Cisco Aggregation Services Router (ASR) 1000 Series

Common Criteria Operational User Guidance

And Preparative Procedures

Version 0.4

Table of Contents

1 Introduction ............................................................................................................................. 7

1.1 Audience ......................................................................................................................... 7

1.2 Purpose ............................................................................................................................ 7

1.3 Document References ..................................................................................................... 7

1.4 Supported Hardware and Software ................................................................................. 9

1.5 Operational Environment ................................................................................................ 9

1.5.1 Supported non-TOE Hardware/Software/Firmware ................................................... 9

1.6 Excluded Functionality ................................................................................................. 10

2 Secure Acceptance of the TOE ............................................................................................. 11

3.2.4 Administrator Configuration and Credentials ........................................................... 17

3.2.5 Session Termination.................................................................................................. 17

3.2.6 User Lockout ............................................................................................................. 18

3.3 Network Protocols and Cryptographic Settings ............................................................ 19

3.3.1 Remote Administration Protocols ............................................................................. 19

3.3.2 Authentication Server Protocols ............................................................................... 20

3.3.3 Logging Configuration.............................................................................................. 20

3.3.4 Logging Protection.................................................................................................... 22

3.3.5 Base Firewall Rule set Configuration ....................................................................... 24

3.3.6 Routing Protocols...................................................................................................... 26

4.4 Identification and Authentication ................................................................................. 30

4.5 Login Banners ............................................................................................................... 30

4.6 Virtual Private Networks (VPN) ................................................................................... 30

4.6.1 IPsec Overview ......................................................................................................... 30

4.6.2 IPsec Transforms and Lifetimes ............................................................................... 34

4.6.3 NAT Traversal .......................................................................................................... 36

4.6.4 X.509 Certificates ..................................................................................................... 36

4.6.5 Information Flow Policies......................................................................................... 41

4.6.6 IPsec Session Interuption/Recovery ......................................................................... 42

8 Security Measures for the Operational Environment............................................................ 70

9 Related Documentation ......................................................................................................... 71

9.1 World Wide Web .......................................................................................................... 71

9.2 Ordering Documentation .............................................................................................. 71

9.3 Documentation Feedback.............................................................................................. 71

10 Obtaining Technical Assistance ............................................................................................ 72

List of Tables

Table 1: Acronyms .......................................................................................................................... 5

Table 2: Cisco Documentation....................................................................................................... 7

Table 3: Operational Environment Components ............................................................................ 9

Table 4: Excluded Functionality .................................................................................................. 10

Table 5: TOE External Identification .......................................................................................... 11

Table 6: Evaluated Software Images ........................................................................................... 13

Table 7: Auditable Events ............................................................................................................. 46

Table 8 Auditable Administrative Events .................................................................................... 55

Table 8: Protocols and Services .................................................................................................... 63

List of Acronyms

The following acronyms and abbreviations are used in this document:

administrators in this document.

1 Introduction

This Operational User Guidance with Preparative Procedures documents the administration of

the Aggregation Services Router (ASR) 1000 Series (ASR), the TOE, as it was certified under

Common Criteria. The Aggregation Services Router (ASR) 1000 Series (ASR ) may be

referenced below as the model number series ex. ASR 1000, TOE, or simply router.

1.1 Audience

This document is written for administrators configuring the TOE. This document assumes that

Criteria evaluation. It was written to highlight the specific TOE configuration and administrator

configuration. This document is not meant to detail specific actions performed by the

administrator but rather is a road map for identifying the appropriate locations within Cisco

documentation to get the specific details for configuring and maintaining ASR operations. All

security relevant commands to manage the TSF data are provided within this documentation

within each functional section.

1.3 Document References

This document makes reference to several Cisco Systems documents. The documents used are

shown below in Table 2. Throughout this document, the guides will be referred to by the “#”,

such as [1].

The ASR must be given basic configuration via console connection prior to being connected to

any network.

3.2.1 Options to be chosen during the initial setup of the ASR

answers that fit your policies with the exception of the following values.

1 – Enable Secret – Must adhere to the password complexity requirements. Note that this setting

on Using Setup Mode to Configure a Cisco Networking Device  Click on subsection “Using

2 – Enable Password - Must adhere to the password complexity requirements. Note that this must

suggested. This password allows access to the device through only the console port. Later in this

guide steps will be given to allow ssh into the vty lines. [4] Under Configure  Click on

Configuration Guides  System Management  Click on Using Setup Mode to Configure a

Cisco Networking Device  Click on subsection “Using the System Configuration Dialog to

4 – Configure SNMP Network Management – NO (this is the default). Note that this setting can

Management Click on Using Setup Mode to Configure a Cisco Networking Device Click on

subsection “Using the System Configuration Dialog to Create an Initial Configuration File”

run start). These commands should be used frequently when making changes to the

configuration of the Router. If the Router reboots and resumes operation when uncommitted

changes have been made, these changes will be lost and the Router will revert to the last

configuration saved.

3.2.3 Enabling FIPS Mode

The value of the boot field must be 0x0102. This setting disables break from the console to the

ROM monitor and automatically boots the IOS image. From the ROMMON command line enter

the following:

confreg 0x0102 [3] under section “C commands”

The self-tests for the cryptographic functions in the TOE are run automatically during power-on

as part of the POST. The same POST self-tests for the cryptographic operations can also be

service password-encryption [10] Cisco IOS Security Command Reference: Commands

S to Z

Configures local AAA authentication:

aaa authentication login default local [10] Cisco IOS Security Command Reference:

Commands A to C

aaa authorization exec default local [10] Cisco IOS Security Command Reference:

Commands A to C

When creating administrator accounts, all individual accounts are to be set to a privilege level of

one. This is done by using the following commands:

username <name> password <password> [10] Cisco IOS Security Command

Inactivity settings must trigger termination of the administrator session. These settings are

configurable by setting

line vty <first> <last> [2] and [20] under section “Configuring Virtual Terminal Lines

exec-timeout <time> [10] >System Management > Cisco IOS Configuration

line console [19] under section “Configuring Line Password Protection”

exec-timeout <time>

To save these configuration settings to the startup configuration:

copy run start [3] under section “C commands”

where first and last are the range of vty lines on the box (i.e. “0 4”), and time is the period of

All TOE administration must be performed through an IPsec tunnel. However, it is

recommended that the interactive interface be over SSH. The following method is used to

configure SSH for use in a secure manner.

6. Configure vty lines to accept ‘ssh’ login services