NDPP environment, your switch must be running

Release 14.1X53-D30 for your device, as specified in

Table 1 on page xi . Before you begin

to download the software, ensure that you have a Juniper Networks Web account and a valid support contract. To obtain an account, complete the registration form at the

Juniper Networks website: https://www.juniper.net/registration/Register.jsp

To download software upgrades from Juniper Networks:

Using a Web browser, follow the links to the download URL on the Juniper Networks webpage. For EX and QFX Series, there are not separate software packages for Canada the U.S. and other locations. Therefore, select Canada and U.S. Version regardless of your location:

• https://www.juniper.net/support/downloads/junos.html

Log in to the Juniper Networks authentication system using the username (generally your e-mail address) and password supplied by Juniper Networks representatives.

Select the appropriate software package. Ensure that the name contains the correct switch name and number of the Junos OS release that is FIPS-certified on the switches.

For example, jinstall-qfx-5-14.1X53-D30.3-domestic-signed.tgz

Chapter 2: Preparing Junos OS for Common Criteria NDPP

NOTE: domestic-signed is appended to all EX and QFX Series package names. Although other Juniper Networks platforms use a domestic package for the United States and Canada and an export package for worldwide distribution, EX and QFX Series switches use domestic for both domestic and worldwide distribution.

Download the software to a local host or to an internal software distribution site.

NOTE: When downloading the Junos install package from the Juniper support site, note the SHA-1 value in the Checksum column. These are used to verify the file integrity of the Junos install package in Installing

Software Packages.

Documentation

• Junos OS 14.1 Installation and Upgrade Guide

Installing Software Packages

•

Overview of the Software Installation Process on page 9

•

Installing Software Upgrades on the Switch on page 10

•

Verifying the Digital Signature on page 12

Overview of the Software Installation Process

EX Series and QFX Series switches are delivered with a domestic version of Junos OS preinstalled. When you connect power to the switch, it starts (boots) from the installed software. For information about initial configuration of and EX4600 switch, see Configuring an EX4600 Switch in the EX4600 Switch Hardware Guide . For information about initial configuration of a QFX5100 switch, see Configuring a QFX5100 Device in the QFX5100

Hardware Guide .

As new features and software fixes become available, you must upgrade your software to use them. You upgrade Junos OS on an EX Series or QFX Series switch by copying a software package to your switch or another system on your local network, then use the command-line interface (CLI) to install the new software package on the switch. Finally, you reboot the switch; it boots from the upgraded software. After a successful upgrade, you should back up the new current configuration to a secondary device. You should following this procedure regardless of whether you are installing a domestic or controlled

Junos OS package.

During a successful upgrade, the upgrade package removes all files from /var/tmp and completely reinstalls the existing software. It retains configuration files, and similar information, such as secure shell and host keys, from the previous version. The previous software package is preserved in a separate disk partition, and you can manually revert back to it if necessary. If the software installation fails for any reason, such as loss of

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices power during the installation process, the system returns to the originally active installation when you reboot.

Installing Software Upgrades on the Switch

To install software upgrades on the switch:

(Optional) Copy the software package to the switch. We recommend that you use

FTP to copy the file to the /var/tmp directory.

This step is optional because Junos OS can also be upgraded when the software image is stored at a remote location. These instructions describe the software upgrade process for both scenarios.

Verify that the SHA-1 checksum value for the Junos install package copied to the Junos device matches the checksum noted on the Juniper support site. This ensures that the transferred file is ready to use for installation, and that it is not truncated or a corrupted file.

When downloading the Junos install package from the Juniper support site, note the SHA-1 value in the Checksum column.

Use the file checksum sha1 command to verify that the Junos install package is present and that the checksum matches the value on the Juniper support site: user@switch> file checksum sha1

/var/tmp/jinstall-ex-4600-junos14.1X53-D30.3-domestic-signed.tgz

SHA1 (/var/tmp/jinstall-ex-4600-Junos-14.1X53-D30.3-domestic-signed.tgz) =

ba9e47120c7ce55cff29afd73eacd370e162c676

Install the new package on the switch. We recommend that you use the force-host option to force installing the latest version of CentOS: user@switch> request system software add force-host package

Replace package with one of the following paths:

• For a software package in a local directory on the switch— /var/tmp/ package .tgz

• For a software package on a remote server:

• ftp:// hostname / pathname / package .tgz.

• http:// hostname / pathname / package .tgz.

where package .tgz is, for example, jinstall-ex-4600-Junos-14.1X53-D30.3-domestic-signed.tgz

NOTE: To abort the installation, do not reboot your device; instead, finish the installation and then issue the request system software delete

package.tgz command, where package.tgz is, for example, jinstall-ex-4600-Junos-14.1X53-D30.3-domestic-signed.tgz

. This is your last chance to stop the installation.

Reboot to start the new software:

Chapter 2: Preparing Junos OS for Common Criteria NDPP

user@switch> request system reboot

After the reboot has completed, log in and verify that the new version of the software is properly installed by running the show version command: user@switch> show version

Hostname: switch

Model: ex4600-40f

Junos: 14.1X53-D30.3

JUNOS EX Software Suite [14.1X53-D30.3]

JUNOS FIPS mode utilities [14.1X53-D30.3]

JUNOS Online Documentation [14.1X53-D30.3]

JUNOS EX 4600 Software Suite [14.1X53-D30.3]

JUNOS Web Management Platform Package [14.1X53-D30.3]

JUNOS py-base-powerpc [14.1X53-D30.3]

If the switch gets stuck in the boot process and fails to load the Junos OS after upgrade, or if the Junos OS loads but the CLI is not working, see Troubleshooting Software

Installation in the Junos OS Installation and Upgrade Guide .

After installing the Junos OS Release 14.1X53 software, you can install the Junos FIPS mode package and configure the SSH server to achieve the Common Criteria NDPP environment.

To install the FIPS mode package:

Download the Junos-FIPS Mode Install Package from https://www.juniper.net/support//downloads/?p=junosfips#sw . Select the 14.1X53-D30 release from the version drop-down list and download the package named:

• fips-mode-i386-14.1X53-D30.3-signed.tgz

When downloading the Junos install package from the Juniper support site, note the SHA-1 value in the Checksum column.

Use the file checksum sha1 command to verify that the Junos install package is present and that the checksum matches the value on the Juniper support site: user@switch> file checksum sha1 /var/tmp/fips-mode-i386-14.1X53-D30.3-signed.tgz

SHA1 (/var/tmp/fips-mode-i386-14.1X53-D30.3-signed.tgz) =

2aedfa17e6c1b6216d6cfd3265953136b8153ac3

Connect to the console port on the device, and log in to the Junos OS command line interface.

See the Junos OS 14.1 Installation and Upgrade Guide for instructions.

(Optional) Back up the current software configuration to a second storage option.

See the Junos OS 14.1 Installation and Upgrade Guide for instructions.

(Optional) Copy the software package to the /var/tmp directory.

Install the new package on the switch.

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices user@host> request system software add package

Replace package with /var/tmp/ package .tgz

Reboot to start the new software: user@host> request system reboot

After the reboot has completed, log in and verify that the new version of the software is properly installed by running the show version command.

NOTE: For Common Criteria NDPP compliance, FIPS mode must not be enabled when the package is installed. Follow the guidance for using the

FIPS package to configure the SSH server to achieve the Common Criteria

NDPP (see

“Configuring SSH Service to Protect Remote Connections” on page 18 l ).

Verifying the Digital Signature

The digital signature is verified by default as part of the installation build process.

Successful verification is indicated in the install log as follows: user@switch> request system software add jinstall-14.2-20150812.0-domestic-signed.tgz

no-validate

Installing package '/var/home/regress/jinstall-14.2-20150812.0-domestic-signed.tgz'

...

Verified jinstall-14.2-20150812.0-domestic.tgz signed by PackageDevelopmentEc_2015

Verified jinstall-14.2-20150812.0-domestic.tgz signed by PackageDevelopmentRSA_2015

Pre-checking requirements for jinstall...

NOTE: The digital signature is applied for the complete install package.

CentOS VM modules in the install package are verified as part of the build process as well as Junos OS install modules.

If verification of the digital signature fails during the build process, the installation will be aborted with following error message: user@switch> request system software add jinstall-14.2-20150812.0-domestic-signed.tgz

no-validate

Installing package '/var/home/regress/jinstall-14.2-20150812.0-domestic-signed.tgz'

...

verify-sig: ERROR: Failed loading signature file fips-mode-i386-14.2-20150807.0.tgz.esig

Package signature verification failed for fips-mode-i386-14.2-20150807.0.tgz

Installation failed for package '/var/home/regress/build/test.tgz'

In the event that verification of the digital signature fails, do not proceed with the installation using that copy of the image. Download the image again as described in

Downloading Software Packages , and reattempt the installation. If that fails, then contact

Chapter 2: Preparing Junos OS for Common Criteria NDPP

Juniper customer support to advise them of the issue (see

“Requesting Technical Support” on page xvi ).

Documentation

• Junos OS Installation and Upgrade Guide

• System Setup Feature Guide for EX Series Switches

• Junos OS Basics Feature Guide for the QFX Series

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

PART 3

Configuring Junos OS for Common Criteria

NDPP

•

Securing Management Connections on page 17

•

Authorizing Administrators on page 21

•

Configuring System Message on page 25

•

Configuring Idle Timeout and Session Disconnection on page 27

•

Configuring Event Logging on page 29

•

Configuring Firewall Filters on page 37

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

CHAPTER 3

Securing Management Connections

•

Using the Console Port on page 17

•

Configuring SSH Service to Protect Remote Connections on page 18

•

Default Management Service Settings on page 19

•

Disabling SNMP and DHCP Services on page 19

Using the Console Port

By default, the console port on the router or switch is enabled. You can use the console port to connect to the Routing Engine through an RJ-45 cable and use the command-line interface (CLI) to configure the device.

Before you begin connecting and configuring an EX4600 or QFX5100 switch, set the following parameter values on the console server or PC:

• Baud rate—9600

• Flow control—None

• Data—8

• Parity—None

• Stop bits—1

• DCD rate—Disregard

For EX4600 console port pinout specifications, see Console Port Connector Pinout

Information for an EX Series Switch . For QFX5100 console port pinout specifications, see

Console Port Connector Pinouts for the QFX Series .

For more information about the EX4600 console connector, see Connecting a Switch to a Management Console . For more information about the QFX5100 console connector, see Connecting a QFX Series Device to a Management Console .

Documentation

• EX4600 Switch Hardware Guide

• QFX5100 Switch Hardware Guide

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Configuring SSH Service to Protect Remote Connections

Use this procedure to configure SSH for NDPP for a router or switch running Junos OS.

Specify the set of ciphers that SSH can use to perform encryption and decryption functions.

[ edit ] administrator@host# set system services ssh ciphers [ aes128-cbc aes256-cbc ]

Specify that the only host-key algorithm enabled is for ECDSA and that algorithms for DSA and RSA are disabled.

[ edit ] administrator@host# set system services ssh hostkey-algorithm ssh-ecdsa administrator@host# set system services ssh hostkey-algorithm no-ssh-dsa administrator@host# set system services ssh hostkey-algorithm no-ssh-rsa

Configure the key exchange method. The supported key exchange methods are

Diffie-Hellman group 14 for SHA-1, Elliptical Curve Diffie-Hellman nistp256 for SHA-2,

Elliptical Curve Diffie-Hellman nistp384 for SHA-2, and Elliptical Curve Diffie-Hellman nistp521 for SHA-2.

[ edit ] administrator@host# set system services ssh key-exchange dh-group14-sha1

[ edit ] administrator@host# set system services ssh key-exchange ecdh-sha2-nistp256

[ edit ] administrator@host# set system services ssh key-exchange ecdh-sha2-nistp384

[ edit ] administrator@host# set system services ssh key-exchange ecdh-sha2-nistp521

Specify the set of message authentication code (MAC) algorithms that the SSH server can use to authenticate messages for NDPP. The MAC algorithms that can be used are hmac-sha1, hmac-sha2-256, and hmac-sha2-512.

[ edit ] administrator@host# set system services ssh macs hmac-sha1

[ edit ] administrator@host# set system services ssh macs hmac-sha2-256

[ edit ] administrator@host# set system services ssh macs hmac-sha2-512

Log out the console session when the serial cable connected to the console port is unplugged.

administrator@host# set system ports console log-out-on-disconnect

Commit the changes.

[ edit ] administrator@host# commit

Chapter 3: Securing Management Connections

NOTE: Any SSHv2-compliant client can be used to establish the Remote

Administrator connection over the configured SSHv2 service.

Default Management Service Settings

By default, the majority of management services, such as SNMP and DHCP, are disabled on EX4600 and QFX5100 switches. Those services disabled by default should not be enabled unless explicitly required for the NDPP configuration.

Disabling SNMP and DHCP Services

By default, SNMP and DHCP services are enabled on EX4600 and QFX5100 switches.

They must be disabled in the NDPP configuration.

To disable SNMP:

Disable the snmp process:

[ edit ] administrator@host# set system processes snmp disable

Commit the changes:

[ edit ] administrator@host# commit

To disable DHCP:

Disable the dhcp process:

[ edit ] administrator@host# set system processes dhcp-service disable

Commit the changes:

[ edit ] administrator@host# commit

NOTE: The administrator can re-enable DHCP services by deleting these commands and configuring DHCP.

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

CHAPTER 4

Authorizing Administrators

•

Authorized Administrator Overview on page 21

•

Configuring Common Criteria NDPP Authorized Administrator on page 22

Authorized Administrator Overview

In Junos OS for NDPP, users who are allowed to make changes to the router or switch are called authorized administrators (or security administrators). An authorized administrator has read and write privileges over key operational components and configuration parameters. An authorized administrator has all permissions, including the ability to change configuration statements and security parameters in addition to other management tasks.

For each authorized administrator account, the following can be defined:

• Username—(Required) Name that identifies the user. It must be unique within the router. Do not include spaces, colons, or commas in the username.

• User’s full name—(Optional) If the full name contains spaces, enclose it in quotation marks. Do not include colons or commas.

• User identifier (UID)—(Optional) Numeric identifier that is associated with the user account name. The identifier must be in the range from 100 through 64,000 and should be unique on the router. If you do not assign a UID to a username, the software assigns one when you commit the configuration, using the lowest available number. You should ensure that the UID is unique. However, you can assign the same UID to different users.

If you do, the CLI displays a warning when you commit the configuration and then assigns the duplicate UID.

• Authentication methods used to access the router must be either password authentication or public-key authentication.

For SSH authentication, you must copy the contents of an SSH key file into the configuration. Use the load-key-file URL filename command to load an SSH key file that was previously generated, for example, by using ssh-keygen . The URL filename is the path to the file’s location and name. The contents of the SSH key file are copied into the configuration immediately after you enter the load-key-file statement.

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Configuring Common Criteria NDPP Authorized Administrator

An account for the user root is always present in the configuration. The root account is not intended for use in normal operation. For the evaluated configuration, the root account is restricted to initial installation and configuration of the evaluated device.

You must configure a Common Criteria NDPP authorized administrator with all permissions, including the ability to change the router configuration. However, the ability to add guest VMs must be disabled.

This procedure shows how to configure an NDPP authorized administrator.

The authentication algorithm for plain-text passwords must be configured as sha1 or sha256.

• For sha1:

[edit] administrator@host# set system login password format sha1

• For sha256:

[edit] administrator@host# set system login password format sha256

Commit the changes.

[edit] root@host# commit

Create a login class named security-admin with permissions all .

[edit] root@host# set system login class security-admin permissions all

Add restrictions to the login class to prevent the configuration of additional VMs.

[edit] root@host# set system login class security-admin deny-commands “request system software add virtual-machine-package|request app-engine virtual-machine-shell|show app-engine virtual-machine" root@host# set system login class security-admin deny-configuration “(services app-engine compute-cluster)|(services app-engine virtual-machines)"

Use the newly-created security-admin class to define your NDPP user authorized administrator named NDPP-admin.

[edit] root@host# set system login user NDPP-admin full-name “Common Criteria NDPP

Authorized Administrator” class security-admin authentication plain-text-password

<password>

New password: type password here

Retype new password: retype password here

(Optional) Configure public key authentication for remote administrators.

[edit] root@host# set system login user NDPP-admin authentication ssh-ecdsa <public-key>

Chapter 4: Authorizing Administrators

Commit the changes.

[edit] root@host# commit

NOTE: The root user password should be reset following the change to sha1 or sha256 for the password storage format. This ensures the new password is protected using a sha1 hash, rather than the default password hashing algorithm. To reset the root user password use the set system login user root authentication plain-text-password password command, and confirm the new password when prompted.

Verify your user setup.

[edit system login user NDPP-admin] root@host# show full-name "Common Criteria NDPP Authorized Administrator"; uid 001; class security-admin; authentication { encrypted-password “$ ABC123 ”; # SECRET-DATA; ssh-ecdsa

“ecdsa-sha2-nistp256

AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCSGe4pk5SCOLzNH01/Ngwc

+QUvlSTokbBFHdgpwhc15P1jw0Mm+AiB9UO72D+HZc8lAd/5082NA1imk7QSYuog= shanbhag@nms5-vm-linux3";

}

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

CHAPTER 5

Configuring System Message

•

Configuring System Message on page 25

•

message on page 25

Configuring System Message

The security administrator must configure a banner with an advisory notice to be displayed before the identification and authentication screen.

The message system login option defines the system login message. This message appears before a user logs in.

message

Syntax message text;

Hierarchy Level [edit system login]

Release Information Statement introduced before Junos OS Release 7.4.

Statement introduced in Junos OS Release 9.0 for EX Series switches.

Description Configure a system login message. This message appears before a user logs in.

You can format the message using the following special characters:

• \n—New line

• \t—Horizontal tab

• \'—Single quotation mark

• \"—Double quotation mark

• \\—Backslash

Options text —Text of the message.

Required Privilege

Level system—To view this statement in the configuration.

system-control—To add this statement to the configuration

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

CHAPTER 6

Configuring Idle Timeout and Session

Disconnection

•

Configuring Idle Timeout and Session Disconnection on page 27

•

idle-timeout (System-Login) on page 28

Configuring Idle Timeout and Session Disconnection

The security administrator can configure a period of time after which an inactive session will be locked and require re-authentication to be unlocked. This helps to protect the device from being idle for a long period before the session times out.

The idle-timeout system login option defines the length of time the CLI operational mode prompt remains active before the session times out.

administrator@host# set system login class class-name idle-timeout minutes

The administrator can also configure the console session to logout when the serial cable connected to the console port is unplugged using the log-out-on-disconnect option at the [edit system ports console] hierarchy level.

administrator@host# set system ports console log-out-on-disconnect

Documentation

•

idle-timeout (System-Login) on page 28

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

idle-timeout (System-Login)

Syntax idle-timeout minutes;

Hierarchy Level [edit system login class class-name]

Release Information Statement introduced before Junos OS Release 7.4.

Statement introduced in Junos OS Release 9.0 for EX Series switches.

Description For a login class, configure the maximum time that a session can be idle before the user is logged out of the router or switch. The session times out after remaining at the CLI operational mode prompt for the specified time.

Default If you omit this statement, a user is never forced off the system after extended idle times.

Options minutes —Maximum idle time.

Range: 0 through 4294967295 minutes

NOTE: The timeout feature is disabled if the value of minutes is set to 0.

Required Privilege

Level admin—To view this statement in the configuration.

admin-control—To add this statement to the configuration.

Documentation

• Configuring the Timeout Value for Idle Login Sessions

• user

CHAPTER 7

Configuring Event Logging

•

Event Logging Overview on page 29

•

Configuring Event Logging File Locations on page 30

•

Configuring the System Log Message Timestamp on page 33

•

Setting the Date and Time Locally on page 34

•

time-format on page 35

•

set date

Event Logging Overview

A secure Junos OS environment requires the auditing of events listed below, and storing them in a local audit file. The recorded events are simultaneously sent to an external syslog server.

A syslog server is required to receive the syslog messages streamed from the switch. The syslog server must have an SSH client with NETCONF support configured to receive the streamed syslog messages.

The logging for NDPP captures the following events:

• Changes to secret data in the configuration.

• Committed changes.

• System startup.

• Login/logout of users.

• Failure to establish an SSH session.

• Establishment/termination of an SSH session.

• Changes to the (system) time.

• Initiation of a system update.

• Completion of TOE Security Functions (TSF) self-tests.

• Attempts at unlocking an interactive session.

• Termination of a remote session by the session locking mechanism.

• Termination of an interactive session.

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

• Initiation of a trusted channel.

• Termination of a trusted channel.

• Failure of functions of a trusted channel or a trusted path.

Configuring Event Logging File Locations

•

Configuring Event Logging to a Local File on page 30

•

Configuring Event Logging to a Remote Server on page 30

Configuring Event Logging to a Local File

You configure the storing of audit information to a local file and the level of detail to be recorded with the syslog statement. The following must be used to ensure all events detailed in NDPP are logged and are stored in a local file (named Audit-File in this example):

[edit system] syslog { file Audit-File { any any;

}

NOTE: The log file should be set to a maximum size of 250 MB. To configure the log file size, use the size statement at the [edit system syslog file filename archive] hierarchy level.

Configuring Event Logging to a Remote Server

You configure the export of audit information to a secure, remote server by setting up an event trace monitor that sends event log messages by using NETCONF over SSH to the remote system event logging server (see

“Configuring SSH Service to Protect Remote

Connections” on page 18 ).

The following procedures show the configuration needed to send system log messages to a secure external server by using NETCONF over SSH.

•

Configuring Event Logging to a Remote Server When Initiating the Connection from the Remote Server on page 30

•

Configuring Event Logging to a Remote Server When Initiating the Connection from the NDPP Device on page 32

•

Configuring the Client Alive Mechanism on page 33

Configuring Event Logging to a Remote Server When Initiating the Connection from the Remote Server

To configure event logging to a remote server when the SSH connection to the NDPP device is initiated from the remote system log server.

Chapter 7: Configuring Event Logging

On the remote system log server, generate an ECDSA public key.

$ ssh-keygen -b 256 -t ecdsa -C 'syslog-monitor key pair' -f ~/.ssh/syslog-monitor

You are prompted to enter a passphrase. The storage locations for the syslog-monitor key pair are shown.

On the NDPP device, create a class named monitor that has permission to trace events.

[edit system login] root@host# set class monitor permissions trace

Create a user named syslog-mon with the class monitor , and with authentication that uses the syslog-monitor key pair from the key pair file located on the remote system log server.

[edit system login] root@host# set user syslog-mon class monitor authentication ssh-ecdsa “ssh-ecdsa xxxxx syslog-monitor key pair”

Set up NETCONF for use with SSH.

[edit system services] root@host# set netconf ssh

Configure the system log to log everything to /var/log/messages .

[edit system ] root@host# set syslog file messages any any

Commit the changes.

[edit ] root@host# commit

On the remote system log server, start up the SSH agent ssh-agent(1) .

$ eval `ssh-agent -s`

On the remote system log server, add the syslog-monitor key pair to ssh-agent(1) .

$ ssh-add ~/.ssh/syslog-monitor

You are prompted to enter the predetermined passphrase. Enter the same passphrase that you used in Step 1.

While you are logged in to the external_syslog_server session, establish a tunnel to the

Junos OS device and start NETCONF.

$ ssh syslog-mon@1NDPP_TOE -s netconf

10.

With NETCONF established, configure a system log events message stream.

<rpc><get-syslog-events><stream>messages</stream></get-syslog-events></rpc>

You should see examples of system log messages (<syslog></syslog>) being received, for example:

May 7 11:40:46 test0 mgd[1522]: UI_CMDLINE_READ_LINE: User 'root', command 'quit'

</syslog>

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

For more information about configuring event logging, see Junos OS 14.1 Administration

Library for Routing Devices .

Configuring Event Logging to a Remote Server When Initiating the Connection from the NDPP Device

To configure event logging to a remote server when the SSH connection to the remote system log server is initiated from the NDPP device:

On the remote system log server, generate an ECDSA public key.

$ ssh-keygen -b 256 -t ecdsa -C 'syslog-monitor key pair' -f ~/.ssh/syslog-monitor

You are prompted to enter a passphrase. The storage locations for the syslog-monitor key pair are shown.

On the NDPP device, create a class named monitor that has permission to trace events.

[edit system login] root@host# set class monitor permissions trace

Create a user named syslog-mon with the class monitor , and with authentication that uses the syslog-monitor key pair from the key pair file located on the remote system log server.

[edit system login] root@host# set user syslog-mon class monitor authentication ssh-ecdsa “ssh-ecdsa xxxxx syslog-monitor key pair”

In system services, set up NETCONF for use with SSH.

[edit system services] root@host# set netconf ssh

Configure the system log to log everything to /var/log/messages .

[edit system ] root@host# set syslog file messages any any

Commit the changes.

[edit ] root@host# commit

Initiate an SSH session to the external system log server from the NDPP device.

$ ssh -R 127.0.0.1:2222:127.0.0.1:22 USER_X@external_syslog_server

While you are logged in, on the remote system log server, start up the SSH agent ssh-agent(1) .

$ eval `ssh-agent -s`

On the remote system log server, add the syslog-monitor key pair to ssh-agent(1) .

$ ssh-add ~/.ssh/syslog-monitor

You are prompted to enter the predetermined passphrase. Enter the same passphrase that you used in Step 1.

10.

While you are logged in to the external_syslog_server session, establish a tunnel to the

Junos OS device and start NETCONF.

Chapter 7: Configuring Event Logging

$ ssh -p2222 [email protected] -s netconf

11.

With NETCONF established, configure a system log events message stream.

<rpc><get-syslog-events><stream>messages</stream></get-syslog-events></rpc>

You should see examples of system log messages (<syslog></syslog>) being received, for example:

May 7 11:40:46 test0 mgd[1522]: UI_CMDLINE_READ_LINE: User 'root', command 'quit'

</syslog>

For more information about configuring event logging, see Junos OS 14.1 Administration

Library for Routing Devices .

Configuring the Client Alive Mechanism

If the connection to the remote syslog server drops, the session can be re-established automatically using the client alive mechanism. The client alive mechanism is not enabled at default. To enable it, configure the client-alive-interval and the client-alive-count-max statements at the [ edit system services ssh ] hierarchy level.

In the following example, the session will be re-established automatically if connectivity is restored within the period ( client-alive-interval seconds * client-alive-count-max seconds ), or 100 seconds (20 x 5).

[edit system services ssh] client-alive-count-max 5; client-alive-interval 20;

If the connection is dropped beyond this period, there will be no automatic re-establishment of the session and the administrator will need to re- establish the session manually.

Configuring the System Log Message Timestamp

By default, the timestamp recorded in a standard-format system log message specifies the month, date, hour, minute, and second when the message was logged, as in the following example:

Aug 21 12:36:30

To achieve compliance with NDPP, the timestamp must also include the year, as in the following example:

Aug 21 12:36:30 2014

To include the year in the timestamp, include the time-format statement at the

[edit system syslog] hierarchy level:

[edit system syslog]

time-format

year

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

NOTE: Messages logged in structured-data format include the year and millisecond by default. If you include the structured-data statement at the

[edit system syslog file filename ] hierarchy level along with the time-format statement, the time-format statement is ignored and messages are logged in structured-data format.

Documentation

•

time-format on page 35

Setting the Date and Time Locally

You can set the date and time on a device running Junos OS by using the set date operational mode command:

To enter the date and time locally:

From operational mode, manually set the date and time.

Because this is an operational-mode command, there is no need to perform a commit operation.

user@host> set date

YYYYMMDDhhmm.ss

For example: user@host> set date 201307251632

Thu Jul 25 16:32:00 PDT 2013

Verify the time.

The show system uptime command provides the following information: current time, last boot time, protocols start time, last configuration commit time.

user@host> show system uptime

Current time: 2013-07-25 16:33:38 PDT

System booted: 2013-07-11 17:14:25 PDT (1w6d 23:19 ago)

Protocols started: 2013-07-11 17:16:35 PDT (1w6d 23:17 ago)

Last configured: 2013-07-23 12:32:42 PDT (2d 04:00 ago) by user

4:33PM up 13 days, 23:19, 1 user, load averages: 0.00, 0.01, 0.00

Documentation

•

set date on page 36

Chapter 7: Configuring Event Logging

time-format

Syntax time-format (year | millisecond | year millisecond);

Hierarchy Level [edit system syslog]

Release Information Statement introduced before Junos OS Release 7.4.

Statement introduced in Junos OS Release 9.0 for EX Series switches.

Statement introduced in Junos OS Release 11.1 for the QFX Series.

Statement introduced in Junos OS Release 14.1X53-D20 for the OCX Series.

Description Include the year, the millisecond, or both, in the timestamp on every standard-format system log message. The additional information is included for messages directed to each destination configured by a file , console , or user statement at the [edit system syslog] hierarchy level. As of Junos OS Release 11.4, the additional time information is also sent to destinations configured by a host statement.

By default, the timestamp specifies the month, date, hour, minute, and second when the message was logged—for example, Aug 21 12:36:30 . However, the timestamp for traceoption messages is specified in milliseconds by default, and is independent of the

[edit system syslog time-format] statement.

NOTE: When the structured-data statement is included at the [edit system syslog file filename ] hierarchy level, this statement is ignored for the file.

Options millisecond —Include the millisecond in the timestamp.

year —Include the year in the timestamp.

Required Privilege

Level system—To view this statement in the configuration.

system-control—To add this statement to the configuration.

Documentation

• Including the Year or Millisecond in Timestamps

• Junos OS System Log Messages Reference

• structured-data

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

set date

Syntax set date ( date-time )

Release Information Command introduced before Junos OS Release 7.4.

Description Set the date and time manually.

user@host> set date 201307251632

Thu Jul 25 16:32:00 PDT 2013

Options • date-time —Specify date and time in one of the following formats:

• YYYYMMDDHHMM.SS

• “ month DD , YYYY HH:MM (am | pm)”

Required Privilege

Level view

Documentation

• Setting the Date and Time Locally

CHAPTER 8

Configuring Firewall Filters

•

Configuring Firewall Filters on page 37

Configuring Firewall Filters

In the Junos OS, management traffic is isolated from other types of traffic, such as user transit traffic, in several ways. The Junos OS maintains a separate virtual address space for every authorized manager. Traffic separation is also accomplished when a separate management network is connected to the dedicated management port.

You should deploy firewall filters on management ports to limit access to authorized locations. For more information about firewall filters, see the Junos OS Policy Framework

Configuration Guide .

This section provides examples for configuring firewall filters:

Filtering Default Network Services

This firewall filter should be applied to ensure that only the services detailed in the Security

Target respond in the NDPP configuration. This filters the unsecured syslog connection between the Routing Engines (UDP/514) and also filters the JVAS PTSP application connection (which is an RE/PIC application for internal routing instance IRI1, UDP/49155).

NOTE: This firewall filter is only an example. Do not copy the addressing specifics and use them on an actual system.

Configure the firewall filter:

[edit firewall family inet] filter NDPP-filter { term block { from { protocol udp; destination-port [ 514 49155 ];

} reject port-unreachable;

} term allow { then accept;

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

}

Configure the NDPP-filter filter as an input filter to lo0 :

[edit interfaces lo0 unit 0 family inet] filter { input NDPP-filter;

}

PART 4

Additional NDPP Guidance

•

Authorization on page 41

•

Understanding Event Logging on page 43

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

CHAPTER 9

Authorization

•

Choosing and Using Passwords on page 41

Choosing and Using Passwords

The following guidelines and configuration options should be considered when configuring the requirements for passwords and when selecting passwords for authorized administrator accounts:

• The password should be easy to remember so that users are not tempted to write it down.

• The password should be changed periodically.

• The password should not be divulged to anyone.

• The following password requirements can be configured:

• Contain a minimum of 15 characters or more. The minimum length can be set to more than 15 characters by the authorized administrator if needed.

[ edit ] administrator@host# set system login password minimum-length 15

Include both alphanumeric and punctuation characters, composed of any combination of upper and lowercase letters, numbers, and special characters (which include !, @, #, $, %, ^, &, *, (, and )). There should be at least one change of case, one or more digits, and one or more punctuation marks.

• Contain character sets in the password. Valid character sets include uppercase letters, lowercase letters, numbers, punctuation, and other special characters.

[ edit ] administrator@host# set system login password change-type character-sets

• Contain the minimum number of character sets or character set changes. The minimum number of character sets required in plain-text passwords in Junos OS is

[ edit ] administrator@host# set system login password minimum-changes 3

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Weak passwords are:

• Words that might be found in or exist as a permuted form in a system file such as

/etc/passwd .

• The host name of the system (always a first guess).

• Any word that appears in a dictionary. This includes dictionaries other than English, and words found in works such as Shakespeare, Lewis Carroll, Roget's Thesaurus, and so on. This prohibition includes common words and phrases from sports, sayings, movies, and television shows.

• Permutations on any of the above. For example, a dictionary word with vowels replaced with digits (for example f00t) or with digits added to the end.

• Any machine-generated password. Algorithms reduce the search space of password-guessing programs and so should not be used.

Strong reusable passwords can be based on letters from a favorite phrase or word, and then concatenated with other, unrelated words, along with additional digits and punctuation.

NOTE: Passwords should be changed from time to time.

CHAPTER 10

Understanding Event Logging

•

Interpreting Event Messages on page 43

•

Logging of Audit Startup and Shutdown on page 44

•

Logging Failure to Establish an SSH Session on page 45

•

Logging Establishment or Termination of an SSH session on page 45

•

Logging Changes to the System Time on page 46

•

Logging Initiation of a System Update on page 47

•

Logging Completion of a TSF Self-Test on page 47

•

Logging Attempts at Unlocking an Interactive Session on page 47

•

Logging Termination of a Remote Session by the Session Locking Mechanism on page 47

•

Logging Termination of an Interactive Session on page 48

•

Logging Initiation of a Trusted Channel on page 48

•

Logging Termination of a Trusted Channel on page 49

•

Logging Failure of Trusted Channel or Trusted Path Functions on page 49

•

System Log Messages on page 50

Interpreting Event Messages

The following is a sample event message.

Jul 24 17:43:28 router1 mgd[4163]: UI_CFG_AUDIT_SET_SECRET: User 'admin' set: [system radius-server 1.2.3.4 secret]

Table 4 on page 44

describes the fields for an event message. If the system logging utility cannot determine the value in a particular field, a hyphen ( - ) appears instead.

Common Criteria Evaluation Configuration Guide for QFX5100 and EX4600 Devices

Table 4: Fields in Event Messages

Field timestamp

Description

Time when the message was generated, in one of two representations:

•

MMM-DD HH:MM:SS.MS+/-HH:MM, is the month, day, hour, minute, second and millisecond in local time. The hour and minute that follows the plus sign (+) or minus sign (-) is the offset of the local time zone from

Coordinated Universal Time (UTC).

YYYY-MM-DDTHH:MM:SS.MSZ

is the year, month, day, hour, minute, second and millisecond in UTC.

Examples

Jul 24 17:43:28 is the timestamp expressed as local time in the United

States.

2012-07-24T09:17:15.719Z

is 9:17 AM UTC on 24 July

2012.

hostname Name of the host that originally generated the message.

router1 process mgd processID

Name of the Junos OS process that generated the message.

UNIX process ID (PID) of the Junos OS process that generated the message.

4153

TAG Junos OS system log message tag, which uniquely identifies the message.

Username of the user initiating the event.

username message-text English-language description of the event .

UI_DBASE_LOGOUT_EVENT

“admin” set: [system radius-server

1.2.3.4 secret]

Logging of Audit Startup and Shutdown

The audit information logged includes both startup and shutdown events of Junos OS.

This in turn identifies the startup and shutdown events of the audit system, which cannot be independently disabled or enabled. For example, if Junos OS is restarted, the audit log contains the following information:

Oct 12 12:48:44 2015 gunni eventd[1248]: SYSTEM_OPERATIONAL: System is operational

Oct 22 10:13:33 2015 gunni shutdown: reboot by sec-officer:

Login and Logout Events Using SSH

System log messages are generated whenever a user successfully or unsuccessfully attempts SSH access. Logout events are also recorded. For example, the following logs are the result of one failed authentication attempt, a successful password authentication attempt followed by a logout, and finally a successful public key authentication attempt:

Oct 22 10:17:36 2015 gunni sshd: SSHD_LOGIN_FAILED: Login failed for user 'sec-officer' from host

'10.92.232.107'

Oct 22 10:18:04 2015 gunni sshd[2098]: Accepted keyboard-interactive/pam for sec-officer from 10.92.232.107

Chapter 10: Understanding Event Logging

port 27364 ssh2

Oct 22 10:18:04 2015 gunni mgd[2103]: UI_AUTH_EVENT: Authenticated user 'sec-officer' at permission level

'j-sec-admin'

Oct 22 10:18:04 2015 gunni mgd[2103]: UI_LOGIN_EVENT: User 'sec-officer' login, class 'j-sec-admin'

[2103], ssh-connection '10.92.232.107 27364 192.168.38.152 22', client-mode 'cli'

Oct 22 10:18:04 2015 gunni mgd[2103]: UI_CMDLINE_READ_LINE: User 'sec-officer', command 'exit '

Oct 22 10:18:04 2015 gunni mgd[2103]: UI_LOGOUT_EVENT: User 'sec-officer' logout

Oct 22 10:18:04 2015 gunni sshd[2098]: Received disconnect from 10.92.232.107: 11: disconnected by user

Oct 22 10:18:50 2015 gunni sshd[3322]: Accepted publickey for syslog-mon from 10.92.232.107 port 60610 ssh2: ECDSA 62:0d:c5:b6:4b:ab:98:aa:6d:a1:ae:68:24:c9:9d:68

Oct 22 10:18:50 2015 gunni sshd[3322]: subsystem request for netconf by user syslog-mon

Oct 22 10:18:50 2015 gunni mgd[3326]: UI_AUTH_EVENT: Authenticated user 'syslog-mon' at permission level

'j-monitor'

Oct 22 10:18:50 2015 gunni mgd[3326]: UI_LOGIN_EVENT: User 'syslog-mon' login, class 'j-monitor' [3326],

ssh-connection '10.92.232.107 60610 192.168.38.152 22', client-mode 'cli'

Logging Failure to Establish an SSH Session

System log messages are generated whenever a user attempts to establish an SSH session. For example, the following logs are generated as a result of failure to establish a remote administrator connection over SSH:

Jan 20 14:03:24 starfire sshd: SSHD_LOGIN_FAILED: Login failed for user 'sec-admin' from host

'10.209.11.24'

Logging Establishment or Termination of an SSH session

System log messages are generated whenever a user successfully or unsuccessfully attempts to establish an SSH session. For example, the following logs are generated when an SSH session has been established: