Cisco 2621XM and Cisco 2651XM Modular
Access Routers with AIM-VPN/EP FIPS 140-2
Non-Proprietary Security Policy
Level 2 Validation
Version 1.3
June 2, 2004
Introduction
This is the non-proprietary Cryptographic Module Security Policy for the 2621XM and 2651XM
Modular Access Routers with AIM-VPN/EP. This security policy describes how the 2621XM and
2651XM routers (Hardware Version: 2621XM, 2651XM; AIM-VPN/EP: Hardware Version 1.0, Board
Version B0; Firmwar e Version: IOS 12.3(3d)) meet the security requirements of FIPS 140-2, and ho w t o
operate the 2621XM and 2651XM routers in a secure FIPS 140-2 mode. This policy was prepared as
part of the Level 2 FIPS 140-2 validation of the 2621XM and 2651XM routers.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2—Security Requirements for Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the NIST website at
http://csrc.nist.gov/cryptval/.
This document contains the following sections:
• Introduction, page 1
• The 2621XM/2651XM Router, page 2
• Secure Operation of the Cisco 2621XM/2651XM Router, page 17
• Related Documentation, page 19
• Obtaining Documentation, page 19
• Documentation Feedback, page 20
• Obtaining Technical Assistance, page 20
• Obtaining Additional Publications and Information, page 22
Corporate Headquarters:
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
This document deals only with operations and capabilities of the Cisco 2621XM and Cisco 2651XM
routers in the technical terms of a FIPS 140-2 cryptographic module security policy. More information
is available on the Cisco 2621XM and Cisco 2651XM routers and the Cisco 2600 Series from the
following sources:
• The Cisco Systems website contains information on the full line of products at www.cisco.com. The
Cisco 1700 Series product descriptions can be found at:
• For answers to technical or sales related questions please refer to the contacts listed on the Cisco
Systems website at www.cisco.com.
• The NIST Validated Modules website (http://csrc.nist.gov/cryptval) contains contact information
for answers to technical or sales-related questions for the module
In this document, the Cisco 2621XM and Cisco 2651XM routers are referred to as the routers, the
modules, or the systems.
Document Organization
The Security Policy document is part of the FIPS 140-2 Submission Package. In addition to this
document, the Submission Package contains:
• Vendor Evidence document
• Finite State Machine
• Module Software Listing
• Other supporting documentation as additional references
This document provides an ov ervie w of the Cisco 2621XM and 2651XM routers an d explains th e secure
configuration and operation of the modules. This introduction section is followed by “The
2621XM/2651XM Router”, w hich d etails the genera l featu res and functionality of the Cisco 2621XM
and 2651XM routers. “Secure Operation of the Cisco 26 21XM/ 26 51XM Rou ter” specifically addresses
the required configuration for the FIPS-mode of operation.
With the exception of this Non-Proprietary Security Policy, the FIPS 140-2 Validation Submission
Documentation is Cisco-proprietary and is releasable only under appropriate n on-disclosure agreements.
For access to these documents, please contact Cisco Systems
The 2621XM/2651XM Router
Branch office networking requirements are dramatically evolving, driven by web and e-commerce
applications to enhance productivit y and merging the voice and d ata inf rastructu re to reduce costs. The
Cisco 2621XM and 2651XM routers offer versatility, integration, and security to branch offices. With
over 100 Network Modules (NMs) and WAN Interface Cards (WICs), the modular architecture of the
Cisco router easily allows interfaces to be upgraded to accommodate network expansi on. The Cis co
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
2
OL-6262-01
2621XM and 2651XM provide a scalable, secure, manageable remote access server that meets FIPS
140-2 Level 2 requirements. This section describes the general features and functionality provided by
the Cisco 2621XM and 2651XM routers.
The 2621XM/2651XM Cryptographic Module
Figure 1The 2621XM/2651XM Router
The 2621XM/2651XM Router
POWER
RPS
ACTIVITY
Cisco 2600
SERIES
9493
The 2621XM and 2651XM Routers are multiple-chip standalone cryptographic modules. The
cryptographic boundary is defined as encompassing the "top," "front," "left," "right," and "bottom"
surfaces of the case; all portions of the "backplane" of the case which are not designed to accommodate
a WIC or Network Module; and the inverse of the three-dimensional space within the case that would be
occupied by an installed WIC or Network Modu le. The cryptographic boundary includ es the connection
apparatus between the WIC or Network Module and the motherboard/daughterboard that hosts the WIC
or Network Module, but the boundary does not include the WIC or Network Module itself. In other
words, the cryptographic boundary encompasses all hardware components within the case of the device
except any installed modular WICs or Network Modules. All of the functionality discussed in this
document is provided by components within this cryptographic boundary.
The Cisco 2621XM and 2651XM routers incorporate an AIM-VPN/EP cryptographic accelerator card.
The AIM-VPN/EP is located inside the module chassis, and is installed directly on the motherboard.
Cisco IOS features such as tunneling, data encryption, and termination of Remote Access WANs via
IPSec, Layer 2 Forwarding (L2F) and Layer 2 T unnelin g Protocols (L2TP) make t he Cisco 2600 an ideal
platform for building virtual private networks or outsourced dial solutions. Cisco 2600`s RISC-based
processor provides the power needed for the dynamic requirements of the remote branch office,
achieving wire speed Ethernet to Ethernet routing with up to 30 thousand packets per second (Kpps)
throughput capacity for the 2621XM, an d 40 Kpps for t he 2651XM .
Module Interfaces
The interfaces for the router are located on the rear panel as shown in Figure 2.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
3
The 2621XM/2651XM Router
port (RJ-45)
N
Figure 2Cisco 2621XM and Cisco 2651XM Physical Interfaces
WIC slots
Cisco 2650
SERIAL 1
SERIAL 0
CONN
CONN
SEE MANUAL BEFORE INSTALLATION
W1
LINK
ETHERNET 1
ACT
SERIAL 1
Cisco 2650
100-240V– 1A
WIC
SERIAL 0
2A/S
LINK
ETHERNET 0
CONN
SEE MANUAL BEFORE INSTALLATION
WIC
CONN
2T
W0
ACT
CONSOLE
AUX
50/60 Hz 47 W
10/100BASE-T
etwork
module
Ethernet 0/1
(RJ-45)
10/100BASE-T
Ethernet 0/0
(RJ-45)
Console
Auxiliary port
(RJ-45)
99494
The Cisco 2621XM and 2651XM routers feature a console port, an auxiliary port, dual fixed LAN
interfaces, a Network Module slot, and two WIC slots.
LAN support includes single and dual Ethernet options; 10/100 Mbps auto-sensing Ethernet; mixed
Token-Ring and Ethernet; and single Token Ring chassis versions.
WAN interface cards support a variety of serial, ISDN BRI, and integrated CSU/DSU options for
primary and backup WAN connectivity. Available Network Modules support multi-service
voice/data/fax integration, departmental dial concentration, and high-density serial options
All Cisco 2600 series routers include an auxiliary port supporting 115Kbps Dial-On-Demand Routing,
ideal for back-up WAN connectivity.
When a Network Module is inserted, it fits into an adapter called the Network Module expansion bus.
The expansion bus interacts with the PCI bridge i n the same w ay that the f ixed LAN ports do; therefore,
no critical security parameters pass through the Network Module (just as they don't pass through the
LAN ports). Network modules do not perform any cryptographic functions.
WICs are similar to Network Modules in that they greatly increase the router's flexibility. A WIC is
inserted into one of two slots, which are l ocated abov e the fix ed LAN ports. WICs interface di rectly with
the processor. They do not interface with the cryptographic card; therefore no security parameters will
pass through them. WICs cannot perform cryptographic functions; they only serve as a data input and
data output physical interface.
The physical interfaces include a power plug for the power supply and a power switch. The router has
two Fast Ethernet (10/100 RJ-45 ) connectors for data transfers in and out. The module also has two other
RJ-45 connectors on the back panel for a console terminal for local system access and an auxiliary port
for remote system access or dial backup using a modem. The 10/100Base-T LAN ports have
Link/Activity, 10/100Mbps, and half/full duplex LEDs. Figure 3 shows the LEDs located on the rear
panel with descriptions de tailed in Table 1:
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
4
OL-6262-01
SEE MANUAL BEFORE INSTALLATION
SERIAL 1
SERIAL 0
CONN
CONN
WIC
2A/S
SEE MANUAL BEFORE INSTALLATION
SERIAL 1
SERIAL 0
CONN
CONN
WIC
2A/S
Cisco 2621
W0
W1
AUX
CONSOLE
10/100 ETHERNET 0/0
10/100 ETHERNET 0/1
1
99496
Figure 3Cisco 2621XM and Cisco 2651XM Rear Panel LEDs
The 2621XM/2651XM Router
00 Mbps
LED
100 Mbps
Link
LED
Link
10/100BASE-T
Ethernet 0/1
(RJ-45)
100 Mbps
FDX
LED
FDX
LED
100 Mbps
Link
LED
Link
10/100BASE-T
Ethernet 0/0
(RJ-45)
FDX
LED
FDX
99495
Auxiliary
port (RJ-45)
Console
port (RJ-45)
Table 1Cisco 2621XM and Cisco 2651XM Rear Panel LEDs and Descriptions
LEDIndicationDescription
LINKGreenAn Ethernet link has been established
OffNo Ethernet link established
FDXGreenThe interface is transmitting data in full-duplex mode
OffWhen off, the interface is transmitting data in half-duplex mode
100 MbpsGreenThe speed of the interface is 100 Mbps
OffThe speed of the interface is 10 Mbps or no link is established
Figure 4 shows the front panel LEDs, which provide overall status of the router's operation. The front
panel displays whether or not the router is booted, if the redundant po wer is (successfu lly) at tached and
operational, and overall activity/link status.
Figure 4Front Panel LEDs
POWERRPS ACTIVITY
Table 2 provides more detailed information conveyed by the LEDs on the front panel of the router:
OL-6262-01
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
5
The 2621XM/2651XM Router
Table 2Cisco 2621XM and Cisco 2651XM Front Panel LEDs and Descriptions
LEDIndicationDescription
PowerGreenPower is supplied to the router and the router is operational
OffThe router is not powered on
1
RPS
ActivityOffIn the Cisco IOS software, but no network activity
1. RPS = Redundant Power System
GreenRPS is attached and operational
OffNo RPS is attached
BlinkRPS is attached, but has a failure
Blink (500 ms ON, 500 ms OFF) In ROMMON, no errors
Blink (500 ms ON, 500 ms OFF,
In ROMMON, error detected
2 sec between codes)
Blink (less than 500 ms)In the Cisco IOS software, the blink rate reflects the level of activity
All of these physical interfaces are separated into the logical interfaces from FIPS 140-2 as described in
Table 3:
Table 3Cisco 2621XM and Cisco 2651XM FIPS 140-2 Logical Interfaces
10/100BASE-TX LAN Port
WIC Interface
Network Module Interface
LAN Port LEDs
10/100BASE-TX LAN Port LEDs
Power LED
Redundant Power LED
Activity LED
Console Port
Auxiliary Port
Power PlugPower Interface
Roles and Services
Authentication is role-based. There are two main roles in the router that operators may assume: the
Crypto Officer role and the User role. The administrator of the router assumes the Crypto Officer role
in order to configure and maintain the ro uter using Crypto Off icer services, while the Users exercise only
the basic User services. Both roles are authenticated by providing a valid username and password. The
configuration of the encryption and decryption functionality is performed only by the Crypto Officer
after authentication to the Crypto Officer role by providing a valid Crypto Officer username and
password. Once the Crypto Of ficer conf igured the encryption an d decryption functionality, the User can
use this functionality after authentication to the User role by providing a valid User username and
password. The Crypto Officer can also use the encryption and decryption functionality after
authentication to the Crypto Officer role. The module supports RADIUS and TACACS+ for
authentication and they are used in the FIPS mode. A complete description of all the management and
configuration capabilities of the Cisco 2621XM and 2651XM Routers can be found in the Performing Basic System Management manual and in the online help for the router.
The User and Crypto Officer passwords and the RADIUS/TACACS+ shared secrets must each be at least
8 alphanumeric characters in length. See the “Secure Operation of the Cisco 2621XM/2651XM Router”
section on page 17, for more information. If only integers 0-9 are used without repetition for an 8 digit
PIN, the probability of randomly guessing the correct sequence is 1 in 1,814,400. Including the rest of
the alphanumeric characters drastically decreases the odds of guessing the correct sequence.
The 2621XM/2651XM Router
Status Output Interface
Crypto Officer Services
During initial configuration of the router, the Cr ypto Officer password (the “enable” password) is
defined. A Crypto Officer may assign permission to access the Crypto Officer role to additional
accounts, thereby creating additional Crypto Officers.
The Crypto Officer role is responsible for the configuration and maintenance of the router. The Crypto
Officer services consist of the following:
• Configure the router—define network interfaces and settings, create command aliases, set the
protocols the router will support, enable interfaces and network services, set system date and time,
and load authentication information.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
7
The 2621XM/2651XM Router
User Services
• Define Rules and Filters—create packet Filters that are applied to User data streams on each
interface. Each Filter consists of a set of Rules, which define a set o f packets to permit or deny based
characteristics such as protocol ID, addresses, ports, TCP connection establishment, or packet
direction.
• Status Functions—view the router configuration, routing tables, active sessions, use Gets to view
SNMP MIB II statistics, health, temperature, memory status, voltage, packet statistics, review
accounting logs, and view physical interface status
• Manage the router—log off users, shutdown or reload the outer, manually back up router
configurations, view complete configurations, manager user rights, and restore router
configurations.
• Set Encryption/Bypass—set up the configuration tables for IP tunneling. Set keys and algorithms
to be used for each IP range or allow plaintext packets to be set from specified IP address.
• Change Network Modules—insert and remove modules in the Network Module slot as described
in the “Initial Setup” section of this document.
• Change WAN Interface Cards—insert and remove WICs in the WAN interface slot as described
in the “Initial Setup” section of this document.
A User enters the system by accessing the console port with a terminal program. The IOS prompts the
User for their password. If the password is correct, the User is allowed entry to the IOS executive
program. The services available to the User role consist of the following:
• Status Functions—view state of interfaces, state of layer 2 protocols, version of IOS currently
• Network Functions—connect to other network devices through outgoing telnet, PPP, etc. and
• Terminal Functions—adjust the terminal session (e.g., lock the terminal, adjust flow control)
• Directory Services—display directory of files kept in flash memory
Physical Security
The router is entirely encased by a thick steel chassis. The rear of the unit provides 1 Network Module
slot, 2 WIC slots, on-board LAN connectors, Console/Aux iliary connectors, the po wer cable connection
and a power switch. The top portion of the chassis may be remov ed (see Figure 5) to allo w access to the
motherboard, memory, and expansion slots.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
8
OL-6262-01
The 2621XM/2651XM Router
Figure 5Cisco 2621XM and Cisco 2651XM Chassis Removal
Cisco 2600
SERIES
POWER RPS ACTIVITY
Any NM or WIC slot, which is not populat ed with a N M or WIC, must be popu lated with an appropriate
slot cover in order to operate in a FIPS compliant mode. The slot covers are included with each router,
and additional covers may be ordered from Ci sco. The same procedure mentioned below to apply tamper
evidence labels for NMs and WICs must also be followed to apply tamper evidence labels for the slot
covers.
Once the router has been configured in to meet FIPS 140-2 Level 2 requirements, the router cannot be
accessed without signs of tampering. To seal the system, apply serialized tamper-evidence labels as
follows:
9497
Step 1Clean the cover of any grease, dirt, or oil before applying the tamper evidence labels. Alcohol-based
cleaning pads are recommended for this purpose. The temperature of the router should be above 10 C.
Step 2Place the first label on the router as shown in Figure 6. The tamper evidence label should be placed so
that the one half of the tamper evidence label covers the enclosure and the other half covers the side of
the router. Any attempt to remove the enclosure will leave tamper evidence.
Step 3Place the second label on the router as shown in Figure 6. The tamper evidence label should be placed
so that the one half of the tamper evidence label covers the enclosure and the other half covers the side
of the router. Any attempt to remove the enclosure will leave tamper evidence.
Step 4Place the third label on the router as shown in Figure 6. The tamper evidence label should be placed so
that the one half of the label covers the enclosure and the other half covers the Network Module slot.
Any attempt to remove a Network Module will leave tamper evidence.
Step 5Place the fourth label on the router as shown in Figure 6. The tamper e vidence label should be placed so
that the half of the label covers the enclosure and the other half covers the WAN interface card slot.
Any attempt to remove a WAN interface card will leave tamper evidence.
Step 6Place the fifth label on the router as shown in Figure 6. The tamper evidence label should be placed so
that one half of the label covers the enclosure and the other half covers the WAN interface card slot.
Any attempt to remove a WAN interface card will leave tamper evidence.
Step 7The labels completely cure within five minutes.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
9
The 2621XM/2651XM Router
Figure 6Cisco 2621XM and Cisco 2651XM Tamper Evidence Label Placement
CONN
SEE MANUAL BEFORE INSTALLATION
W1
LINK
POWER
RPS
ACTIVITY
The tamper evidence seals are p roduced from a s pecial thin g auge vin yl with self- adhesi ve backing. An y
attempt to open the router, remove Network Modules or WIC cards, or the front faceplate will damage
the tamper evidence seals or the painted surface and metal of the module cover. Since the tampe r
evidence seals have non-repeated serial numbers, they may be inspected for damage and compared
against the applied serial numbers to verify that the module has not been tampered. Tamper evidence
seals can also be inspected for signs of tampering, which include the follo wing: curled corners, b ubbling,
crinkling, rips, tears, and slices. The word “OPEN” may appear if the label was peeled back.
Cryptographic Key Management
The router securely administers both cryptographic keys and other critical security parameters such as
passwords. The tamper evidence seals provide physical protection for all keys. All keys are also
protected by the password-protection on the Crypto Of ficer ro le login, and can be zeroized b y the Crypto
Officer. Keys are exchanged manually and entered electronically via manual key exchange or Internet
Key Exchange (IKE).
SERIAL 1
SERIAL 0
CONN
SERIAL 1
Cisco 2611
100-240V– 1A
WIC
SERIAL 0
2A/S
LINKACTETHERNET 1
ETHERNET 0
CONN
SEE MANUAL BEFORE INSTALLATION
WIC
CONN
2T
W0
ACT
CONSOLE
AUX
50/60 Hz 47 W
Cisco 2600
SERIES
99498
10
The modules contain a cryptographic accelerator card (the AIM-VPN/EP), which provides DES (56-bit)
(only for legacy systems) and 3DES (168-bit) IPSec encryption at up to 15Mbps, MD5 and SHA-1
hashing, and has hardware support for DH and RSA key generation.
The module supports the following critical security parameters (CSPs):
Table 4Critical Security Parameters
#CSP
DescriptionStorage
Name
1CSP 1This is the seed key for X9.31 PRN G. This key is stored in DRAM
and updated periodically after the generation of 400 bites; hence,
it is zeroized periodically. Also, the operator can turn off the
router to zeroize this key.
2CSP 2The private exponent used in Diffie-Hellman (DH) exchange.
Zeroized after DH shared secret has been generated.
3CSP 3The shared secret within IKE exchange. Zeroized when IKE
session is terminated.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
DRAM
(plaintext)
DRAM
(plaintext)
DRAM
(plaintext)
OL-6262-01
The 2621XM/2651XM Router
Table 4Critical Security Parameters (continued)
4CSP 4Same as aboveDRAM
(plaintext)
5CSP 5Same as aboveDRAM
(plaintext)
6CSP 6Same as aboveDRAM
(plaintext)
7CSP 7The IKE session encrypt key. The zeroization is the same as
above.
8CSP 8The IKE session authentication key. The zeroization is the same
as above .
9CSP 9The RSA private key . “crypto k ey zeroize” command zeroizes this
key.
10CSP 10The key used to generate IKE skeyid during preshared-key
authentication. “no crypto isakmp ke y” command zeroizes it. This
key can have two forms b ased on whether the k e y is related to the
hostname or the IP address.
11CSP 11This key generates keys 3, 4, 5 and 6. This key is zeroized after
generating those keys.
12CSP 12The RSA public key used to validate signatures within IKE. These
keys are expired either when CRL (certificate revocation list)
expires or 5 secs after if no CRL exists. After a bove expiration
happens and before a new public key structure is created this key
is deleted. This key does not need to be zeroized because it is a
public key; however, it is zeroized as mentioned here.
13CSP 13The fixed key used in Cisco vendor ID generation. This key is
embedded in the module binary image and can be deleted by
erasing the Flash.
14CSP 14The IPSec encryption key. Zeroiz ed when IPSec sess ion is
terminated.
15CSP 15The IPSec authentication key. The zeroization is the same as
above.
16CSP 16The RSA public key of the CA. “no crypto ca trust <label>”
command invalidates the key and it frees the public key label
which in essence prevent use of the key. This key does not need to
be zeroized because it is a public key.
17CSP 17This key is a public key of the DNS server. Zeroized using the
same mechanism as above. “no crypto ca trust <label>” command
inv al id at e the DNS server’s pub lic key and it frees the public key
label which in essence prevent use of that key. This label is
different from the label in the above key. This key does not need
to be zeroized because it is a public key.
DRAM
(plaintext)
DRAM
(plaintext)
NVRAM
(plaintext)
NVRAM
(plaintext)
DRAM
(plaintext)
DRAM
(plaintext)
NVRAM
(plaintext)
DRAM
(plaintext)
DRAM
(plaintext)
NVRAM
(plaintext)
NVRAM
(plaintext)
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
11
The 2621XM/2651XM Router
Table 4Critical Security Parameters (continued)
18CSP 18The SSL session key. Zeroized w hen the SSL connection is
terminated.
19CSP 19The ARAP key that is hardcoded in the module binary image.
This key can be deleted by erasing the Flash.
20CSP 20This is an ARAP user password used as an authentication key. A
function uses this key in a DES algorithm for authentication.
21CSP 21The key used to encrypt values of the configuration f ile. This k ey
is zeroized when the “no key config-key” is issued.
22CSP 22This key is used by the router to authenticate itself to the peer . The
router itself gets the password (that is used as this key) from the
AAA server and sends it onto the peer. The password retrieved
from the AAA server is zeroized upon completion of the
authentication attempt.
23CSP 23The RSA public key used in SSH. Zeroized after the termination
of the SSH session. This key does not need to be zeroized becau se
it is a public key; However, it is zeroized as mentioned here.
24CSP 24The authentication key used in PPP. This key is in the DRAM and
not zeroized at runtime. One can turn off the router to zeroize this
key because it is stored in DRAM.
25CSP 25This key is used by the router to authenticate itself to the peer . The
key is identical to #22 except that it is retrieved from the local
database (on the router itself). Issuing the “no username
password” zeroizes the password (that is used as this key) from
the local database.
26CSP 26This is th e SSH sessio n key. It is zeroized when the SSH sessio n
is terminated.
27CSP 27The password of the User role. This password is zeroized by
overwriting it with a new password.
28CSP 28The plaintext password of the CO role. This password is zeroized
by overwriting it with a new password.
29CSP 29The ciphertext password of the CO role. However, the algorithm
used to encrypt this password is not FIPS approved. Therefore,
this password is considered plaintext for FIPS purposes. This
password is zeroized by overwriting it with a new password.
30CSP 30The RADIUS shared secret. This shared secret is zeroized by
executing the “no” form of the RADIUS shared secret set
command.
31CSP 31The TACACS+ shared secret. This shared secret is zeroized by
executing the “no” form of the TACACS+ shared secret set
command.
DRAM
(plaintext)
Flash
(plaintext)
DRAM
(plaintext)
NVRAM
(plaintext)
DRAM
(plaintext)
DRAM
(plaintext)
DRAM
(plaintext)
NVRAM
(plaintext)
DRAM
(plaintext)
NVRAM
(plaintext)
NVRAM
(plaintext)
NVRAM
(plaintext)
NVRAM
(plaintext),
DRAM
(plaintext)
NVRAM
(plaintext),
DRAM
(plaintext)
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
12
OL-6262-01
The 2621XM/2651XM Router
The services accessing the CSPs, the type of access and which role accesses the CSPs are listed in
Table 5.
Table 5Role and Service Access to CSPs
SRDI/Role/Service Access Policy
Role/Service
User Role
Status Functions
Network Functions
Terminal Functions
Directory Services
Crypto-Officer Role
Configure the Router
Define Rules and Filters
Status Functions
Manage the Router
Set Encryptions/Bypass
Security Relevant Data Item
CSP 1rdr
w
d
CSP 2
rr
w
d
CSP 3
rr
w
d
CSP 4
rr
w
d
CSP 5
rr
w
d
CSP 6
rr
w
d
CSP 7
rr
w
d
CSP 8
rr
w
d
CSP 9
rr
w
d
CSP 10
rr
w
d
CSP 11
rr
w
d
Change WAN Interface Cards
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
13
The 2621XM/2651XM Router
Table 5Role and Service Access to CSPs (continued)
SRDI/Role/Service Access Policy
Role/Service
User Role
Status Functions
Network Functions
Terminal Functions
Directory Services
Crypto-Officer Role
Configure the Router
Define Rules and Filters
Status Functions
Manage the Router
CSP 12rr
CSP 13
rr
w
d
CSP 14
CSP 15
CSP 16
CSP 17
CSP 18
CSP 19
rr
rr
rr
rr
rr
rr
w
d
CSP 20
rr
w
d
CSP 21
CSP 22
rr
r
w
d
r
w
d
w
d
CSP 23
rr
Set Encryptions/Bypass
Change WAN Interface Cards
w
d
w
d
w
d
w
w
d
w
d
w
d
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
14
OL-6262-01
Table 5Role and Service Access to CSPs (continued)
The 2621XM/2651XM Router
SRDI/Role/Service Access Policy
CSP 24
CSP 25
CSP 26
CSP 27
CSP 28
CSP 29
CSP 30
CSP 31
Role/Service
User Role
Status Functions
Network Functions
Terminal Functions
Directory Services
Crypto-Officer Role
Configure the Router
Define Rules and Filters
Status Functions
Manage the Router
Set Encryptions/Bypass
rdr
w
rr
w
d
rr
w
d
rr
w
d
r
w
d
r
w
d
r
w
d
r
w
d
Change WAN Interface Cards
The module supports DES (only for legacy systems), 3DES, DES-MAC, TDES-MAC, AES, SHA-1,
HMAC SHA-1, MD5, MD4, HMAC MD5, Diffie-Hellman, RSA (for digital signatures and
encryption/decryption (for IKE authentication)), cryptograp hic algorithms. The MD5, HMA C MD5, and
MD4 algorithms are disabled when operating in FIPS mode.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
15
The 2621XM/2651XM Router
Key Zeroization:
The module supports three types of key management scheme s:
• Manual key exchange method that is symmetric. DES/3DES/AES key and HMAC-SHA-1 key are
exchanged manually and entered electronically.
• Internet Key Exchan ge meth od wi th supp ort for exchanging pre-shared keys manually and entering
electronically.
–
The pre-shared keys are used with Diffie-Hellman key agreement technique to derive DES,
3DES or AES keys.
–
The pre-shared key is also used to derive HMAC-SHA-1 key.
• Internet Key Exchange with RSA-signature authentication.
All pre-shared keys are associated with the CO role that created the keys, and the CO role is protected
by a password. Therefore, the CO password is associated with all the pre-shared keys. The Crypto
Officer needs to be authenticated to stor e keys. All Dif fie-Hellman (DH) ke ys agreed upon for individual
tunnels are directly associated with that specific tunnel only via the IKE protocol.
All of the keys and CSPs of the module can be zeroized. Please refer to the Description column of
Table 4 for information on methods to zeroize each key and CSP.
Self-Tests
In order to prevent any secure data from being released, it is important to test the cryptographic
components of a security module to insure all components are functioning correctly . The router includes
an array of self-tests that are run during startup and periodically during operations. If an y of the self-tests
fail, the router transitions into an er ror state. Within the error state, all secure data transmission is halted
and the router outputs status information indicating the failure.
NoteAfter the router recovers from failure of a power-up self-test performed by the AIM-VPN/EP, the
router only allows plaintext traffic to pass through and no encrypted traffic is allowed.
Self-tests performed by the IOS image:
• Power-up tests
–
Firmware integrity tes t
–
RSA signature KAT (both signature and verification)
–
DES KAT
–
TDES KAT
–
AES KAT
–
SHA-1 KAT
–
PRNG KAT
–
Power-up bypass test
–
Diffie-Hellman self-test
–
HMAC SHA-1 KAT
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
16
OL-6262-01
Secure Operation of the Cisco 2621XM/2651XM Router
• Conditional tests
–
Conditional bypass test
–
Pairwise consistency test on RSA signature
–
Continuous random number generator tests
Self-tests performed by the AIM-VPN/EP (cryptographic accelerator):
• Power-up tests
–
Firmware integrity test
–
DES KAT
–
TDES KAT
–
SHA-1 KAT
• Conditional tests
–
Continuous random number generator test
Secure Operation of the Cisco 2621XM/2651XM Router
The Cisco 2621XM and 2651XM Modular Access Routers with AIM-VPN/EP meet all the Level 2
requirements for FIPS 140-2. Follow the setting instructions provided below to place the module in FIPS
mode. Operating this router without maintaining the following settings will remove the module from
the FIPS approved mode of operation.
Initial Setup
• The Crypto Officer must ensure that the AIM-VPN/EP crypt ographic accelerator card is installed in
the module by opening the chassis and visual ly confirming the presence of the AIM-VPN/EP. Please
refer to the Cisco publication Installing Adv an ced Integration Modules in Cisco 2600 Series, Cisco
3600 Series, and Cisco 3700 Series Routers for detailed instructions on chassis disassembly and
reassembly, and AIM-VPN/EP identification. This document may be accessed on the web at:
• The Crypto Officer must apply tamper evidence labels as described in the “Physical Security”
section of this document.
• Only a Crypto Officer may ad d and remov e Network Modules. Wh en removing the tamper e viden ce
label, the Crypto Officer should remove the entire label from the router and clean the cover of any
grease, dirt, or oil with an alcohol-based cleaning pad. The Crypto Officer must re-apply tamper
evidence labels on the router as described in the “Physical Security” section of this document.
• Only a Crypto Officer may add and remove WAN Interface Cards. When removing the tamper
evidence label, the Crypto Off icer should remo ve the entire label from the router and clean the cov er
of any grease, dirt, or oil with an alcohol-based cleaning pad. The Crypto Officer must re-apply
tamper evidence labels on the router as described in the “Physical Security” section of this
document.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
17
Secure Operation of the Cisco 2621XM/2651XM Router
• The Crypto Officer must disable IOS Password Recovery by executing the following commands:
configure terminal
no service password-recovery
end
show version
NoteOnce Password Recovery is disabled, administrative access to the module without the
password will not be possible.
System Initialization and Configuration
• The Crypto Officer must perform the initial configuration. Cisco IOS version 12.3(3d) is the only
allowable image; no other image may be loaded.
• The value of the boot f ield must be 0x0102. This set ting disables break from the console to the R OM
monitor and automatically boots the Cisco IOS image. From the “configure terminal” command
line, the Crypto Officer enters the following syntax:
config-register 0x0102
• The Crypto Officer must create the “enable” password for the Crypto Officer role. The password
must be at least 8 characters and is entered when the Crypto Officer first engages the “enable”
command. The Crypto Officer enters the following syntax at the “#” prompt:
enable secret <PASSWORD>
• The Crypto Officer must always assign passwords (of at least 8 characters) to users. Identification
and authentication on the console port is required for Users. From the “configure terminal”
command line, the Crypto Officer enters the following syntax:
line con 0
password <PASSWORD>
login local
• The Crypto Officer shall only assign users to a privilege level 1 (the default).
• The Crypto Officer shall not assign a command to any privilege level other than its default.
• The Crypto Officer may configure the module to use RADIUS or TACACS+ for authentication.
Configuring the module to use RADIUS or TACACS+ for authentication is optional. If the module
is configured to use RADIUS or TACACS+, the Crypto-Officer must define RADIUS or TACACS+
shared secret keys that are at least 8 characters long.
• If the Crypto Officer loads any IOS image onto the router, this will put the router into a non-FIPS
mode of operation.
IPSec Requirements and Cryptographic Algorithms
• There are two types of key management method that are allowed in FIPS mode: Internet Key
Exchange (IKE) and IPSec manually entered keys.
• Although the Cisco IOS implementation of IKE allows a number of algorithms, only the following
algorithms are allowed in a FIPS 140-2 configuration:
–
ah-sha-hmac
–
esp-des
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
18
OL-6262-01
• The following algorithms are not FIPS approved and should be disabled:
Protocols
All SNMP operations must be performed within a secure IPSec tunnel.
Remote Access
• Telnet access to the module is only allowed via a secure IPSec tunnel between the remote system
• SSH access to the module is only allowed if SSH is configured to use a FIPS-approved algorithm.
Related Documentation
–
esp-sha-hmac
–
esp-3des
–
esp-aes
–
MD-4 and MD-5 for signing
–
MD-5 HMAC
and the module. The Crypto officer must configure the module so that any remote connections via
telnet are secured through IPSec.
The Crypto officer must configure the module so that SSH uses only FIPS-approved algorithms.
Related Documentation
For more information about the Cisco 2621XM and Cisco 2651XM modular access routers, refer to the
following documents:
• Cisco 2600 Series Modular Routers Quick Start Guide
• Cisco 2600 Series Hardware Installation Guide
• Software Configuration Guide for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series
Routers
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several
ways to obtain technical assistance and other technical resources. These sections explain how to obtain
technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/univercd/home/home.htm
You can access the Cisco website at this URL:
http://www.cisco.com
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
19
Documentation Feedback
You can access international Cis co websites at this URL:
• Nonregistered Cisco.com users can order documentation through a local account representative by
calling Cisco Systems Corporate Headquarters (California, USA) at 408 5 26-7208 or, elsewhere in
North America, by calling 800 553-NETS (6387).
Documentation Feedback
You can send comments about technical documentation to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your
document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate your comments.
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco
Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical
Support W ebsit e on Cisco.com features e xtensi v e online support resou rces. In addition, Cisco Technical
Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service
contract, contact your reseller.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
20
OL-6262-01
Cisco Technical Support Website
The Cisco Technical Support Website provides online d ocuments and t ools for trou bleshooting and
resolving technical issues with Cisco products and technologies. The website is a v ailable 24 hours a day,
365 days a year at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support W ebsite requires a Cisco.com user ID and password.
If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3
and S4 service requests are those in which your netw ork is minimally impaired o r for wh ich you require
product information.) After you describe your situation, the TAC Service Request Tool automatically
provides recommended solutions. If your issue is not resolved using the recommended resources, your
service request will be assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at
this URL:
Obtaining Technical Assistance
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone.
(S1 or S2 service requests are those in which your production network is down or severely degraded.)
Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help k eep your bu siness
operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553 2447
For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity
definitions.
Severity 1 (S1)—Your network is “down,” or there is a critical impact to your business operations. You
and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your
business operation are negatively affected by inadequate performance of Cisco product s. You and Cisco
will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations
remain functional. You and Cisco will commit resources during normal business hours to restore serv ice
to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or
configuration. There is little or no effect on your business operations.
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
21
Obtaining Additional Publications and Information
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solu tio ns is available from vario us onl ine
and printed sources.
• Cisco Marketplace provides a v ariety of Cisco boo ks, reference guides, and logo merchandise. Visit
Cisco Marketplace, the company store, at this URL:
http://www.cisco.com/go/marketplace/
• The Cisco Product Cata log describes the netw orki ng products o f fered b y Cisco Systems, as well as
ordering and customer support services. Access the Cisco Product Catalog at this URL:
http://cisco.com/univercd/cc/td/doc/pcat/
• Cisco Press publishes a wide range of general networking, training and certification titles. Both new
and experienced users will benefit from these publications. For current Cisco Press titles and other
information, go to Cisco Press at this URL:
http://www.ciscopress.com
• Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and
networking investments. Each quarter, Packet delivers coverage of the latest industry trends,
technology breakthroughs, and Cis co products an d solutions, as well as network deployment and
troubleshooting tips, configuration examples, customer case studies, certification and training
information, and links to scores of in-dept h online resources. You can access Packet magazine at this
URL:
http://www.cisco.com/packet
• iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies
learn how they can use technology to increase revenue, streamline their business, and expand
services. The publication identifies the challenges facing these companies and the technologies to
help solve them, using real-world case studies and business strategies to help readers make sound
technology investment decisions. You can access iQ Magazine at this URL:
http://www.cisco.com/go/iqmagazine
• Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering
professionals involved in designing, developing, and operating public and private internets and
intranets. You can access the Internet Protocol Journ al at this UR L:
http://www.cisco.com/ipj
• World-class networking training is available from Cisco. You can view current offerings at
this URL:
http://www.cisco.com/en/US/learning/index.html
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
22
OL-6262-01
Obtaining Additional Publications and Information
By printing or making a copy of this document, th e user ag rees to use t his inf o rmatio n for p r oduct evaluation purposes only. Sale of this information
in whole or in part is not authorized by Cisco Systems.
This document is to be used in conjunction with the documents listed in the “Related Documentation” section.
CCVP, the Cisco logo, and Welcome to the Human Network are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is
a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco
Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity,
Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS,
iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networkers,
Networking Academy, Network Registrar, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient,
and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (0711R)
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
OL-6262-01
23
Obtaining Additional Publications and Information
Cisco 2621XM and Cisco 2651XM Modular Access Routers with AIM-VPN/EP FIPS 140-2 Non-Proprietary Security Policy
24
OL-6262-01
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.