National Information Assurance Partnership
Common Criteria Evaluation and Validation Scheme
Validation Report
Cisco Catalyst Industrial Ethernet 3100 (IE3100)
Rugged Series Switches running IOS-XE 17.12
Report Number: CCEVS-VR-VID11490-2024
Dated: 09/12/2024
Version: 1.0
National Institute of Standards and Technology National Security Agency
Information Technology Laboratory Information Assurance Directorate
100 Bureau Drive 9800 Savage Road STE 6982
Gaithersburg, MD 20899 Fort George G. Meade, MD 20755-6982
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
ii
ACKNOWLEDGEMENTS
Validation Team
Jerome Myers
David Thompson
The Aerospace Corporation
Common Criteria Testing Laboratory
Cody Cummins
Katie Sykes
Gossamer Security Solutions, Inc.
Catonsville, MD
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
iii
Table of Contents
1 Executive Summary.................................................................................................... 1
2 Identification............................................................................................................... 2
3 Architectural Information ........................................................................................... 3
3.1 TOE Evaluated Configuration ............................................................................ 4
3.2 TOE Architecture................................................................................................ 4
3.3 Physical Boundaries............................................................................................ 4
4 Security Policy............................................................................................................ 4
4.1 Security audit ...................................................................................................... 4
4.2 Cryptographic support ........................................................................................ 5
4.3 Identification and authentication......................................................................... 6
4.4 Security management.......................................................................................... 6
4.5 Protection of the TSF.......................................................................................... 6
4.6 TOE access.......................................................................................................... 7
4.7 Trusted path/channels ......................................................................................... 7
5 Assumptions & Clarification of Scope ....................................................................... 7
6 Documentation............................................................................................................ 8
7 IT Product Testing ...................................................................................................... 8
7.1 Developer Testing............................................................................................... 8
7.2 Evaluation Team Independent Testing ............................................................... 8
8 Evaluated Configuration............................................................................................. 9
9 Results of the Evaluation ............................................................................................ 9
9.1 Evaluation of the Security Target (ASE)............................................................ 9
9.2 Evaluation of the Development (ADV) ............................................................ 10
9.3 Evaluation of the Guidance Documents (AGD)............................................... 10
9.4 Evaluation of the Life Cycle Support Activities (ALC) ................................... 10
9.5 Evaluation of the Test Documentation and the Test Activity (ATE) ............... 10
9.6 Vulnerability Assessment Activity (VAN)....................................................... 11
9.7 Summary of Evaluation Results........................................................................ 11
10 Validator Comments/Recommendations .................................................................. 11
11 Annexes..................................................................................................................... 12
12 Security Target.......................................................................................................... 12
13 Glossary .................................................................................................................... 12
14 Bibliography ............................................................................................................. 13
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
1
1 Executive Summary
This report documents the assessment of the National Information Assurance Partnership
(NIAP) validation team of the evaluation of Cisco Catalyst Industrial Ethernet 3100
(IE3100) Rugged Series Switches running IOS-XE 17.12 solution provided by Cisco
Systems, Inc. It presents the evaluation results, their justifications, and the conformance
results. This Validation Report is not an endorsement of the Target of Evaluation by any
agency of the U.S. government, and no warranty is either expressed or implied.
The evaluation was performed by the Gossamer Security Solutions (Gossamer) Common
Criteria Testing Laboratory (CCTL) in Catonsville, MD, United States of America, and
was completed in September 2024. The information in this report is largely derived from
the Evaluation Technical Report (ETR) [9] and associated test reports, all written by
Gossamer Security Solutions. The evaluation determined that the product is both Common
Criteria Part 2 [2] Extended and Part 3 [3] Conformant, and meets the assurance
requirements of the
• collaborative Protection Profile for Network Devices, Version 2.2e, 23 March
2020 (NDcPP22e) [5].
The Target of Evaluation (TOE) is the Cisco Catalyst Industrial Ethernet 3100 (IE3100)
Rugged Series Switches running IOS-XE 17.12.
The Target of Evaluation (TOE) identified in this Validation Report has been evaluated at a
NIAP approved Common Criteria Testing Laboratory using the Common Methodology for
IT Security Evaluation (Version 3.1, Rev 5) [4] for conformance to the Common Criteria
for IT Security Evaluation (Version 3.1, Rev 5). This Validation Report applies only to the
specific version of the TOE as evaluated. The evaluation has been conducted in
accordance with the provisions of the NIAP Common Criteria Evaluation and Validation
Scheme and the conclusions of the testing laboratory in the evaluation technical report are
consistent with the evidence provided.
The validation team monitored the activities of the evaluation team, provided guidance on
technical issues and evaluation processes, and reviewed the individual work units and
successive versions of the ETR. The validation team found that the evaluation showed that
the product satisfies all the functional requirements and assurance requirements stated in
the Security Target (ST) [6]. Therefore, the validation team concludes that the testing
laboratory’s findings are accurate, the conclusions justified, and the conformance results
are correct. The conclusions of the testing laboratory in the evaluation technical report are
consistent with the evidence produced.
The technical information included in this report was obtained from the Cisco Catalyst
Industrial Ethernet 3100 (IE3100) Rugged Series Switches running IOS-XE 17.12
Common Criteria Security Target, Version 0.5, 03 September 2024 [6] and analysis
performed by the Validation Team.
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
2
2 Identification
The CCEVS is a joint National Security Agency (NSA) and National Institute of Standards
and Technology (NIST) effort to establish commercial facilities to perform trusted product
evaluations. Under this program, security evaluations are conducted by commercial testing
laboratories called Common Criteria Testing Laboratories (CCTLs) using the Common
Evaluation Methodology (CEM) in accordance with National Voluntary Laboratory
Assessment Program (NVLAP) accreditation.
The NIAP Validation Body assigns Validators to monitor the CCTLs to ensure quality and
consistency across evaluations. Developers of information technology products desiring a
security evaluation contract with a CCTL and pay a fee for their product’s evaluation.
Upon successful completion of the evaluation, the product is added to NIAP’s Validated
Products List.
Table 1 provides information needed to completely identify the product, including:
• The Target of Evaluation (TOE): the fully qualified identifier of the product as
evaluated.
• The Security Target (ST), describing the security features, claims, and assurances of the
product.
• The conformance results of the evaluation.
• The Protection Profile to which the product is conformant.
• The organizations and individuals participating in the evaluation.
Table 1: Evaluation Identifiers
Item Identifier
Evaluation Scheme United States NIAP Common Criteria Evaluation and Validation Scheme
TOE Cisco Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches
running IOS-XE 17.12
Protection Profile
(Specific models identified in Section 8)
collaborative Protection Profile for Network Devices, Version 2.2e, 23 March
2020 (NDcPP22e) [5]
ST Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches
running IOS-XE 17.12 Common Criteria Security Target, Version 0.5, 03
September, 2024 [6]
Evaluation Technical
Report
Evaluation Technical Report for Cisco Catalyst Industrial Ethernet 3100 (IE3100)
Rugged Series Switches running IOS-XE 17.12, Version 0.3, 09/05/2024 [9]
CC Version Common Criteria for Information Technology Security Evaluation, Version 3.1,
rev 5 [1, 2, 3]
Conformance Result CC Part 2 extended, CC Part 3 conformant
Sponsor Cisco Systems, Inc.
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
3
Item Identifier
Developer Cisco Systems, Inc.
Common Criteria
Testing Lab (CCTL)
Gossamer Security Solutions, Inc.
Catonsville, MD
CCEVS Validators Jerome Myers and David Thompson of The Aerospace Corporation
3 Architectural Information
Note: The following architectural description is based on the description presented in the
Security Target.
The Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches, running
IOS-XE 17.12, is a purpose-built switching and routing platform with OSI Layer2 and
Layer3 traffic filtering capabilities.
The TOE is comprised of both software and hardware. The software is comprised of the
Universal Cisco Internet Operating System (IOS) XE software image Release IOS-XE
17.12. The hardware models that comprise the TOE have common hardware
characteristics. These characteristics affect only non-TSF relevant functions of the switches
(such as throughput and amount of storage) and therefore support security equivalency of
the switches in terms of hardware.
The Cisco Catalyst Industrial Ethernet IE3100 Rugged Series Switches primary features
include the following:
• Central processor that supports all system operations
• Dynamic memory, used by the central processor for all system operation
• x86 CPU complex with minimum, based on model of 2 GB memory, 1.5 GB of
flash
• Flash memory (EEPROM), used to store the Cisco IOS-XE image (binary program)
• Non-volatile read-only memory (ROM) used to store the bootstrap program and
power-on diagnostic programs
• Non-volatile random-access memory (NVRAM) used to store switch configuration
parameters that are used to initialize the system at start-up
• Physical network interfaces (minimally two) (for example, RJ45 serial and standard
10/100/1000 Ethernet ports). Some models have a fixed number and/or type of
interfaces; some models have slots that accept additional network interfaces.
• Dedicated management port on the switch, RJ-45 console port and a USB mini-
Type B console connection
• Built for harsh environments and temperature ranges, fanless, convection-cooled
with no moving parts for extended durability and hardened for vibration, shock and
surge, and electrical noise immunity.
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
4
Although IOS-XE performs many networking functions, this TOE only addresses the
functions that provide for the security of the TOE itself as described in Section 4 below.
3.1 TOE Evaluated Configuration
Detail regarding the evaluated configuration is provided in Section 8 below.
3.2 TOE Architecture
The Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches are
switching and routing platforms that provide connectivity and security services. These
switches offer broadband speeds and simplified management to small businesses, and
enterprise small branch and teleworkers. The Cisco Catalyst Industrial Ethernet 3100
(IE3100) Rugged Series Switches are single-device security and switching solutions for
protecting the network.
3.3 Physical Boundaries
The TOE is a hardware and software solution that makes up the Cisco Catalyst Industrial
Ethernet IE3100 Rugged Series Switch models as follows: IE3100 running Cisco IOS-XE
17.12. The network on which they reside is considered part of the operational
environment.
4 Security Policy
This section summaries the security functionality of the TOE:
1. Security audit
2. Cryptographic support
3. Identification and authentication
4. Security management
5. Protection of the TSF
6. TOE access
7. Trusted path/channels
4.1 Security audit
The Cisco Catalyst Industrial Ethernet IE3100 Rugged Series Switches provide extensive
auditing capabilities. The TOE generates a comprehensive set of audit logs that identify
specific TOE operations. For each event, the TOE records the date and time of each event,
the type of event, the subject identity, and the outcome of the event.
Auditable events include:
• Failure on invoking cryptographic functionality such as establishment, termination
and failure of cryptographic session establishments and connections
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
5
• Modifications to the group of users that are part of the Authorized Administrator
roles
• All use of the user identification mechanism
• Any use of the authentication mechanism
• Unsuccessful login attempts limit is met or exceeded
• Any change in the configuration of the TOE
• Changes to time
• Initiation of TOE update
• Indication of completion of TSF self-test
• Termination of a remote or local session
• Initiation and termination of a trusted channel
The TOE is configured to transmit its audit messages to an external syslog server.
Communication with the syslog server is protected using TLS and the TOE can determine
when communication with the syslog server fails. If that should occur, the TOE will store
all audit records locally and when the connection to the remote syslog server is restored, all
stored audit records will be transmitted to the remote syslog server.
The audit logs can be viewed on the TOE using the appropriate IOS-XE commands. The
records include the date/time the event occurred, the event/type of event, the user associated
with the event, and additional information of the event and its success and/or failure. The
TOE does not have an interface to modify audit records, though there is an interface
available for the Authorized Administrator to clear audit data stored locally on the TOE.
4.2 Cryptographic support
The TOE provides the cryptography to support all security functions. With the exception of
RSA key establishment and FFC schemes using safe-prime groups, all the algorithms
claimed have NIST CAVP certificates (the Operation Environment is Marvell Prestera
(ARMv8 Cortex-A55) processor). RSA key establishment and FFC schemes using safe-
prime groups were verified using a known good implementation.
The TOE leverages the IOS Common Cryptographic Module (IC2M) Rel5a for SSH and
CiscoSSL FIPS Object Module (FOM) Cryptographic Implementation 7.2a for TLS as
identified in the table below. The IOS software calls the CiscoSSL FIPS Object Module
(FOM) Cryptographic Implementation 7.2a (Firmware Version: 7.2a) and IOS Common
Cryptographic Module (IC2M) Rel5a (Firmware Version: Rel 5a) that have been validated
for conformance to the requirements of FIPS 140-2 Level 1.
The TOE provides cryptography in support of secure connections that includes remote
administrative management via SSHv2, and TLS to secure the transmission of audit records
to the remote syslog server.
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
6
4.3 Identification and authentication
The TOE performs two types of authentication: device-level authentication of the remote
device (TOE peers) and user authentication for the Authorized Administrator of the TOE.
Device-level authentication allows the TOE to establish a secure channel with a trusted
peer. The secure channel is established only after each device authenticates the other.
Device-level authentication is performed via TLS authentication.
The TOE provides authentication services for administrative users to connect to the TOE’s
secure Command Line Interface (CLI) administrator interface. The TOE requires
Authorized Administrators to authenticate prior to being granted access to any of the
management functionality. The TOE can be configured to require a minimum password
length of between 1-127 characters. The TOE provides administrator authentication against
a local user database. Password-based authentication can be performed on the local serial
console or SSHv2 interfaces. The SSHv2 interface also supports authentication using SSH
keys.
The TOE also provides an automatic lockout when a user attempts to authenticate and
enters invalid information. When the threshold for a defined number of failed
authentication attempts has exceeded the configured allowable attempts, the user is locked
out for an administrator specified period of time.
The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for
TLS connections.
4.4 Security management
The TOE provides secure remote administrative interface and local interface to perform
security management functions. This includes the ability to configure cryptographic
functionality; a function to set an access banner containing an advisory notice and consent
warning message; a session inactivity timer before session termination as well as an ability
to update TOE software. The TOE provides a Security Administrator role and only the
Security Administrator can perform the TOE security management functions.
4.5 Protection of the TSF
The TOE protects against interference and tampering by untrusted subjects by
implementing identification, authentication, and access controls to limit configuration to
Authorized Administrators. The TOE prevents the reading of cryptographic keys and
passwords. Additionally, Cisco IOS-XE is not a general-purpose operating system, access
to Cisco IOS-XE memory space is restricted to Cisco IOS-XE functions.
The TOE can verify software updates prior to the software updates being installed on the
TOE. This verification avoids the installation of unauthorized software.
The TOE internally maintains the date and time. This date and time are used as the
timestamp that is applied to audit records generated by the TOE. The TOE provides the
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
7
Authorized Administrators the capability to update the TOE’s clock manually to maintain a
reliable timestamp.
Finally, the TOE performs self-testing to verify correct operation of the TOE itself and that
of the cryptographic module.
4.6 TOE access
The TOE can terminate inactive local and remote sessions after an Authorized
Administrator configurable time period. Once a session has been terminated, the TOE
requires the Authorized Administrator to re-authenticate to establish a new session.
Sessions can also be terminated if an Authorized Administrator enters “exit” or the
“logout” command.
The TOE can also display an Authorized Administrator specified banner on the CLI
management interface prior to allowing any administrative access to the TOE.
4.7 Trusted path/channels
The TOE allows a trusted path to be established to itself from remote administrators over
SSHv2 and initiates outbound TLS trusted channels to transmit audit messages to remote
syslog servers.
5 Assumptions & Clarification of Scope
Assumptions
The Security Problem Definition, including the assumptions, may be found in the following
documents:
• collaborative Protection Profile for Network Devices, Version 2.2e, 23 March 2020
(NDcPP22e)
That information has not been reproduced here and the NDcPP22e should be consulted if
there is interest in that material.
The scope of this evaluation was limited to the functionality and assurances covered in the
NDcPP22e as described for this TOE in the Security Target. Other functionality included in
the product was not assessed as part of this evaluation. All other functionality provided by
the devices needs to be assessed separately, and no further conclusions can be drawn about
their effectiveness.
Clarification of scope
All evaluations (and all products) have limitations, as well as potential misconceptions that
need clarification. This text covers some of the more important limitations and
clarifications of this evaluation. Note that:
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
8
• As with any evaluation, this evaluation only shows that the evaluated configuration
meets the security claims made with a certain level of assurance (the assurance
activities specified in the Protection Profile for Network Devices and performed by
the evaluation team).
• This evaluation covers only the specific device models and software as identified in
this document, and not any earlier or later versions released or in process.
• This evaluation did not specifically search for, nor attempt to exploit, vulnerabilities
that were not “obvious” or vulnerabilities to objectives not claimed in the ST. The
CEM [4] defines an “obvious” vulnerability as one that is easily exploited with a
minimum of understanding of the TOE, technical sophistication, and resources.
• The functionality evaluated is scoped exclusively to the security functional
requirements specified in the NDcPP22e and applicable Technical Decisions. Any
additional security related functional capabilities of the TOE were not covered by
this evaluation.
6 Documentation
The following documents were available with the TOE for evaluation:
Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches running IOS-XE 17.12 CC
Configuration Guide, Version 0.4, August 12, 2024
Cisco Catalyst IE3100 Rugged Series Switches Hardware Installation Guide, 08-04-2023
Command Reference, Cisco IOS XE Dublin 17.12.x (Catalyst 9300 Switches), 07-28-2023
Programmability Command Reference, Cisco IOS XE Dublin 17.12.x, 07-28-2023
Security Configuration Guide, Cisco Catalyst IE3x00 and IE3100 Rugged, IE3400 Heavy Duty, and ESS3300
Series Switches, 04-05-2024
System Message Guide for Cisco IOS XE Dublin 17.12.x, 09-21-2023
7 IT Product Testing
This section describes the testing efforts of the developer and the Evaluation Team. It is
derived from information contained in the Assurance Activity Report for Cisco Catalyst
Industrial Ethernet 3100 (IE3100) Rugged Series Switches running IOS-XE 17.12, Version
0.3, 09/05/2024 (AAR).
7.1 Developer Testing
No evidence of developer testing is required in the assurance activities for this product.
7.2 Evaluation Team Independent Testing
The evaluation team verified the product according to the Cisco Catalyst Industrial 3100
(IE3100) Rugged Series Switches running IOS-XE 17.12 Common Criteria Security
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
9
Target, Version 0.5, 03 September 2024 and ran the tests specified in the NDcPP22e,
including the tests associated with optional requirements.
8 Evaluated Configuration
The TOE is a hardware and software solution composed of the Cisco Catalyst Industrial
Ethernet 3100 (IE3100) Rugged Series Switches running IOS-XE 17.12.
The evaluated configuration consists of the following devices:
3100 Series
• IE-3100-4T2S
• IE-3100-8T2C
• IE-3100 18T2C
• IE-3100-8T4S
• IE-3105-8T2C
• IE-3105-18T2C
9 Results of the Evaluation
The results of the assurance requirements are generally described in this section and are
presented in detail in the proprietary ETR. The reader of this document can assume that all
assurance activities and work units received a passing verdict.
A verdict for an assurance component is determined by the resulting verdicts assigned to
the corresponding evaluator action elements. The evaluation was conducted based upon
CC version 3.1 rev 5 and CEM version 3.1 rev 5. The evaluation determined the Cisco
Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches running IOS-XE 17.12
TOE to be Part 2 extended, and to meet the SARs contained in the NDcPP22e.
9.1 Evaluation of the Security Target (ASE)
The evaluation team applied each ASE CEM work unit. The ST evaluation ensured the ST
contains a description of the environment in terms of policies and assumptions, a statement
of security requirements claimed to be met by the Cisco Catalyst Industrial Ethernet 3100
(IE3100) Rugged Series Switches running IOS-XE 17.12 products that are consistent with
the Common Criteria, and product security function descriptions that support the
requirements.
The validator reviewed the work of the evaluation team and found that sufficient evidence
and justification was provided by the evaluation team to confirm that the evaluation was
conducted in accordance with the requirements of the CEM, and that the conclusion
reached by the evaluation team was justified.
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
10
9.2 Evaluation of the Development (ADV)
The evaluation team applied each ADV CEM work unit. The evaluation team assessed the
design documentation and found it adequate to aid in understanding how the TSF provides
the security functions. The design documentation consists of a functional specification
contained in the Security target and Guidance documents. Additionally, the evaluator
performed the assurance activities specified in the NDcPP22e related to the examination of
the information contained in the TSS.
The validator reviewed the work of the evaluation team and found that sufficient evidence
and justification was provided by the evaluation team to confirm that the evaluation was
conducted in accordance with the requirements of the CEM, and that the conclusion
reached by the evaluation team was justified.
9.3 Evaluation of the Guidance Documents (AGD)
The evaluation team applied each AGD CEM work unit. The evaluation team ensured the
adequacy of the user guidance in describing how to use the operational TOE. Additionally,
the evaluation team ensured the adequacy of the administrator guidance in describing how
to securely administer the TOE. All guidance documents were assessed during the design
and testing phases of the evaluation to ensure they were complete.
The validator reviewed the work of the evaluation team and found that the evaluation team
provided sufficient evidence and justification to confirm that the evaluation was conducted
in accordance with the requirements of the CEM, and that the conclusion reached by the
evaluation team was justified.
9.4 Evaluation of the Life Cycle Support Activities (ALC)
The evaluation team applied each ALC CEM work unit. The evaluation team found that
the TOE was identified.
The validator reviewed the work of the evaluation team and found that sufficient evidence
and justification was provided by the evaluation team to confirm that the evaluation was
conducted in accordance with the requirements of the CEM, and that the conclusion
reached by the evaluation team was justified.
9.5 Evaluation of the Test Documentation and the Test Activity (ATE)
The evaluation team applied each ATE CEM work unit. The evaluation team ran the set of
tests specified by the assurance activities in the NDcPP22e and recorded the results in a
Test Report, summarized in the AAR.
The validator reviewed the work of the evaluation team and found that sufficient evidence
and justification was provided by the evaluation team to confirm that the evaluation was
conducted in accordance with the requirements of the CEM, and that the conclusion
reached by the evaluation team was justified.
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
11
9.6 Vulnerability Assessment Activity (VAN)
The evaluation team applied each AVA CEM work unit. The vulnerability analysis is in the
Detailed Test Report (DTR) prepared by the evaluator. The vulnerability analysis includes
a public search for vulnerabilities and fuzz testing. None of the public search for
vulnerabilities, or the fuzz testing uncovered any residual vulnerability.
The evaluation team performed a public search of the following sources for vulnerabilities,
in order to ensure there are no publicly known and exploitable vulnerabilities in the TOE.
• National Vulnerability Database (https://web.nvd.nist.gov/vuln/search)
• Vulnerability Notes Database (http://www.kb.cert.org/vuls/)
• Rapid7 Vulnerability Database (https://www.rapid7.com/db/vulnerabilities)
• Tipping Point Zero Day Initiative (http://www.zerodayinitiative.com/advisories )
• Exploit / Vulnerability Search Engine (http://www.exploitsearch.net)
• Tenable Network Security (http://nessus.org/plugins/index.php?view=search)
• Offensive Security Exploit Database (https://www.exploit-db.com/)
The search was performed on 08/12/2024 with the following search terms: "SSH", "TLS",
"Cisco IOS XE", "IOS-XE 17", "Cisco Catalyst", "IE3100", "Marvell Prestera", "Arm
Cortex-A55", "Armv8 Cortex-A55", "IOS Common Cryptographic Module", "IC2M",
"IC2M Rel5a", "CiscoSSL FIPS Object Module", "CiscoSSL FOM 7.2a".
The validator reviewed the work of the evaluation team and found that the evaluation team
provided sufficient evidence and justification to confirm that the evaluation was conducted
in accordance with the requirements of the CEM, and that the conclusion reached by the
evaluation team was justified.
9.7 Summary of Evaluation Results
The evaluation team’s assessment of the evaluation evidence demonstrates that the claims
in the ST are met. Additionally, the evaluation team’s testing also demonstrated the
accuracy of the claims in the ST.
The validation team’s assessment of the evidence provided by the evaluation team is that it
demonstrates that the evaluation team followed the procedures defined in the CEM, and
correctly verified that the product meets the claims in the ST.
10 Validator Comments/Recommendations
All validator comments and recommendations have been adequately addressed in the
Assumptions and Clarification of Scope section of this document.
The TOE uses a proprietary operating system that is supported by the TOE vendor.
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
12
11 Annexes
Not applicable
12 Security Target
The Security Target is identified as: Cisco Catalyst Industrial Ethernet 3100 (IE3100)
Rugged Series Switches running IOS-XE 17.12 Common Criteria Security Target, Version
0.5, 03 September 2024.
13 Glossary
The following definitions are used throughout this document:
• Common Criteria Testing Laboratory (CCTL). An IT security evaluation facility
accredited by the National Voluntary Laboratory Accreditation Program (NVLAP) and
approved by the CCEVS Validation Body to conduct Common Criteria-based
evaluations.
• Conformance. The ability to demonstrate in an unambiguous way that a given
implementation is correct with respect to the formal model.
• Evaluation. The assessment of an IT product against the Common Criteria using the
Common Criteria Evaluation Methodology to determine whether or not the claims
made are justified; or the assessment of a protection profile against the Common
Criteria using the Common Evaluation Methodology to determine if the Profile is
complete, consistent, technically sound and hence suitable for use as a statement of
requirements for one or more TOEs that may be evaluated.
• Evaluation Evidence. Any tangible resource (information) required from the sponsor
or developer by the evaluator to perform one or more evaluation activities.
• Feature. Part of a product that is either included with the product or can be ordered
separately.
• Target of Evaluation (TOE). A group of IT products configured as an IT system, or
an IT product, and associated documentation that is the subject of a security evaluation
under the CC.
• Validation. The process carried out by the CCEVS Validation Body leading to the
issue of a Common Criteria certificate.
• Validation Body. A governmental organization responsible for carrying out validation
and for overseeing the day-to-day operation of the NIAP Common Criteria Evaluation
and Validation Scheme.
Cisco Cisco Catalyst Industrial Ethernet
3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12 Validation Report Version 1.0, 09/12/2024
13
14 Bibliography
The Validation Team used the following documents to produce this Validation Report:
[1] Common Criteria for Information Technology Security Evaluation: Part 1:
Introduction and General Model, Version 3.1, Revision 5, April 2017.
[2] Common Criteria for Information Technology Security Evaluation Part 2: Security
functional components, Version 3.1, Revision 5, April 2017.
[3] Common Criteria for Information Technology Security Evaluation Part 3: Security
assurance components, Version 3.1 Revision 5, April 2017.
[4] Common Evaluation Methodology for Information Technology Security, Version
3.1, Revision 5, April 2017.
[5] collaborative Protection Profile for Network Devices, Version 2.2e, 23 March 2020
(NDcPP22e).
[6] Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches running
IOS-XE 17.12 Common Criteria Security Target, Version 0.5, 03 September 2024
(ST).
[7] Assurance Activity Report for Cisco Catalyst Industrial Ethernet 3100 (IE3100)
Rugged Series Switches running IOS-XE 17.12, Version 0.3, 09/05/2024 (AAR).
[8] Detailed Test Report for Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged
Series Switches running IOS-XE 17.12, Version 0.3, 08/30/2024 (DTR).
[9] Evaluation Technical Report for Cisco Catalyst Industrial Ethernet 3100 (IE3100)
Rugged Series Switches running IOS-XE 17.12, Version 0.3, 09/05/2024 (ETR)