Nortel 4500 FIPS Manuale utente

This document may be freely reproduced and distributed whole and intact including this Copyright Notice.

Contivity™ Extranet Switch 4500

FIPS 140-1 Non-Proprietary

Cryptographic Module Security Policy

Level 2 Validation

February 2000

Table of Contents

1Introduction..................................................................................................................3

1.1 Purpose................................................................................................................... 3

1.2 References............................................................................................................... 3

1.3 Terminology............................................................................................................. 3

1.4 Document Organization............................................................................................ 3

2The Contivity Extranet 4500 Switch...........................................................................5

2.1 Cryptographic Module............................................................................................. 5

2.2 Module Interfaces.................................................................................................... 5

2.3 Redundancy and Physical Security............................................................................ 7

2.4 Roles and Services................................................................................................. 10

2.4.1 Crypto Officer Services................................................................................. 11

2.4.2 User Services................................................................................................. 12

2.5 Key Management .................................................................................................. 13

2.6 Self Tests............................................................................................................... 13

3Secure Operation of the Contivity Switch................................................................13

1Introduction

1.1 Purpose

This is a non-proprietary Cryptographic Module Security Policy for the Contivity™ Extranet

Switch 4500. This security policy describes how the Contivity™ Extranet Switch 4500 meets

the security requirements of FIPS 140-1, and how to operate the Contivity™ Extranet Switch

4500 in a secure FIPS 140-1 mode. This policy was prepared as part of the level 2 FIPS 140-

1 certification of the Contivity™ Extranet Switch 4500.

FIPS 140-1 (Federal Information Processing Standards Publication 140-1 -- Security

Requirements for Cryptographic Modules) details the U.S. Government requirements for

cryptographic modules. More information about the FIPS 140-1 standard and validation

program is available on the NIST web site at http://csrc.nist.gov/cryptval/.

1.2 References

This document deals only with operations and capabilities of the Contivity™ Extranet Switch

4500 in the technical terms of a FIPS 140-1 cryptographic module security policy. More

information is available on the Contivity™ Extranet Switch 4500 and the entire line of

Contivity™ products from the following sources:

•The Nortel Networks web site contains information on the full line of Contivity

products at www.nortelnetworks.com.

•For answers to technical or sales related questions please refer to the contacts listed

on the Nortel Networks web site at www.nortelnetworks.com.

1.3 Terminology

In this document the Nortel Contivity™ Extranet Switch 4500 is referred to as the switch, the

Contivity™ Switch, module, or system.

1.4 Document Organization

The Security Policy document is part of the complete FIPS 140-1 Submission Package. In

addition to this document, the complete Submission Package contains:

♦Vendor Evidence document

♦Finite State Machine

♦Module Software Listing

♦Other supporting documentation as additional references

This document provides an overview of the Contivity™ Switch and explains the secure

configuration and operation of the module. This introduction section is followed by Section 2,

which details the general features and functionality of the Contivity™ Switch. Section 3

specifically addresses the required configuration for the FIPS-mode of operation.

This Security Policy and other Certification Submission Documentation was produced by

Corsec Security, Inc. under contract to Nortel Networks. With the exception of this Non-

Proprietary Security Policy, the FIPS 140-1 Certification Submission Documentation is Nortel-

proprietary and is releasable only under appropriate non-disclosure agreements. For access to

these documents, please contact Nortel Networks.

2The Contivity Extranet 4500 Switch

The Nortel Networks Contivity Extranet Switch 4500 provides a scalable, secure, manageable

remote access server that meets FIPS 140-1 level 2 requirements. This section will describe

the general features and functionality provided by the Contivity Extranet Switch. Section 3 will

provide further details on how the Contivity Switch addresses FIPS 140-1 requirements.

2.1 Cryptographic Module

The Contivity Extranet Switch combines remote access protocols, security, authentication,

authorization, and encryption technologies into a single solution.

Figure 1– The Contivity Extranet 4500 Switch

The Switch can support up to 5,000 simultaneous user sessions, allowing each user to exercise

a variety of secure connections and services. The Switch supports a number of secure

network-layer and data-link-layer protocols including Internet Protocol Security (IPSec), Point-

to-Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol (L2TP), and Layer Two

Forwarding (L2F). The architecture for the Switch is user-centric, where an individual user or

group of users can be associated with a set of attributes that provide custom access to the

Extranet. In effect, you can create a personal Extranet based on the special needs of a user or

group.

2.2 Module Interfaces

The interfaces for the Switch are located on the rear panel as shown in Figure 2.

Figure 2– Physical Interfaces

The physical interfaces include the dual power plugs for the redundant power supplies, the

power and reset buttons, the serial port, the LAN Port RJ-45 connector, and up to six slots

containing additional network connectors. The power and reset buttons light up to indicate

power and hard disk activity respectively. Each RJ-45 connector is accompanied with Light

Emitting Diodes (LEDs), including green and orange LEDs on the LAN Port, and Link/Activity

and 10/100Mbps LEDs on the 10/100BASE-TX LAN ports.

Figure 3shows details of the LAN Port LEDs, with the green LED indicating 100Mbps activity,

and the orange LED indicating link status and activity. More information on these LEDs and the

LAN Port interface can be found in the Contivity Extranet Switch 4500 Getting Started

Guide, 1C.

Figure 3– LAN Port LEDs

Figure 4shows details of the 10/100BASE-TX LAN Port LEDs, with the link status LED

indicating connection to a hub, the activity LED indicating traffic being sent, and the 100TX

LED indicating 100Mbps operation. More information on these LEDs and the /100BASE-TX

LAN Port interface can be found in the manual “Getting Started with the Contivity Extranet

Switch 4500”.

Figure 4– 10/100BASE-TX LAN LEDs

These physical interfaces are separated into the logical interfaces from FIPS as described in the

following table:

Switch physical interface FIPS 140-1 Logical Interface

10/100BASE-TX LAN Port,

LAN Port,

Serial Port

Data Input Interface

10/100BASE-TX LAN Port,

LAN Port,

Serial Port

Data Output Interface

Power Button,

Reset Button,

Serial Port,

LAN Port

Control Input Interface

LAN Port LEDs,

10/100BASE-TX LAN PortLEDs

Serial Port

Power Button Light

Reset Button Light

Status Output Interface

Dual Power Plugs Power Interface

Table 1– FIPS 140-1 Logical Interfaces

2.3 Redundancy and Physical Security

With up to 5,000 simultaneous users accessing critical information, network managers can rest

assured that the Contivity Extranet Switch is designed for high availability. Auto switching

redundant power supplies and a redundant storage system protect against failure. Multilevel

authentication methods and automatic backup of all system and accounting data ensure

maximum reliability and management peace of mind. The Switch meets FCC requirements in

47 CFR Part 15 for personal computers and peripherals designated for business use (ClassA),

and is labeled in accordance with FCC requirements.

The Contivity™ Extranet Switch 4500 is entirely encased by a thick steel chassis. The system

has three removable portions: the front bezel, the top cover, and the I/O Panel. Removing the

front bezel allows access to the dual power supplies, hard drives, and floppy drive. Removing

the top cover or the I/O panel allows access to the motherboard, memory, and expansion slots.

Figure 5– The Steel Cover of the Extranet Switch 4500

Once the Extranet Switch 4500 has been configured in its FIPS 140-1 level 2 conformant

mode, the system cannot be accessed without signs of tampering. To seal the system, apply

serialized tamper-evident labels as follows:

1. Clean the cover of any grease, dirt, or oil before applying the tamper-evident labels.

Alcohol based cleaning pads are recommended for this purpose. The temperature

of the switch should be above 10°C.

2. Apply two (2) labels on the sides overlapping the top cover and the main chassis as

shown in Figure 6.

3. Apply two (2) labels on the top and bottom overlapping the bezel and the main

chassis as shown in Figure 6.

4. Apply one (1) label over the air holes on the rear I/O Panel as shown in Figure 7

5. Apply one (1) label over the keyboard button cover as shown in Figure 7

6. Apply one (1) label over the gap between the I/O Panel and the main chassis as

shown in Figure 7

7. Apply 2 labels over the AC filter input module screws as shown in Figure 7

8. Record the serial numbers of the labels applied to the module.

9. Allow 24 hours for the adhesive in the tamper-evident seals to completely cure.

(2) Top Cover

Labels

(2) Front

Bezel Labels

Figure 6– Tamper-Evident Labels Applied to Switch Front Bezel and Top Cover

(2) AC Filter

InputLabels

(1) Air Hole

Label

(1) I/O Panel

Label

(1)Keyboard

Connector

Label

Figure 7– Tamper Evident Labels Applied to Rear Panel

The tamper-evident seals are produced from a special thin gauge white vinyl with self-adhesive

backing. Any attempt to open the switch will damage or destroy the tamper-evident seals, or

the painted surface and metal of the module cover. Since the tamper-evident labels have non-

repeated serial numbers, the labels may be inspected for damage and compared against the

applied serial numbers to verify that the module has not been tampered with. An intact label is

shown in Figure 8, with a visible serial number and no breaks.

FIPS 140-1 Level 2 Tamper Evident Label

Serial Number: 5673422

Contivity

Extranet

Switch

Figure 8– Tamper-Evident Label

Attempting to remove a label breaks it or continually tears off small fragments as depicted in

Figure 9. Other signs of tamper-evidence include a strong smell of organic solvents, warped or

bent cover metal, and scratches in the paint on the module.

FIPS 140-1 Level 2 Tamper Evident Label

Serial Number: 5673422

Contivity

Extranet

Switch

Figure 9– Damaged Tamper-Evident Label

2.4 Roles and Services

The Switch supports up to 5000 simultaneous users sending packets using Internet Protocol

Security (IPSec), Point-to-Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol

(L2TP), and Layer Two Forwarding (L2F). In addition, an administrator may securely

configure the switch either locally, or remotely.

The Switch employs role-based authentication of users, and stores user identity information in

an internal or an External Lightweight Directory Access Protocol (LDAP) database.

Authentication can optionally be performed against a variety of external servers using LDAP or

RADIUS (Novell NDS, Microsoft Windows NT Domains, Security Dynamics ACE Server,

Axent OmniGuard Defender)

There are two main roles in the Switch (as required by FIPS 140-1) that users may assume:

Crypto Officer role and User role. The administrator of the switch assumes the Crypto Officer

role in order to configure and maintain the switch using Crypto Officer services, while the Users

exercise only the User services. The Crypto Officer role is assumed with the following rights:

•Manage Switch rights: (either none, view switch, or manage switch). View

switch rights allow an administrator to view all the configuration and status

information on the switch. Manage switch rights allow an administrator to

configure the switch and actually change settings.

•Manage Users rights: (either none, view users, or manage users). View users

rights allow an administrator to review all user accounts and settings on the Switch

while manage users rights actually allow an administrator to create, modify, and

delete users.

A User authenticates and assumes the User role in order to have rights to access the following

services:

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Nortel Interruttore

Nortel

Nortel Passport 4400 Series Manuale di riferimento

Nortel

Nortel DMS-100 Series Istruzioni operative e di manutenzione

Nortel

Nortel Passport 1424T Manuale di istruzioni

Nortel

Nortel 70 Series Manuale di installazione e funzionamento

Nortel

Nortel 2500 Seriess Manuale dell'operatore

Nortel

Nortel CVX 600 Manuale

Nortel

Nortel BayStack 5520-48T-PWR Manuale utente

Nortel

Nortel 8000 Series Manuale di istruzioni

Nortel

Nortel Contivity1510D Manuale di servizio

Nortel

Nortel Passport 4400 Series Istruzioni per il montaggio

Nortel

Nortel 700117 Manuale

Nortel

Nortel AN/DC Manuale utente

Nortel

Nortel 1600 Series Manuale di istruzioni

Nortel

Nortel BayStack 460 Switch Manuale di programmazione

Nortel

Nortel BayStack 400-2FX Manuale utente

Nortel

Nortel BayStack 325-24G Manuale utente

Nortel

Nortel Contivity 600 Manuale utente

Nortel

Nortel Ethernet Routing Switch 8000Series Istruzioni di montaggio

Nortel

Nortel 4524GT Guida rapida

Nortel

Nortel Passport 8010 Manuale utente

Nortel

Nortel Versalar 15000 Istruzioni operative

Nortel

Nortel COMMISSIONING 8600 Guida

Nortel

Nortel BayStack 100 Series Guida rapida

Nortel

Nortel Application Switch 2424-SSL Guida di riferimento

Manuali Interruttore popolari di altre marche

URC

URC Total Control MFS-8 Manuale utente

Azbil

Azbil HPQ-D11 Manuale utente

Sony

Sony DFS-900M Manuale utente

SICK

SICK i17S Manuale utente

F&F

F&F SZR-277 Manuale utente

Shure

Shure UAMS/BK Manuale utente

Dräger

Dräger X-zone Switch Off Manuale utente

Asco

Asco Joucomatic 349 Series Manuale utente

BT Mini Hub Manuale utente

D-Link

D-Link DES-1226G Manuale utente

Johnson Controls

Johnson Controls FS80-C Manuale utente

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Manuale utente

MicroNet

MicroNet SP1200A Manuale utente

Ruijie

Ruijie RG-PF2920 Series Manuale di installazione e funzionamento

Altinex

Altinex DA1914SX Manuale utente

MiLAN

MiLAN MIL-SM2401M Manuale utente

RJM

RJM MASTERMIND PBC/6X Manuale utente

Atlas

Atlas MMK-KVM8 Manuale utente