Americas Headquarters:
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
© 2015 Cisco Systems, Inc. All rights reserved.
Cisco Catalyst 6K Series Switches
Security Target
Version 1.0
December 18, 2015
Cisco Catalyst 6K Series Switches Security Target
2
Table of Contents
1 SECURITY TARGET INTRODUCTION .............................................................................8
1.1 ST and TOE Reference .................................................................................................... 8
1.2 TOE Overview ................................................................................................................. 8
1.2.1 TOE Product Type .................................................................................................... 8
1.2.2 Supported non-TOE Hardware/ Software/ Firmware............................................... 9
1.3 TOE DESCRIPTION..................................................................................................... 10
1.4 TOE Evaluated Configuration........................................................................................ 12
2 x SFP+ 10G................................................................................ Error! Bookmark not defined.
1.5 Physical Scope of the TOE............................................................................................. 16
1.6 Logical Scope of the TOE.............................................................................................. 16
1.6.1 Security Audit......................................................................................................... 17
1.6.2 Cryptographic Support............................................................................................ 17
1.6.3 Full Residual Information Protection...................................................................... 19
1.6.4 Identification and authentication............................................................................. 19
1.6.5 Security Management ............................................................................................. 19
1.6.6 Protection of the TSF.............................................................................................. 20
1.6.7 TOE Access ............................................................................................................ 20
1.6.8 Trusted path/Channels ............................................................................................ 20
1.7 Excluded Functionality .................................................................................................. 21
2 Conformance Claims.............................................................................................................22
2.1 Common Criteria Conformance Claim .......................................................................... 22
2.2 Protection Profile Conformance..................................................................................... 22
2.2.1 Protection Profile Additions ................................................................................... 22
2.3 Protection Profile Conformance Claim Rationale.......................................................... 22
2.3.1 TOE Appropriateness.............................................................................................. 22
2.3.2 TOE Security Problem Definition Consistency...................................................... 22
2.3.3 Statement of Security Requirements Consistency.................................................. 23
3 SECURITY PROBLEM DEFINITION................................................................................24
3.1 Assumptions................................................................................................................... 24
3.2 Threats............................................................................................................................ 24
3.3 Organizational Security Policies.................................................................................... 25
4 SECURITY OBJECTIVES...................................................................................................26
4.1 Security Objectives for the TOE .................................................................................... 26
4.2 Security Objectives for the Environment....................................................................... 27
5 SECURITY REQUIREMENTS ...........................................................................................28
5.1 Conventions.................................................................................................................... 28
5.2 TOE Security Functional Requirements ........................................................................ 28
5.2.1 Security audit (FAU)............................................................................................... 30
5.2.2 Cryptographic Support (FCS)................................................................................. 32
5.2.3 User data protection (FDP)..................................................................................... 35
5.2.4 Identification and authentication (FIA) .................................................................. 35
5.2.5 Security management (FMT).................................................................................. 36
5.2.6 Protection of the TSF (FPT) ................................................................................... 37
5.2.7 TOE Access (FTA) ................................................................................................. 37
Cisco Catalyst 6K Series Switches Security Target
3
5.2.1 Trusted Path/Channels (FTP).................................................................................. 38
5.3 TOE SFR Dependencies Rationale for SFRs Found in PP............................................ 39
5.4 Security Assurance Requirements.................................................................................. 39
5.4.1 SAR Requirements.................................................................................................. 39
5.4.2 Security Assurance Requirements Rationale.......................................................... 39
5.5 Assurance Measures....................................................................................................... 40
6 TOE Summary Specification ................................................................................................41
6.1 TOE Security Functional Requirement Measures.......................................................... 41
7 Annex A: Key Zeroization....................................................................................................51
7.1 Key Zeroization.............................................................................................................. 51
8 Annex B: References.............................................................................................................53
Cisco Catalyst 6K Series Switches Security Target
4
List of Tables
TABLE 1 ACRONYMS............................................................................................................................................................................................ 5
TABLE 2 TERMINOLOGY ..................................................................................................................................................................................... 6
TABLE 3 ST AND TOE IDENTIFICATION.......................................................................................................................................................... 8
TABLE 4 IT ENVIRONMENT COMPONENTS...................................................................................................................................................... 9
TABLE 5: CAT 6500 SERIES EVALUATED CONFIGURATIONS.....................................................................................................................12
TABLE 6: CAT 6800 SERIES EVALUATED CONFIGURATIONS.....................................................................................................................14
TABLE 7 6800IA SWITCH FAMILY ......................................................................................................ERROR! BOOKMARK NOT DEFINED.
TABLE 8 CAT 3560CX-12PD-S FEATURES......................................................................................ERROR! BOOKMARK NOT DEFINED.
TABLE 9 FIPS REFERENCES.............................................................................................................................................................................17
TABLE 10 CAT6K PROCESSORS.......................................................................................................................................................................18
TABLE 11 TOE PROVIDED CRYPTOGRAPHY.................................................................................................................................................18
TABLE 12 EXCLUDED FUNCTIONALITY..........................................................................................................................................................21
TABLE 13 PROTECTION PROFILES ..................................................................................................................................................................22
TABLE 14 TOE ASSUMPTIONS ........................................................................................................................................................................24
TABLE 15 THREATS..........................................................................................................................................................................................24
TABLE 16 ORGANIZATIONAL SECURITY POLICIES.......................................................................................................................................25
TABLE 17 SECURITY OBJECTIVES FOR THE TOE..........................................................................................................................................26
TABLE 18 SECURITY OBJECTIVES FOR THE ENVIRONMENT........................................................................................................................27
TABLE 19 SECURITY FUNCTIONAL REQUIREMENTS....................................................................................................................................28
TABLE 20 AUDITABLE EVENTS.......................................................................................................................................................................30
TABLE 21: ASSURANCE MEASURES.................................................................................................................................................................39
TABLE 22 ASSURANCE MEASURES..................................................................................................................................................................40
TABLE 23 HOW TOE SFRS MEASURES.........................................................................................................................................................41
TABLE 24: TOE KEY ZEROIZATION................................................................................................................................................................51
TABLE 25: REFERENCES ...................................................................................................................................................................................53
List of Figures
FIGURE 1 TOE EXAMPLE DEPLOYMENT .......................................................................................................................................................10
FIGURE 2 CISCO CATALYST 6500 SERIES SWITCHES ..................................................................................................................................12
FIGURE 3 CISCO CATALYST 6800 SERIES SWITCHES - CISCO CATALYST 6880-X SERIES CHASSIS WITH 4 PORT CARDS.............13
FIGURE 4 CISCO CATALYST 6800 SERIES SWITCHES - 6807-XL CHASSIS .............................................................................................14
FIGURE 5 CISCO CATALYST 6800IA SERIES SWITCHES (IA-CLIENT) ..........................................ERROR! BOOKMARK NOT DEFINED.
FIGURE 6 CISCO CATALYST 3560CX-12PD-S (IA-CLIENT) ........................................................ERROR! BOOKMARK NOT DEFINED.
FIGURE 7 CISCO CATALYST INSTANT ACCESS................................................................................................................................................15
Cisco Catalyst 6K Series Switches Security Target
5
Acronyms
The following acronyms and abbreviations are common and may be used in this Security Target:
Table 1 Acronyms
Acronyms /
Abbreviations
Definition
AAA Administration, Authorization, and Accounting
ACL Access Control Lists
AES Advanced Encryption Standard
BRI Basic Rate Interface
CC Common Criteria for Information Technology Security Evaluation
CEM Common Evaluation Methodology for Information Technology Security
CM Configuration Management
CSU Channel Service Unit
DHCP Dynamic Host Configuration Protocol
DSU Data Service Unit
EAL Evaluation Assurance Level
EHWIC Ethernet High-Speed WIC
ESP Encapsulating Security Payload
GE Gigabit Ethernet port
HTTP Hyper-Text Transport Protocol
HTTPS Hyper-Text Transport Protocol Secure
ICMP Internet Control Message Protocol
ISDN Integrated Services Digital Network
ISR Integrated Service Router
IT Information Technology
NDPP Network Device Protection Profile
OS Operating System
PBKDF2 Password-Based Key Derivation Function version 2
PoE Power over Ethernet
POP3 Post Office Protocol
PP Protection Profile
SA Security Association
SFP Small–form-factor pluggable port
SHS Secure Hash Standard
SIP Session Initiation Protocol
SSHv2 Secure Shell (version 2)
ST Security Target
TCP Transport Control Protocol
TOE Target of Evaluation
TSC TSF Scope of Control
TSF TOE Security Function
TSP TOE Security Policy
UDP User datagram protocol
WAN Wide Area Network
WIC WAN Interface Card
Cisco Catalyst 6K Series Switches Security Target
6
Terminology
Table 2 Terminology
Term Definition
Authorized
Administrator
Any user which has been assigned to a privilege level that is permitted to perform all TSF-
related functions.
Peer router/switch Another router/switch on the network that the TOE interfaces with.
Privilege level Assigns a user specific management access to the TOE to run specific commands. The
privilege levels are from 1-15 with 15 having full administrator access to the TOE similar
to root access in UNIX or Administrator access on Windows. Privilege level 1 has the
most limited access to the CLI. By default when a user logs in to the Cisco IOS, they will
be in user EXEC mode (level 1). From this mode, the administrator has access to some
information about the TOE, such as the status of interfaces, and the administrator can view
routes in the routing table. However, the administrator can't make any changes or view the
running configuration file. The privilege levels are customizable so that an Authorized
Administrator can also assign certain commands to certain privilege levels.
Remote VPN
Gateway/Peer
A remote VPN Gateway/Peer is another network device that the TOE sets up a VPN
connection with. This could be a VPN client or another switch/router.
Role An assigned role gives a user varying access to the management of the TOE. For the
purposes of this evaluation the privilege level of a user is synonymous with the assigned
privilege level.
Security
Administrator
Synonymous with Authorized Administrator for the purposes of this evaluation.
User Any entity (human user or external IT entity) outside the TOE that interacts with the TOE.
Vty vty is a term used by Cisco to describe a single terminal (whereas Terminal is more of a
verb or general action term).
Cisco Catalyst 6K Series Switches Security Target
7
DOCUMENT INTRODUCTION
Prepared By:
Cisco Systems, Inc.
170 West Tasman Dr.
San Jose, CA 95134
This document provides the basis for an evaluation of a specific Target of Evaluation (TOE), the
Cisco Catalyst 6K Series Switches (CAT 6K) running IOS 15.2(1)SY1a. This Security Target
(ST) defines a set of assumptions about the aspects of the environment, a list of threats that the
product intends to counter, a set of security objectives, a set of security requirements, and the IT
security functions provided by the TOE which meet the set of requirements. Administrators of
the TOE will be referred to as administrators, Authorized Administrators, TOE administrators,
semi-privileged, privileged administrators, and security administrators in this document.
Cisco Catalyst 6K Series Switches Security Target
8
1 SECURITY TARGET INTRODUCTION
The Security Target contains the following sections:
 Security Target Introduction [Section 1]
 Conformance Claims [Section 2]
 Security Problem Definition [Section 3]
 Security Objectives [Section 4]
 IT Security Requirements [Section 5]
 TOE Summary Specification [Section 6]
The structure and content of this ST comply with the requirements specified in the Common
Criteria (CC), Part 1, Annex A, and Part 2.
1.1 ST and TOE Reference
This section provides information needed to identify and control this ST and its TOE.
Table 3 ST and TOE Identification
Name Description
ST Title Cisco Catalyst 6K Series Switches Security Target
ST Version 1.0
Publication Date December 18, 2015
Vendor and ST
Author
Cisco Systems, Inc.
TOE Reference Cisco Catalyst 6K Series Switches
TOE Hardware
Models
6503-E, 6504-E, 6506-E, 6509-E, 6509-V-E and 6513-E with Supervisor Engine 2T
(Excluding Sup720), C6880, 6807-X in stand-alone and Cisco Catalyst Instant Access modes.
TOE Software
Version
IOS 15.2(1)SY1a
Keywords Audit, Authentication, Encryption, Information Flow, Protection, Switch, Traffic
1.2 TOE Overview
The Cisco Catalyst 6K Series Switches purpose-built, switching and routing platform with OSI
Layer2 and Layer3 traffic filtering capabilities. The TOE includes the hardware models as
defined in Table 3 in section 1.1.
1.2.1 TOE Product Type
The TOE is a switching and routing platform used to construct IP networks by interconnecting
multiple smaller networks or network segments. As a Layer2 switch, it performs analysis of
incoming frames, makes forwarding decisions based on information contained in the frames, and
forwards the frames toward the destination. As a Layer3 switch/router, it supports routing of
traffic based on tables identifying available routes, conditions, distance, and costs to determine
the best route for a given packet. Routing protocols used by the TOE include BGPv4, EIGRP,
EIGRPv6 for IPv6, RIPv2, and OSPFv2. BGPv4, EIGRP, and EIGRPv6 supports routing
Cisco Catalyst 6K Series Switches Security Target
9
updates with IPv6 or IPv4, while RIPv2 and OSPFv2 routing protocol support routing updates
for IPv4 only.
1.2.2 Supported non-TOE Hardware/ Software/ Firmware
The TOE supports the following hardware, software, and firmware components in its operational
environment. Each component is identified as being required or not based on the claims made in
this Security Target. All of the following environment components are supported by all TOE
evaluated configuration:
Table 4 IT Environment Components
Component Required Usage/Purpose Description for TOE performance
Instant Access (IA) Client
 Cisco Cat 6800IA-
48FPD
 Cisco Cat 6800IA-
FPDR
 Cisco Cat 6800IA-TD
 Cisco Cat 3560CX-
12PD-S
 Cisco Cat 3560CX-
8XPD-S
Yes When the TOE is in the Instant Access (IA) mode, it functions as the
Instant Access (IA) Parent and connects with the Instant Access
Client for successful operation in the Instant Access Solution. The
details of the Instant Access mode are described in Section 1.4
RADIUS/TACAS+ AAA
Server
No This includes any IT environment RADIUS/TACACS+ AAA server
that provides single-use authentication mechanisms. This can be any
RADIUS or TACACS+ AAA server that provides single-use
authentication. The TOE correctly leverages the services provided by
this AAA server to provide single-use authentication to
administrators.
Management Workstation
with SSH Client
Yes This includes any IT Environment Management workstation with a
SSH client installed that is used by the TOE administrator to support
TOE administration through SSH protected channels. Any SSH
client that supports SSHv2 may be used.
Local Console Yes This includes any IT Environment Console that is directly connected
to the TOE via the Serial Console Port and is used by the TOE
administrator to support TOE administration.
NTP Server No The TOE supports communications with an NTP server.
Syslog Server Yes This includes any syslog server to which the TOE would transmit
syslog messages.
Cisco Catalyst 6K Series Switches Security Target
10
1.3 TOE DESCRIPTION
This section provides an overview of the Cisco Catalyst (Cat) 6K Series Switches Target of
Evaluation (TOE). The TOE is comprised of both software and hardware. The hardware is
comprised of the following models: Cisco Cat 6503-E, Cisco Cat 6504-E, Cisco Cat 6506-E,
Cisco Cat 6509-E, Cisco Cat 6509-V-E and Cisco Cat 6513-E with Supervisor Engine 2T
(Excluding Sup720), Cisco Cat 6880, Cisco Cat 6807-X in Stand-Alone and Instant Access
modes. The software is comprised of the Universal Cisco Internet Operating System (IOS)
software image Release 15.2(1)SY1a.
Cisco IOS is a Cisco-developed highly configurable proprietary operating system that provides
for efficient and effective routing and switching. Although IOS performs many networking
functions, this TOE only addresses the functions that provide for the security of the TOE itself as
described in Logical Scope of the TOE below.
The following figure provides a visual depiction of an example TOE deployment. The TOE
boundary is surrounded with a hashed red line.
Figure 1 TOE Example Deployment
Cisco Catalyst 6K Series Switches Security Target
11
The previous figure includes the following:
 Identifies the TOE Models
o Cisco Cat 6503-E
o Cisco Cat 6504-E
o Cisco Cat 6506-E
o Cisco Cat 6509-E
o Cisco Cat 6509-V-E
o Cisco Cat 6513-E
o Cisco Cat 6880
o Cisco Cat 6807-X
 The following are considered to be in the IT Environment:
o Cisco Cat Instant Access Client switches
 Cisco Catalyst 6800ia Series Switches
Management
Workstation
Network 1
Network 2
VPN Peer
Syslog
Server
AAA Server
Network 3
VPN Peer
TOE
6503-E, 6504-E, 6506-E, 6509-E,
6509-V-E and 6513-E with
Supervisor Engine 2T
(Excluding Sup720), C6880 and
6807-X in Stand-Alone and
Instant Access modes
IPsec connection
SSH connection
NTP Server
Cisco Catalyst 6K Series Switches Security Target
12
 Cisco Cat 6800IA-48FPD
 Cisco Cat 6800IA-FPDR
 Cisco Cat 6800IA-TD
 Cisco Catalyst 3560CX-12PD-S
 Cisco Catalyst 3560CX-8XPD-S
o (2) VPN Peers
o Management Workstation
o Authentication Server
o NTP Server
o Syslog Server
1.4 TOE Evaluated Configuration
The TOE consists of the following configurations –
1. Any one of a number of hardware configurations for the 6500 Series (6503-E, 6504-E,
6506-E, 6509-E, 6509-V-E and 6513-E) and the 6800 Series (6880-X and 6807-XL)
switch, each running the same version IOS software. The switch chassis provides power,
cooling, and backplane for the Network Module, Supervisor Engine, line cards, and
service modules. The evaluated configurations consist of the following:
Figure 2 Cisco Catalyst 6500 Series Switches
Table 5: Cat 6500 Series Evaluated Configurations
Cat 6500 Series
TOE
 One or more chassis: WS-C6503-E, WS-C6504-E, WS-C6506-E, WS-C6509-E, WS-
C6509-V-E, WS-C6513-E
 Dimensions: 7 x 17.37 x 21.75/ 8.75 x 17.5 x 21.75/ 19.2 x 17.5 x 18/ 24.5 x
17.5 x 18.2/ 36.65 x 17.2 x 20.7/ 32.7 x 17.3 x 18.1 respectively
 Weight (Chassis only): 33/40/50/60/121/102 respectively
 Rack Units (RU): 4, 5, 11, 14, 21, 19 respectively
 One or two Supervisor 2T (Sup 2T) Cards (VS-S2T-10G or VS-S2T-10G-XL) per chassis
Cisco Catalyst 6K Series Switches Security Target
13
 One or more Line Cards (note, line cards are not TSF enforcing): WS-X6908-10G-2T,
WS-X6908-10G-2TXL, WS-X6824-SFP-2T, WS-X6824-SFP-2TXL, WS-X6848-SFP-
2T, WS-X6848-SFP-2TXL, WS-X6848-TX-2T, WS-X6848-TX-2TXL, WS-X6816-10T-
2T, WS-X6816-10T-2TXL, WS-X6816-10G-2T, WS-X6816-10G-2TXL, WS-X6904-
40G-2T, WS-X6904-40G-2TXL, WS-X6704-10GE with CFC, WS-X6724-SFP with
CFC, WS-X6748-SFP with CFC, WS-X6748-GE-TX with CFC, WS-X6148A-RJ-45,
WS-X6148A-45AF, WS-X6148-FE-SFP, WS-X6148A-GE-TX, WS-X6148A-GE-45AF,
WS-X6148E-GE-45AT, WS-X6704-10GE, WS-X6724-SFP, WS-X6748-SFP, WS-
X6748-GE-TX, WS-X6716-10G-3C, WS-X6716-10G-3CXL, WS-X6716-10T-3C, WS-
X6716-10T-3CXL, C6800-48P-SFP, C6800-48P-SFP-XL, C6800-48P-TX and C6800-
48P-TX-XL
 Running IOS 15.2(1)SY1a
 Typical applications for the chassis include:
 3-and 4-Slot Chassis: Low-density, wiring-closet chassis sharing interface
modules and supervisor engines with larger chassis for common sparing; low-
density, high-performance specialized services module chassis for network
security and management; and low-density, high-end chassis providing
connectivity to the WAN edge
 6- and 9-Slot Chassis: Traditional chassis for the wiring closet, distribution and
core layers, data center, and WAN edge. The Cisco Catalyst 6506-E and Catalyst
6509-E support more than 4000 watts (W) power and higher per slot.
 13-Slot Chassis: Highest-capacity chassis for Ethernet connectivity, with slots to
spare for services modules, providing network security and management.
 Chassis Configuration -
 Slots: 3, 4, 6, 9, 9 vertical and 13 respectively
 Max 10/100/1000 ports: 97, 145, 241, 385, 385 and 529 respectively
 Max 1 GE ports: 99, 147, 243, 387, 387 and 534 respectively
 Max 10GE ports: 34, 50, 82, 130, 130 and 180 respectively
 Max 40 GE ports: 8, 12, 20, 32, 32 and 44 respectively
 Redundant Supervisor Engines (stateful failover)
 All Cisco Catalyst 6500-E Series chassis use common power supplies. The 6- and 9-slot
chassis require a 1000W or 1300W power supply and the 13-slot chassis requires a
2500W or 4000W power supply. The 3-slot chassis requires a 950W power supply.
 Power -
 All Cisco Catalyst 6500-E Series chassis holds up to two load-sharing, fault-
tolerant, hot-swappable AC or DC power supplies. Only one supply is required
to operate a fully loaded chassis. If a second supply is installed, it operates in a
load-sharing capacity. The power supplies are hot-swappable-a failed power
supply can be removed without powering off the system.
 Ethernet management port: RJ-45 connectors, 4-pair Cat-5 UTP cabling
 Management console port: RJ-45-to-DB9 cable for PC connections
Figure 3 Cisco Catalyst 6800 Series Switches - Cisco Catalyst 6880-X Series Chassis with 4 Port Cards
Cisco Catalyst 6K Series Switches Security Target
14
Figure 4 Cisco Catalyst 6800 Series Switches - 6807-XL Chassis
Table 6: Cat 6800 Series Evaluated Configurations
Cat 6800 Series
TOE
Cisco Catalyst 6880-X:
 Dimensions (inches): 8.75 x 17.35 x 23
 Weight (Chassis only): 64
 Rack Units (RU): 4.85
 One of two Supervisor Cards per chassis - C6880-X, C6880-X-LE
 Line Cards (note, line cards are not TSF enforcing): C6880-X-16P10G / C6880-X-LE-
16P10G respectively
 Running IOS 15.2(1)SY1a
 The 40G/100G ready platform’s application is for providing 10G services in small or
midsize campus backbones
 Chassis Configuration -
 16 10G/1G ports
 Each port card supports 16 additional 10G/1G ports.
 Maximum port density per chassis –
o Upto 80 X 10 Gigabit Ethernet ports
o Upto 80 X 1 Gigabit Ethernet ports
o Upto 20 X 40 Gigabit Ethernet ports
 Port card slots - 4
 Power –
1. Power supply compatibility - AC: 3000W, DC: 3000W
2. Input Voltage – 100 to 240 VAC, -48 to -60 VDC
Cisco Catalyst 6807-XL:
 Dimensions (inches): 17.45 x 17.37 x 18.1
 Weight (Chassis only): 62
 Rack Units (RU): 10
 One or two Supervisor 2T (Sup 2T) Cards (VS-S2T-10G or VS-S2T-10G-XL) per chassis
 One or more Line Cards (note, line cards are not TSF enforcing): WS-X6904-40G-2T,
Cisco Catalyst 6K Series Switches Security Target
15
WS-X6904-40G-2TXL, WS-X6908-10G-2T, WS-X6908-10G-2TXL, WS-X6816-10G-
2T, WS-X6816-10G-2TXL, WS-X6816-10T-2T, WS-X6816-10T-2TXL, WS-X6848-
SFP-2T, WS-X6848-SFP-2TXL, WS-X6824-SFP-2T, WS-X6824-SFP-2TXL, WS-
X6848-TX-2T, WS-X6848-TX-2TXL, C6800-48P-SFP, C6800-48P-SFP-XL, C6800-
48P-TX and C6800-48P-TX-XL
 Running IOS 15.2(1)SY1a
 Provides 1+1 supervisor engine redundancy, redundant fans, and N+1 power supply
redundancy, thereby limiting network downtime.
 Main application in enterprise core and aggregation environments and offers Gigabit
Ethernet, 10 Gigabit Ethernet, and 40 Gigabit Ethernet port densities while also ready to
support 100 Gigabit Ethernet
 Chassis Configuration -
 Number of slots – 7
 880 Gbps per slot capability
 Number of module slots – 5
 Power –
3. Power supply compatibility - AC: 3000W (upto 4 power supplies)
4. Input Voltage – 100 to 240 VAC, -48 to -60 VDC
2. Instant Access (IA) solution that provides a single point of operation and management for
campus access and backbone. The solution is composed of Cisco Catalyst 6500 or
Catalyst 6800 Series backbone switches (Instant Access Parent – IA Parent) and Cisco
Catalyst 6800ia Series Switches (Cisco Cat 6800IA-48FPD, Cisco Cat 6800IA-FPDR
and Cisco Cat 6800IA-TD), Cisco Cat 3560CX-12PD-S or Cisco Cat 3560CX-8XPD-S
(Instant Access Client – IA Client). The IA clients (which are in the IT Environment and
are external to the TOE) are physically connected by uplinks to the Cisco Catalyst 6500
or 6800. The entire configuration works as a single extended switch with a single
management domain. Once the TOE enters the Instant Access mode, there is no TSF data
being transmitted to or from the IA-client. There is also no console access available on
the IA-client and the administration of the TOE is through the IA-Parent. The IA-clients
are outside the TOE boundary and are not considered to be a part of the TOE. The main
features of the Instant Access (IA) solution are as follows –
 Single point of management and configuration.
 Standard Cisco Catalyst feature support: Standard features such as Power over
Ethernet Plus (PoE+), stacking, enabling a switch on the front panel of an access
switch are all supported.
 Single switch configuration: With Cisco Catalyst Instant Access, all access switches
are configured and managed at the distribution switch.
 Single consistent security policy: Instant Access provides a single consistent security
policy across the Instant Access system because the security policies are applied on
the single extended switch.
 Single software image management: With Instant Access, only the extended switch
needs software image installation and upgrades.
Figure 5 Cisco Catalyst Instant Access
Cisco Catalyst 6K Series Switches Security Target
16
The Cisco Cat 3560CX-12PD-S or Cisco Cat 3560CX-8XPD-S can replace the C6800IA client
in the configuration depicted in the figure above. The list of line cards that are supported on the
IA Parent switch in the IA Parent-Child connection is restricted to – WS-X6904-40G, C6800-
32P10G-XL, C6800-16P10G-XL and C6800-8P10G-XL.
1.5 Physical Scope of the TOE
The TOE is a hardware and software solution that makes up the router models as discussed in
Section 1.3. The network, on which they reside, is considered part of the environment. The TOE
guidance documentation that is considered to be part of the TOE can be found listed in the Cisco
Catalyst 6K Series Common Criteria Operational User Guidance and Preparative Procedures
document and are downloadable from the http://cisco.com web site.
1.6 Logical Scope of the TOE
The TOE is comprised of several security features. Each of the security features identified above
consists of several security functionalities, as identified below.
1. Security Audit
2. Cryptographic Support
3. Full Residual Information Protection
4. Identification and Authentication
5. Security Management
6. Protection of the TSF
7. TOE Access
8. Trusted Path/Channels
Cisco Catalyst 6K Series Switches Security Target
17
These features are described in more detail in the subsections below. In addition, the TOE
implements all RFCs of the NDPP v1.1 and NDPP Errata # 3 as necessary to satisfy
testing/assurance measures prescribed therein.
1.6.1 Security Audit
The Cisco Catalyst 6K provides extensive auditing capabilities. The TOE generates a
comprehensive set of audit logs that identify specific TOE operations. For each event, the TOE
records the date and time of each event, the type of event, the subject identity, and the outcome
of the event. Auditable events include: failure on invoking cryptographic functionality such as
establishment, termination and failure of an IPsec SA; establishment, termination and failure of
an SSH session; modifications to the group of users that are part of the authorized administrator
roles; all use of the user identification mechanism; any use of the authentication mechanism; any
change in the configuration of the TOE, changes to time, initiation of TOE update, indication of
completion of TSF self-test, maximum sessions being exceeded, termination of a remote session
and attempts to unlock a termination session; and initiation and termination of a trusted channel.
The TOE is configured to transmit its audit messages to an external syslog server.
Communication with the syslog server is protected using IPsec and the TOE can determine when
communication with the syslog server fails. If that should occur, the TOE can be configured to
block new permit actions.
The logs can be viewed on the TOE using the appropriate IOS commands. The records include
the date/time the event occurred, the event/type of event, the user associated with the event, and
additional information of the event and its success and/or failure. The TOE does not have an
interface to modify audit records, though there is an interface available for the authorized
administrator to clear audit data stored locally on the TOE.
1.6.2 Cryptographic Support
The TOE provides cryptography in support of other Cisco Cat 6K security functionality. The
crypto library used to implement the algorithms is IC2M Rel3 v1.5.5. All the algorithms claimed
have CAVP certificates (see Table 7 for certificate references).
Table 7 FIPS References
Algorithm CAVP Cert. #
AES 3755
SHS (SHA-1, 256, 384, 512) 3125
HMAC 2457
DRBG 1030
RSA 1931
Cisco Catalyst 6K Series Switches Security Target
18
The Cat6K Series platforms contain the following processors –
Table 8 Cat6K Processors
Chassis CPU Designation
6503E Freescale MPC8572 - Based on Freescale e500
6504E Freescale MPC8572 - Based on Freescale e500
6506E Freescale MPC8572 - Based on Freescale e500
6509E Freescale MPC8572 - Based on Freescale e500
6509-V-E Freescale MPC8572 - Based on Freescale e500
6513-E Freescale MPC8572 - Based on Freescale e500
C6880 Intel Gladden – Intel Core i3-2115C - AV8062701064700
6807-X Freescale MPC8572 - Based on Freescale e500
The cryptographic services provided by the TOE are described in Table 9 below.
Table 9 TOE Provided Cryptography
Cryptographic Method Use within the TOE
Internet Key Exchange Used to establish initial IPsec session.
Secure Shell Establishment Used to establish initial SSH session.
RSA/DSA Signature Services Used in IPsec session establishment.
Used in SSH session establishment.
SP 800-90 RBG Used in IPsec session establishment.
Used in SSH session establishment.
SHS Used to provide IPsec traffic integrity verification
Used to provide SSH traffic integrity verification
Cisco Catalyst 6K Series Switches Security Target
19
Cryptographic Method Use within the TOE
AES Used to encrypt IPsec session traffic.
Used to encrypt SSH session traffic.
1.6.3 Full Residual Information Protection
The TOE ensures that all information flows from the TOE do not contain residual information
from previous traffic. New packets that do not contain sufficient information to fill the minimum
size of the data portion of the packet use zeroes for padding the remainder of the packet so that
residual data from previous traffic is never transmitted from the TOE.
1.6.4 Identification and authentication
The TOE performs two types of authentication: device-level authentication of the remote device
(VPN peers) and user authentication for the Authorized Administrator of the TOE. Device-level
authentication allows the TOE to establish a secure channel with a trusted peer. The secure
channel is established only after each device authenticates the other. Device-level authentication
is performed via IKE/IPsec mutual authentication. The IKE phase authentication for the IPsec
communication channel between the TOE and authentication server and between the TOE and
syslog server is considered part of the Identification and Authentication security functionality of
the TOE.
The TOE provides authentication services for administrative users to connect to the TOEs secure
CLI administrator interface. The TOE requires Authorized Administrators to authenticate prior
to being granted access to any of the management functionality. The TOE can be configured to
require a minimum password length of 15 characters as well as mandatory password complexity
rules. The TOE provides administrator authentication against a local user database. Password-
based authentication can be performed on the serial console or SSH interfaces. The SSHv2
interface also supports authentication using SSH keys. The TOE supports use of a
RADIUS/TACACS+ AAA server (part of the IT Environment) for authentication of
administrative users attempting to connect to the TOE’s CLI.
1.6.5 Security Management
The TOE provides secure administrative services for management of general TOE configuration
and the security functionality provided by the TOE. All TOE administration occurs either
through a secure SSHv2 session or via a local console connection. The TOE provides the ability
to securely manage:
 All TOE administrative users;
 All identification and authentication;
 All audit functionality of the TOE;
 All TOE cryptographic functionality;
Cisco Catalyst 6K Series Switches Security Target
20
 The timestamps maintained by the TOE;
 Update to the TOE; and
 TOE configuration file storage and retrieval.
The TOE supports two separate administrator roles: non-privileged administrator and privileged
administrator. Only the privileged administrator can perform the above security relevant
management functions.
Administrators can create configurable login banners to be displayed at time of login, and can
also define an inactivity timeout for each admin interface to terminate sessions after a set period
of inactivity.
1.6.6 Protection of the TSF
The TOE protects against interference and tampering by untrusted subjects by implementing
identification, authentication, and access controls to limit configuration to Authorized
Administrators. The TOE prevents reading of cryptographic keys and passwords.
Additionally Cisco IOS is not a general-purpose operating system and access to Cisco IOS
memory space is restricted to only Cisco IOS functions.
The TOE internally maintains the date and time. This date and time is used as the timestamp that
is applied to audit records generated by the TOE. Administrators can update the TOE’s clock
manually, or can configure the TOE to use NTP to synchronize the TOE’s clock with an external
time source. Finally, the TOE performs testing to verify correct operation of the router itself and
that of the cryptographic module.
The TOE is able to verify any software updates prior to the software updates being installed on
the TOE to avoid the installation of malicious software.
1.6.7 TOE Access
The TOE can terminate inactive sessions after an Authorized Administrator configurable time-
period. Once a session has been terminated the TOE requires the user to re-authenticate to
establish a new session.
The TOE can also display an Authorized Administrator specified banner on the CLI management
interface prior to allowing any administrative access to the TOE.
1.6.8 Trusted path/Channels
The TOE allows trusted paths to be established to itself from remote administrators over SSHv2,
and initiates outbound IPsec tunnels to transmit audit messages to remote syslog servers. In
addition, IPsec is used to secure the session between the TOE and the remote authentication
servers. The TOE can also establish trusted paths of peer-to-peer IPsec sessions. The peer-to-
peer IPsec sessions can be used for securing the communications between the TOE and
authentication server/syslog server.
Cisco Catalyst 6K Series Switches Security Target
21
1.7 Excluded Functionality
The following functionality is excluded from the evaluation.
Table 10 Excluded Functionality
Excluded Functionality Exclusion Rationale
Non-FIPS 140-2 mode of operation This mode of operation includes non-FIPS allowed
operations.
SNMP SNMP does not enforce the required privilege
levels. This feature is disabled by default and
cannot be configured for use in the evaluated
configuration. Including this feature would not
meet the security policies as defined in the Security
Target. The exclusion of this feature has no effect
on the operation of the TOE.
Telnet Telnet sends authentication data in the clear. This
feature is enabled by default and must be disabled in
the evaluated configuration. Including this feature
would not meet the security policies as defined in
the Security Target. The exclusion of this feature
has no effect on the operation of the TOE. Refer to
the Guidance documentation for configuration
syntax and information
HTP and HTTPS protocol and
servers
HTTP and HTTPS protocol and servers were not
evaluated and must be disabled
These services will be disabled by configuration. The exclusion of this functionality does not
affect compliance to the U.S. Government Protection Profile for Security Requirements for
Network Devices Version 1.1, with Errata #3.
Cisco Catalyst 6K Series Switches Security Target
22
2 CONFORMANCE CLAIMS
2.1 Common Criteria Conformance Claim
The TOE and ST are compliant with the Common Criteria (CC) Version 3.1, Revision 4, dated:
September 2012. For a listing of Assurance Requirements claimed see section 5.4.
The TOE and ST are CC Part 2 extended and CC Part 3 conformant.
2.2 Protection Profile Conformance
The TOE and ST are conformant with the Protection Profiles as listed in Table 11 below:
Table 11 Protection Profiles
Protection Profile Version Date
U.S. Government Protection Profile for Security Requirements for Network
Devices (NDPP)
1.1 June 8, 2012
Security Requirements for Network Devices – Errata #3 n/a 3 November 2014
2.2.1 Protection Profile Additions
The ST claims exact conformance to the NDPP v1.1, with Errata#3 and does not include any
additions to the functionality described in the Protection Profile.
2.3 Protection Profile Conformance Claim Rationale
2.3.1 TOE Appropriateness
The TOE provides all of the functionality at a level of security commensurate with that identified
in the U.S. Government Protection Profile:
 U.S. Government Protection Profile for Security Requirements for Network Devices,
Version 1.1
 Security Requirements for Network Devices – Errata #3
2.3.2 TOE Security Problem Definition Consistency
The Assumptions, Threats, and Organization Security Policies included in the Security Target
represent the Assumptions, Threats, and Organization Security Policies specified in the U.S.
Government Protection Profile for Security Requirements for Network Devices Version 1.1 for
which conformance is claimed verbatim. All concepts covered in the Protection Profile Security
Problem Definition are included in the Security Target Statement of Security Objectives
Consistency.
Cisco Catalyst 6K Series Switches Security Target
23
The Security Objectives included in the Security Target represent the Security Objectives
specified in the NDPPv1.1 for which conformance is claimed verbatim. All concepts covered in
the Protection Profile’s Statement of Security Objectives are included in the Security Target.
2.3.3 Statement of Security Requirements Consistency
The Security Functional Requirements included in the Security Target represent the Security
Functional Requirements specified in the NDPPv1.1 for which conformance is claimed verbatim.
All concepts covered in the Protection Profile’s Statement of Security Requirements are included
in this Security Target. Additionally, the Security Assurance Requirements included in this
Security Target are identical to the Security Assurance Requirements included in section 4.3 of
the NDPPv1.1.
Cisco Catalyst 6K Series Switches Security Target
24
3 SECURITY PROBLEM DEFINITION
This chapter identifies the following:
 Significant assumptions about the TOE’s operational environment.
 IT related threats to the organization countered by the TOE.
 Environmental threats requiring controls to provide sufficient protection.
 Organizational security policies for the TOE as appropriate.
This document identifies assumptions as A.assumption with “assumption” specifying a unique
name. Threats are identified as T.threat with “threat” specifying a unique name. Organizational
Security Policies (OSPs) are identified as P.osp with “osp” specifying a unique name.
3.1 Assumptions
The specific conditions listed in the following subsections are assumed to exist in the TOE’s
environment. These assumptions include both practical realities in the development of the TOE
security requirements and the essential environmental conditions on the use of the TOE.
Table 12 TOE Assumptions
Assumption Assumption Definition
A.NO_GENERAL_PURPOSE It is assumed that there are no general-purpose computing capabilities (e.g.,
compilers or user applications) available on the TOE, other than those services
necessary for the operation, administration and support of the TOE.
A.PHYSICAL Physical security, commensurate with the value of the TOE and the data it
contains, is assumed to be provided by the environment.
A.TRUSTED_ADMIN TOE Administrators are trusted to follow and apply all administrator guidance
in a trusted manner.
3.2 Threats
The following table lists the threats addressed by the TOE and the IT Environment. The
assumed level of expertise of the attacker for all the threats identified below is Enhanced-Basic.
Table 13 Threats
Threat Threat Definition
T.ADMIN_ERROR An administrator may unintentionally install or configure the TOE
incorrectly, resulting in ineffective security mechanisms.
T.TSF_FAILURE Security mechanisms of the TOE may fail, leading to a compromise of
the TSF.
T.UNDETECTED_ACTIONS Malicious remote users or external IT entities may take actions that
adversely affect the security of the TOE. These actions may remain
undetected and thus their effects cannot be effectively mitigated.
T.UNAUTHORIZED_ACCESS A user may gain unauthorized access to the TOE data and TOE
executable code. A malicious user, process, or external IT entity may
masquerade as an authorized entity in order to gain unauthorized access
to data or TOE resources. A malicious user, process, or external IT
entity may misrepresent itself as the TOE to obtain identification and
authentication data.
Cisco Catalyst 6K Series Switches Security Target
25
Threat Threat Definition
T.UNAUTHORIZED_UPDATE A malicious party attempts to supply the end user with an update to the
product that may compromise the security features of the TOE.
T.USER_DATA_REUSE User data may be inadvertently sent to a destination not intended by the
original sender.
3.3 Organizational Security Policies
The following table lists the Organizational Security Policies imposed by an organization to address its security
needs.
Table 14 Organizational Security Policies
Policy Name Policy Definition
P.ACCESS_BANNER The TOE shall display an initial banner describing restrictions of use, legal agreements, or
any other appropriate information to which users consent by accessing the TOE.
Cisco Catalyst 6K Series Switches Security Target
26
4 SECURITY OBJECTIVES
This Chapter identifies the security objectives of the TOE and the IT Environment. The security
objectives identify the responsibilities of the TOE and the TOE’s IT environment in meeting the
security needs.
 This document identifies objectives of the TOE as O.objective with objective specifying
a unique name. Objectives that apply to the IT environment are designated as
OE.objective with objective specifying a unique name.
4.1 Security Objectives for the TOE
The following table, Security Objectives for the TOE, identifies the security objectives of the
TOE. These security objectives reflect the stated intent to counter identified threats and/or
comply with any security policies identified. An explanation of the relationship between the
objectives and the threats/policies is provided in the rationale section of this document.
Table 15 Security Objectives for the TOE
TOE Objective TOE Security Objective Definition
O.PROTECTED_COMMUNICATIONS The TOE will provide protected communication channels
for administrators, other parts of a distributed TOE, and
authorized IT entities.
O.VERIFIABLE_UPDATES The TOE will provide the capability to help ensure that any
updates to the TOE can be verified by the administrator to
be unaltered and (optionally) from a trusted source.
O.SYSTEM_MONITORING The TOE will provide the capability to generate audit data
and send those data to an external IT entity.
O.DISPLAY_BANNER The TOE will display an advisory warning regarding use of
the TOE.
O.TOE_ADMINISTRATION The TOE will provide mechanisms to ensure that only
administrators are able to log in and configure the TOE,
and provide protections for logged-in administrators.
O.RESIDUAL_INFORMATION_CLEARING The TOE will ensure that any data contained in a protected
resource is not available when the resource is reallocated.
O.SESSION_LOCK The TOE shall provide mechanisms that mitigate the risk of
unattended sessions being hijacked.
O.TSF_SELF_TEST The TOE will provide the capability to test some subset of
its security functionality to ensure it is operating properly.
Cisco Catalyst 6K Series Switches Security Target
27
4.2 Security Objectives for the Environment
All of the assumptions stated in section 3.1 are considered to be security objectives for the
environment. The following are the Protection Profile non-IT security objectives, which, in
addition to those assumptions, are to be satisfied without imposing technical requirements on the
TOE. That is, they will not require the implementation of functions in the TOE hardware and/or
software. Thus, they will be satisfied largely through application of procedural or administrative
measures.
Table 16 Security Objectives for the Environment
Environment Security
Objective
IT Environment Security Objective Definition
OE.NO_GENERAL_PURPOSE There are no general-purpose computing capabilities (e.g., compilers or user
applications) available on the TOE, other than those services necessary for the
operation, administration and support of the TOE.
OE.PHYSICAL Physical security, commensurate with the value of the TOE and the data it
contains, is provided by the environment.
OE.TRUSTED_ADMIN TOE Administrators are trusted to follow and apply all administrator guidance
in a trusted manner.
Cisco Catalyst 6K Series Switches Security Target
28
5 SECURITY REQUIREMENTS
This section identifies the Security Functional Requirements for the TOE. The Security
Functional Requirements included in this section are derived from Part 2 of the Common Criteria
for Information Technology Security Evaluation, Version 3.1, Revision 4, dated: September 2012
and all international interpretations.
5.1 Conventions
The CC defines operations on Security Functional Requirements: assignments, selections,
assignments within selections and refinements. This document uses the following font
conventions to identify the operations defined by the CC:
 Assignment: Indicated with italicized text;
 Refinement: Indicated with bold text;
 Selection: Indicated with underlined text;
 Iteration: Indicated by appending the iteration number in parenthesis, e.g., (1), (2), (3).
 Where operations were completed in the NDPP itself, the formatting used in the NDPP
has been retained.
Explicitly stated SFRs are identified by having a label ‘EXT’ after the requirement name for
TOE SFRs. Formatting conventions outside of operations and iterations matches the formatting
specified within the NDPP.
5.2 TOE Security Functional Requirements
This section identifies the Security Functional Requirements for the TOE. The TOE Security
Functional Requirements that appear in the following table are described in more detail in the
following subsections.
Table 17 Security Functional Requirements
Class Name Component
Identification
Component Name
FAU: Security audit FAU_GEN.1 Audit data generation
FAU_GEN.2 User Identity Association
FAU_STG_EXT.1 External Audit Trail Storage
FCS: Cryptographic support FCS_CKM.1 Cryptographic Key Generation (for asymmetric keys)
FCS_CKM_EXT.4 Cryptographic Key Zeroization
FCS_COP.1(1) Cryptographic Operation (for data encryption/decryption)
FCS_COP.1(2) Cryptographic Operation (for cryptographic signature)
FCS_COP.1(3) Cryptographic Operation (for cryptographic hashing)
FCS_COP.1(4) Cryptographic Operation (for keyed-hash message
authentication)
Cisco Catalyst 6K Series Switches Security Target
29
Class Name Component
Identification
Component Name
FCS_IPSEC_EXT.1 Explicit: IPSEC
FC_SSH_EXT.1 Explicit: SSH
FCS_RBG_EXT.1 Extended: Cryptographic Operation (Random Bit
Generation)
FDP: User data protection FDP_RIP.2 Full Residual Information Protection
FIA: Identification and
authentication
FIA_PMG_EXT.1 Password Management
FIA_UIA_EXT.1 User Identification and Authentication
FIA_UAU_EXT.2 Password-based Authentication Mechanism
FIA_UAU.7 Protected Authentication Feedback
FMT: Security management FMT_MTD.1 Management of TSF Data (for general TSF data)
FMT_SMF.1 Specification of Management Functions
FMT_SMR.2 Restrictions on Security Roles
FPT: Protection of the TSF FPT_SKP_EXT.1 Extended: Protection of TSF Data (for reading of all
symmetric keys)
FPT_APW_EXT.1 Extended: Protection of Administrator Passwords
FPT_STM.1 Reliable Time Stamps
FPT_TUD_EXT.1 Extended: Trusted Update
FPT_TST_EXT.1 TSF Testing
FTA: TOE Access FTA_SSL_EXT.1 TSF-initiated Session Locking
FTA_SSL.3 TSF-initiated Termination
FTA_SSL.4 User-initiated Termination
FTA_TAB.1 Default TOE Access Banners
FTP: Trusted path/channels FTP_ITC.1 Trusted Channel
FTP_TRP.1 Trusted Path
Cisco Catalyst 6K Series Switches Security Target
30
5.2.1 Security audit (FAU)
5.2.1.1 FAU_GEN.1 Audit data generation
FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable
events:
a) Start-up and shut-down of the audit functions;
b) All auditable events for the not specified level of audit; and
c) All administrative actions;
d) [Specifically defined auditable events listed in Table 18].
FAU_GEN.1.2 The TSF shall record within each audit record at least the following information:
a) Date and time of the event, type of event, subject identity, and the outcome (success or
failure) of the event; and
b) For each audit event type, based on the auditable event definitions of the functional
components included in the PP/ST, [information specified in column three of Table 18].
Table 18 Auditable Events
SFR Auditable Event Additional Audit Record Contents
FAU_GEN.1 Start of audit
Shutdown of audit.
None.
FAU_GEN.2 None. None.
FAU_STG_EXT.1 None. None.
FCS_CKM.1 None. None.
FCS_CKM_EXT.4 None. None.
FCS_COP.1(1) None. None.
FCS_COP.1(2) None. None.
FCS_COP.1(3) None. None.
FCS_COP.1(4) None. None.
FCS_IPSEC_EXT.1 Failure to establish an IPsec SA.
Establishment/Termination of an IPsec
SA.
Reason for failure.
Non-TOE endpoint of connection (IP address) for
both successes and failures.
FCS_SSH_EXT.1 Failure to establish an SSH session
Establishment/Termination of an SSH
session.
Reason for failure.
Non-TOE endpoint of connection (IP address) for
both successes and failures.
FCS_RBG_EXT.1 None. None.
Cisco Catalyst 6K Series Switches Security Target
31
SFR Auditable Event Additional Audit Record Contents
FDP_RIP.2 None. None.
FIA_PMG_EXT.1 None. None.
FIA_UIA_EXT.1 All use of the identification and
authentication mechanism.
Provided user identity, origin of the attempt (e.g.,
IP address).
FIA_UAU_EXT.2 All use of the authentication
mechanism.
Origin of the attempt (e.g., IP address).
FIA_UAU.7 None. None.
FMT_MTD.1 None. None.
FMT_SMF.1 Changes to audit function. None.
FMT_SMR.2 None. None.
FPT_SKP_EXT.1 None. None.
FPT_APW_EXT.1 None. None.
FPT_STM.1 Changes to the time. The old and new values for the time.
Origin of the attempt (e.g., IP address).
FPT_TUD_EXT.1 Initiation of update. No additional information.
FPT_TST_EXT.1 None. None.
FTA_SSL_EXT.1 Any attempts at unlocking of an
interactive session.
No additional information.
FTA_SSL.3 The termination of a remote session by
the session locking mechanism.
No additional information.
FTA_SSL.4 The termination of an interactive
session.
No additional information.
FTA_TAB.1 None. None.
FTP_ITC.1 Initiation of the trusted channel.
Termination of the trusted channel.
Failure of the trusted channel functions.
Identification of the initiator and target of failed
trusted channels establishment attempt
FTP_TRP.1 Initiation of the trusted channel.
Termination of the trusted channel.
Failures of the trusted path functions.
Identification of the claimed user identity.
Cisco Catalyst 6K Series Switches Security Target
32
5.2.1.2 FAU_GEN.2 User Identity Association
FAU_GEN.2.1 For audit events resulting from actions of identified users, the TSF shall be able
to associate each auditable event with the identity of the user that caused the event.
5.2.1.3 FAU_STG_EXT.1 External Audit Trail Storage
FAU_STG_EXT.1.1 The TSF shall be able to [transmit the generated audit data to an external
IT entity] using a trusted channel implementing the [IPsec] protocol.
5.2.2 Cryptographic Support (FCS)
5.2.2.1 FCS_CKM.1 Cryptographic Key Generation (for asymmetric keys)
FCS_CKM.1.1 Refinement: The TSF shall generate asymmetric cryptographic keys used for
key establishment in accordance with
 [NIST Special Publication 800-56B, “Recommendation for Pair-Wise Key Establishment
Schemes Using Integer Factorization Cryptography” for RSA-based key establishment
schemes]
and specified cryptographic key sizes equivalent to, or greater than, a symmetric key strength of
112 bits.
5.2.2.2 FCS_CKM_EXT.4 Cryptographic Key Zeroization
FCS_CKM_EXT.4.1 The TSF shall zeroize all plaintext secret and private cryptographic keys
and CSPs when no longer required.
5.2.2.3 FCS_COP.1(1) Cryptographic Operation (for data encryption/decryption)
FCS_COP.1.1(1) Refinement: The TSF shall perform [encryption and decryption] in
accordance with a specified cryptographic algorithm [AES operating in [CBC]] and
cryptographic key sizes 128-bits and 256-bits that meets the following:
 FIPS PUB 197, “Advanced Encryption Standard (AES)”
 [NIST SP 800-38A, NIST SP 800-38D]
5.2.2.4 FCS_COP.1(2) Cryptographic Operation (for cryptographic signature)
FCS_COP.1.1(2) Refinement: The TSF shall perform cryptographic signature services in
accordance with a [RSA Digital Signature Algorithm (rDSA) with a key size (modulus) of 2048
bits or greater]
Cisco Catalyst 6K Series Switches Security Target
33
that meets the following:
[Case: RSA Digital Signature Algorithm
 FIPS PUB 186-2 or FIPS PUB 186-3, “Digital Signature Standard”]
5.2.2.5 FCS_COP.1(3) Cryptographic Operation (for cryptographic hashing)
FCS_COP.1.1(3) Refinement: The TSF shall perform [cryptographic hashing services] in
accordance with a specified cryptographic algorithm [SHA-1, SHA-256, SHA-384, SHA-512]
and message digest sizes [160, 256, 384, 512] bits that meet the following: FIPS Pub 180-3,
“Secure Hash Standard.”
5.2.2.6 FCS_COP.1(4) Cryptographic Operation (for keyed-hash message authentication)
FCS_COP.1.1(4) Refinement: The TSF shall perform [keyed-hash message authentication] in
accordance with a specified cryptographic algorithm HMAC-[ SHA-1, SHA-256, SHA-384,
SHA-512], key size [128, 192, 256 bits], and message digest sizes [160, 256, 384, 512] bits that
meet the following: FIPS Pub 198-1, "The Keyed-Hash Message Authentication Code, and FIPS
Pub 180-3, “Secure Hash Standard.”
5.2.2.7 FCS_IPSEC_EXT.1 Explicit: IPSEC
FCS_IPSEC_EXT.1.1 The TSF shall implement the IPsec architecture as specified in RFC
4301.
FCS_IPSEC_EXT.1.2 The TSF shall implement [tunnel mode].
FCS_IPSEC_EXT.1.3 The TSF shall have a nominal, final entry in the SPD that matches
anything that is otherwise unmatched, and discards it.
FCS_IPSEC_EXT.1.4 The TSF shall implement the IPsec protocol ESP as defined by RFC
4303 using [the cryptographic algorithms AES-CBC-128 (as specified by RFC 3602) together
with a Secure Hash Algorithm (SHA)-based HMAC, AES-CBC-256 (as specified by RFC
3602)].
FCS_IPSEC_EXT.1.5 The TSF shall implement the protocol: [IKEv1 as defined in RFCs 2407,
2408, 2409, RFC 4109, [no other RFCs for extended sequence numbers], and [no other RFCs for
hash functions]].
FCS_IPSEC_EXT.1.6 The TSF shall ensure the encrypted payload in the [IKEv1] protocol uses
the cryptographic algorithms AES-CBC-128, AES-CBC-256 as specified in RFC 6379 and [no
other algorithm].
FCS_IPSEC_EXT.1.7 The TSF shall ensure that IKEv1 Phase 1 exchanges use only main
mode.
Cisco Catalyst 6K Series Switches Security Target
34
FCS_IPSEC_EXT.1.8 The TSF shall ensure that [IKEv1 SA lifetimes can be established based
on [number of packets/number of bytes; length of time, where the time values can be limited to:
24 hours for Phase 1 SAs and 8 hours for Phase 2 SAs].
FCS_IPSEC_EXT.1.9 The TSF shall ensure that all IKE protocols implement DH Groups 14
(2048-bit MODP), and [no other DH groups].
FCS_IPSEC_EXT.1.10 The TSF shall ensure that all IKE protocols perform Peer Authentication
using the [RSA,] algorithm and [Pre-shared Keys].
5.2.2.8 FCS_RBG_EXT.1 Extended: Cryptographic Operation (Random Bit Generation)
FCS_RBG_EXT.1.1 The TSF shall perform all random bit generation (RBG) services in
accordance with [NIST Special Publication 800-90 using [CTR_DRBG (AES)] seeded by an
entropy source that accumulated entropy from [a TSF-hardware-based noise source].
FCS_RBG_EXT.1.2 The deterministic RBG shall be seeded with a minimum of [256 bits] of
entropy at least equal to the greatest security strength of the keys and hashes that it will generate.
5.2.2.9 FCS_SSH_EXT.1 Explicit: SSH
FCS_SSH_EXT.1.1 The TSF shall implement the SSH protocol that complies with RFCs 4251,
4252, 4253, 4254, and [no other RFCs].
FCS_SSH_EXT.1.2 The TSF shall ensure that the SSH protocol implementation supports the
following authentication methods as described in RFC 4252: public key-based, password-based.
FCS_SSH_EXT.1.3 The TSF shall ensure that, as described in RFC 4253, packets greater than
[32768] bytes in an SSH transport connection are dropped.
FCS_SSH_EXT.1.4 The TSF shall ensure that the SSH transport implementation uses the
following encryption algorithms: AES-CBC-128, AES-CBC-256, [no other algorithms].
FCS_SSH_EXT.1.5 The TSF shall ensure that the SSH transport implementation uses
[SSH_RSA] and [no other public key algorithms] as its public key algorithm(s).
FCS_SSH_EXT.1.6 The TSF shall ensure that data integrity algorithms used in SSH transport
connection is [hmac-sha1, hmac-sha1-96].
FCS_SSH_EXT.1.7 The TSF shall ensure that diffie-hellman-group14-sha1and [no other
methods] are the only allowed key exchange method used for the SSH protocol.
Cisco Catalyst 6K Series Switches Security Target
35
5.2.3 User data protection (FDP)
5.2.3.1 FDP_RIP.2 Full Residual Information Protection
FDP_RIP.2.1 The TSF shall ensure that any previous information content of a resource is made
unavailable upon the [deallocation of the resource from] all objects.
5.2.4 Identification and authentication (FIA)
5.2.4.1 FIA_PMG_EXT.1 Password Management
FIA_PMG_EXT.1.1 The TSF shall provide the following password management capabilities
for administrative passwords:
1. Passwords shall be able to be composed of any combination of upper and lower case
letters, numbers, and the following special characters: [“!”, “@”, “#”, “$”, “%”, “^”,
“&”, “*”, “(“,”)”];
2. Minimum password length shall settable by the Security Administrator, and support
passwords of 15 characters or greater;
5.2.4.2 FIA_PSK_EXT.1 Extended: Pre-Shared Key Composition
FIA_PSK_EXT.1.1 The TSF shall be able to use pre-shared keys for IPsec.
FIA_PSK_EXT.1.2 The TSF shall be able to accept text-based pre-shared keys that:
 are 22 characters and [up to 127 characters];
 composed of any combination of upper and lower case letters, numbers, and special
characters (that include: “!”, “@”, “#”, “$”, “%”, “^”, “&”, “*”, “(“, and “)”).
FIA_PSK_EXT.1.3 The TSF shall condition the text-based pre-shared keys by using [AES] and
be able to [use no other pre-shared keys]
5.2.4.3 FIA_UIA_EXT.1 User Identification and Authentication
FIA_UIA_EXT.1.1 The TSF shall allow the following actions prior to requiring the non-TOE
entity to initiate the identification and authentication process:
 Display the warning banner in accordance with FTA_TAB.1;
 [any network packets as configured by the authorized administrator may flow through the
switch].
FIA_UIA_EXT.1.2 The TSF shall require each administrative user to be successfully
identified and authenticated before allowing any other TSF-mediated action on behalf of that
administrative user.
Cisco Catalyst 6K Series Switches Security Target
36
5.2.4.4 FIA_UAU_EXT.2 Extended: Password-based Authentication Mechanism
FIA_UAU_EXT.2.1 The TSF shall provide a local password-based authentication mechanism,
[remote password-based authentication via RADIUS and TACACS+] to perform administrative
user authentication.
5.2.4.5 FIA_UAU.7 Protected Authentication Feedback
FIA_UAU.7.1 The TSF shall provide only obscured feedback to the administrative user while
the authentication is in progress at the local console.
5.2.5 Security management (FMT)
5.2.5.1 FMT_MTD.1 Management of TSF Data (for general TSF data)
FMT_MTD.1.1 The TSF shall restrict the ability to manage the TSF data to the Security
Administrators.
5.2.5.2 FMT_SMF.1 Specification of Management Functions
FMT_SMF.1.1 The TSF shall be capable of performing the following management functions:
 Ability to administer the TOE locally and remotely;
 Ability to update the TOE, and to verify the updates using [digital signature, published
hash] capability prior to installing those updates;
 [
o Ability to configure the list of TOE-provided services available before an entity is
identified and authenticated, as specified in FIA_UIA_EXT.1;
o Ability to configure the cryptographic functionality; ]
5.2.5.3 FMT_SMR.2 Restrictions on Security Roles
FMT_SMR.2.1 The TSF shall maintain the roles:
 Authorized Administrator.
FMT_SMR.2.2 The TSF shall be able to associate users with roles.
FMT_SMR.2.3 The TSF shall ensure that the conditions
 Authorized Administrator role shall be able to administer the TOE locally;
 Authorized Administrator role shall be able to administer the TOE remotely;
are satisfied.
Cisco Catalyst 6K Series Switches Security Target
37
5.2.6 Protection of the TSF (FPT)
5.2.6.1 FPT_SKP_EXT.1 Extended: Protection of TSF Data (for reading of all symmetric
keys)
FPT_SKP_EXT.1.1 The TSF shall prevent reading of all pre-shared keys, symmetric keys, and
private keys.
5.2.6.2 FPT_APW_EXT.1 Extended: Protection of Administrator Passwords
FPT_APW_EXT.1.1 The TSF shall store passwords in non-plaintext form.
FPT_APW_EXT.1.2 The TSF shall prevent the reading of plaintext passwords.
5.2.6.3 FPT_STM.1 Reliable time stamps
FPT_STM.1.1 The TSF shall be able to provide reliable time stamps for its own use.
5.2.6.4 FPT_TST_EXT.1: TSF Testing
FPT_TST_EXT.1.1 The TSF shall run a suite of self tests during initial start-up (on power on)
to demonstrate the correct operation of the TSF.
5.2.6.5 FPT_TUD_EXT.1 Extended: Trusted Update
FPT_TUD_EXT.1.1 The TSF shall provide security administrators the ability to query the
current version of the TOE firmware/software.
FPT_TUD_EXT.1.2 The TSF shall provide security administrators the ability to initiate updates
to TOE firmware/software.
FPT_TUD_EXT.1.3 The TSF shall provide a means to verify firmware/software updates to the
TOE using a [digital signature mechanism, published hash] prior to installing those updates.
5.2.7 TOE Access (FTA)
5.2.7.1 FTA_SSL_EXT.1 TSF-initiated Session Locking
FTA_SSL_EXT.1.1 The TSF shall, for local interactive sessions, [
 terminate the session]
after a Security Administrator-specified time period of inactivity.
Cisco Catalyst 6K Series Switches Security Target
38
5.2.7.2 FTA_SSL.3 TSF-initiated Termination
FTA_SSL.3.1 Refinement: The TSF shall terminate a remote interactive session after a
[Security Administrator-configurable time interval of session inactivity].
5.2.7.3 FTA_SSL.4 User-initiated Termination
FTA_SSL.4.1 The TSF shall allow Administrator-initiated termination of the Administrator’s
own interactive session.
5.2.7.4 FTA_TAB.1 Default TOE Access Banners
FTA_TAB.1.1 Refinement: Before establishing an administrative user session the TSF shall
display a Security Administrator-specified advisory notice and consent warning message
regarding use of the TOE.
5.2.1 Trusted Path/Channels (FTP)
5.2.1.1 FTP_ITC.1 Inter-TSF trusted channel
FTP_ITC.1.1 Refinement: The TSF shall use [IPsec] to provide a trusted communication
channel between itself and authorized IT entities supporting the following capabilities: audit
server, [authentication server] that is logically distinct from other communication channels and
provides assured identification of its end points and protection of the channel data from
disclosure and detection of modification of the channel data.
FTP_ITC.1.2 The TSF shall permit the TSF, or the authorized IT entities to initiate
communication via the trusted channel.
FTP_ ITC.1.3 The TSF shall initiate communication via the trusted channel for [
 external audit servers using IPsec,
 remote AAA servers using IPsec,
 time synchronization with NTP server using IPsec
].
5.2.1.2 FTP_TRP.1 Trusted Path
FTP_TRP.1.1 Refinement: The TSF shall use [SSH] and [no other protocols] provide a
trusted communication path between itself and remote administrators that is logically distinct
from other communication paths and provides assured identification of its end points and
protection of the communicated data from disclosure and detection of modification of the
communicated data.
FTP_TRP.1.2 Refinement: The TSF shall permit remote administrators to initiate
communication via the trusted path.
Cisco Catalyst 6K Series Switches Security Target
39
FTP_TRP.1.3 The TSF shall require the use of the trusted path for initial administrator
authentication and all remote administration actions.
5.3 TOE SFR Dependencies Rationale for SFRs Found in PP
The Security Functional Requirements (SFRs) in this Security Target represent the SFRs
identified in the NDPPv1.1 and Security Requirements for Network Devices – Errata #3. As
such, the NDPP SFR dependency rationale is deemed acceptable since the PP itself has been
validated.
5.4 Security Assurance Requirements
5.4.1 SAR Requirements
The TOE assurance requirements for this ST are taken directly from the NDPP which are derived
from Common Criteria Version 3.1, Revision 4. The assurance requirements are summarized in
the table below.
Table 19: Assurance Measures
Assurance Class Components Components Description
DEVELOPMENT ADV_FSP.1 Basic Functional Specification
GUIDANCE DOCUMENTS AGD_OPE.1 Operational user guidance
AGD_PRE.1 Preparative User guidance
LIFE CYCLE SUPPORT ALC_CMC.1 Labelling of the TOE
ALC_CMS.1 TOE CM coverage
TESTS ATE_IND.1 Independent testing – conformance
VULNERABILITY
ASSESSMENT
AVA_VAN.1 Vulnerability analysis
5.4.2 Security Assurance Requirements Rationale
The Security Assurance Requirements (SARs) in this Security Target represent the SARs
identified in the NDPPv1.1 and Security Requirements for Network Devices – Errata #3. As
such, the NDPP SAR rationale is deemed acceptable since the PP itself has been validated.
Cisco Catalyst 6K Series Switches Security Target
40
5.5 Assurance Measures
The TOE satisfies the identified assurance requirements. This section identifies the Assurance
Measures applied by Cisco to satisfy the assurance requirements. The table below lists the
details.
Table 20 Assurance Measures
Component How requirement will be met
ADV_FSP.1 The functional specification describes the external interfaces of the TOE; such as the means
for a user to invoke a service and the corresponding response of those services. The
description includes the interface(s) that enforces a security functional requirement, the
interface(s) that supports the enforcement of a security functional requirement, and the
interface(s) that does not enforce any security functional requirements. The interfaces are
described in terms of their purpose (general goal of the interface), method of use (how the
interface is to be used), parameters (explicit inputs to and outputs from an interface that control
the behaviour of that interface), parameter descriptions (tells what the parameter is in some
meaningful way), and error messages (identifies the condition that generated it, what the
message is, and the meaning of any error codes). The development evidence also contains a
tracing of the interfaces to the SFRs described in this ST.
AGD_OPE.1 The Administrative Guide provides the descriptions of the processes and procedures of how
the administrative users of the TOE can securely administer the TOE using the interfaces that
provide the features and functions detailed in the guidance.
AGD_PRE.1 The Installation Guide describes the installation, generation, and startup procedures so that the
users of the TOE can put the components of the TOE in the evaluated configuration.
ALC_CMC.1 The Configuration Management (CM) document(s) describes how the consumer (end-user) of
the TOE can identify the evaluated TOE (Target of Evaluation). The CM document(s),
identifies the configuration items, how those configuration items are uniquely identified, and
the adequacy of the procedures that are used to control and track changes that are made to the
TOE. This includes details on what changes are tracked, how potential changes are
incorporated, and the degree to which automation is used to reduce the scope for error.
ALC_CMS.1
ATE_IND.1 Cisco will provide the TOE for testing.
AVA_VAN.1 Cisco will provide the TOE for testing.
Cisco Catalyst 6K Series Switches Security Target
41
6 TOE SUMMARY SPECIFICATION
6.1 TOE Security Functional Requirement Measures
This chapter identifies and describes how the Security Functional Requirements identified above
are met by the TOE.
Table 21 How TOE SFRs Measures
TOE SFRs How the SFR is Met
FAU_GEN.1 The TOE generates an audit record whenever an audited event occurs. The types of
events that cause audit records to be generated include identification and
authentication related events, and administrative events (the specific events and the
contents of each audit record are listed in the table within the FAU_GEN.1 SFR,
“Auditable Events Table”). Each of the events is specified in the audit record is in
enough detail to identify the user for which the event is associated (e.g. user identity,
MAC address, IP address), when the event occurred, where the event occurred, the
outcome of the event, and the type of event that occurred. Additionally, the startup
and shutdown of the audit functionality is audited.
The audit trail consist of the individual audit records; one audit record for each event
that occurred. The audit record can contain up to 80 characters and a percent sign
(%), which follows the time-stamp information. As noted above, the information
includes [at least] all of the required information. Additional information can be
configured and included if desired. Refer to the Common Criteria Operational User
Guidance and Preparative Procedures for command description and usage
information.
The logging buffer size can be configured from a range of 4096 (default) to
2147483647 bytes. It is noted, not make the buffer size too large because the switch
could run out of memory for other tasks. Use the show memory privileged EXEC
command to view the free processor memory on the switch. However, this value is
the maximum available, and the buffer size should not be set to this amount. Refer
to the Common Criteria Operational User Guidance and Preparative Procedures for
command description and usage information.
The log buffer is circular, so newer messages overwrite older messages after the
buffer is full. Administrators are instructed to monitor the log buffer using the show
logging privileged EXEC command to view the audit records. The first message
displayed is the oldest message in the buffer. There are other associated commands
to clear the buffer, to set the logging level, etc.; all of which are described in the
Guidance documents and IOS CLI. Refer to the Common Criteria Operational User
Guidance and Preparative Procedures for command description and usage
information.
The logs can be saved to flash memory so records are not lost in case of failures or
restarts. Refer to the Common Criteria Operational User Guidance and Preparative
Procedures for command description and usage information.
The administrator can set the level of the audit records to be displayed on the
console or sent to the syslog server. For instance all emergency, alerts, critical,
errors, and warning message can be sent to the console alerting the administrator
that some action needs to be taken as these types of messages mean that the
functionality of the switch is affected. All notifications and information type
Cisco Catalyst 6K Series Switches Security Target
42
TOE SFRs How the SFR is Met
message can be sent to the syslog server, whereas message is only for information;
switch functionality is not affected.
To configure the TOE to send audit records to a syslog server, the ‘set logging
server’ command is used. A maximum of three syslog servers can be configured.
Refer to the Common Criteria Operational User Guidance and Preparative
Procedures for command description and usage information. The audit records are
transmitted using IPsec tunnel to the syslog server. If the communications to the
syslog server is lost, the TOE generates an audit record and all permit traffic is
denied until the communications is re-established.
The FIPS crypto tests performed during startup, the messages are displayed only on
the console. Once the box is up and operational and the crypto self-test command is
entered, then the messages would be displayed on the console and will also be
logged. For the TSF self-test, successful completion of the self-test is indicated by
reaching the log-on prompt. If there are issues, the applicable audit record is
generated and displayed on the console.
FAU_GEN.2 The TOE shall ensure that each auditable event is associated with the user that
triggered the event and as a result, they are traceable to a specific user. For example,
a human user, user identity or related session ID would be included in the audit
record. For an IT entity or device, the IP address, MAC address, host name, or other
configured identification is presented. Refer to the Common Criteria Operational
User Guidance and Preparative Procedures for command description and usage
information.
FAU_STG_EXT.1 The TOE is configured to export syslog records to a specified, external syslog
server. The TOE protects communications with an external syslog server via IPsec.
If the IPsec connection fails, the TOE will store audit records on the TOE when it
discovers it can no longer communicate with its configured syslog server. When the
connection is restored, the TOE will transmit the buffer contents when connectivity
to the syslog server
For audit records stored internally to the TOE, the administrator has the ability to
configure the TOE to stop all auditable events when an audit storage threshold is
met (lossless auditing) or given the log file is circular, the TOE may overwrite the
oldest audit records when the audit trail becomes full. The size of the logging files
on the TOE is configurable by the administrator with the minimum value being 4096
(default) to 2147483647 bytes of available disk space. Please refer to the Guidance
documentation for configuration syntax and information.
Only Authorized Administrators are able to clear the local logs, and local audit
records are stored in a directory that does not allow administrators to modify the
contents.
FCS_CKM.1 The TOE implements a random number generator for RSA key establishment
schemes (conformant to NIST SP 800-56B).
The TOE can create a RSA public-private key pair that can be used to generate a
Certificate Signing Request (CSR). Through use of Simple Certificate Enrollment
Protocol (SCEP), the TOE can: send the CSR to a Certificate Authority (CA) for the
CA to generate a certificate; and receive its certificate from the CA. Integrity of the
CSR and certificate during transit are assured through use of digitally signatures
(encrypting the hash of the TOE’s public key contained in the CSR and
Cisco Catalyst 6K Series Switches Security Target
43
TOE SFRs How the SFR is Met
certificate). The TOE can store and distribute the certificate to external entities
including Registration Authorities (RA).
The key pair generation portions of “The RSA Validation System” for FIPS 186-2
were used as a guide in testing the FCS_CKM.1 during the FIPS validation.
FCS_CKM_EXT.4 None of the symmetric keys, pre-shared keys, or private keys are stored in plaintext
form. Please see Section 7.1 for more information on the key zeroization.
FCS_COP.1(1) The TOE provides symmetric encryption and decryption capabilities using AES in
CBC mode (128, 256 bits) as described in NIST SP 800-38A and NIST SP 800-38D.
AES is implemented in the following protocols: IPSEC and SSH. The relevant FIPS
certificate numbers are listed in Table 7 FIPS References
FCS_COP.1(2) The TOE provides cryptographic signature services using RSA Digital Signature
Algorithm with key size of 2048 and greater as specified in FIPS PUB 186-3,
“Digital Signature Standard” and FIPS PUB 186-2, “Digital Signature Standard”.
The relevant FIPS certificate numbers are listed in Table 7 FIPS References
FCS_COP.1(3) The TOE provides cryptographic hashing services using SHA-1, SHA-256, SHA-
384, and SHA-512 as specified in FIPS Pub 180-3 “Secure Hash Standard.” For IKE
(ISAKMP) hashing, administrators can select any of SHA-1, SHA-256, SHA-384,
and/or SHA-512 (with message digest sizes of 160, 256, 384, and 512 bits
respectively) to be used with remote IPsec endpoints. Both SHA-1 and SHA-256
hashing are used for verification of software image integrity. The relevant FIPS
certificate numbers are listed in Table 7 FIPS References
FCS_COP.1(4) The TOE uses HMAC-SHA1 message authentication as part of the RADIUS Key
Wrap functionality. For IPsec SA authentication integrity options administrators can
select any of esp-sha-hmac (HMAC-SHA-1), esp-sha256-hmac, esp-sha384-hmac,
or esp-sha512-hmac (with message digest sizes of 160, 256, 384, and 512 bits
respectively) to be part of the IPsec SA transform-set to be used with remote IPsec
endpoints. The relevant FIPS certificate numbers are listed in Table 7 FIPS
References
FCS_IPSEC_EXT.1 The TOE implements IPsec to provide authentication and encryption services to
prevent unauthorized viewing or modification of data as it travels over the external
network. The TOE implementation of the IPsec standard (in accordance with the
RFCs noted in the SFR) uses the Encapsulating Security Payload (ESP) protocol to
provide authentication, encryption and anti-replay services using AES-CBC-128 and
AES-CBC-256 together with HMAC-SHA1.
The TOE uses IPsec to secure communications with the remote syslog server, with
AAA servers (RADIUS, TACACS+) for remote authentication and with NTP
servers, if configured.
IPsec Internet Key Exchange, also called ISAKMP, is the negotiation protocol that
lets two peers agree on how to build an IPsec Security Association (SA). The IKE
protocols implement Peer Authentication using the rDSA algorithm. IKE separates
negotiation into two phases: phase 1 and phase 2. Phase 1 creates the first tunnel,
which protects later ISAKMP negotiation messages. The key negotiated in phase 1
enables IKE peers to communicate securely in phase 2. During Phase 2 IKE
establishes the IPsec SA. IKE maintains a trusted channel, referred to as a Security
Cisco Catalyst 6K Series Switches Security Target
44
TOE SFRs How the SFR is Met
Association (SA), between IPsec peers that is also used to manage IPsec
connections, including:
 The negotiation of mutually acceptable IPsec options between peers
(including peer authentication parameters, either signature based or pre-
shared key based),
 The establishment of additional Security Associations to protect packets
flows using Encapsulating Security Payload (ESP), and
 The agreement of secure bulk data encryption AES keys for use with ESP.
A crypto map (the Security Policy Definition) set can contain multiple entries, each
with a different access list. The crypto map entries are searched in a sequence – the
router attempts to match the packet to the access list (acl) specified in that entry.
When a packet matches a permit entry in a particular access list, the method of
security in the corresponding crypto map is applied. If the crypto map entry is
tagged as ipsecisakmp, IPsec is triggered. The traffic matching the permit acls
would then flow through the IPsec tunnel and be classified as “PROTECTED”.
Traffic that does not match a permit crypto map acl and does not match a non-crypto
permit acl on the interface would be DISCARDED. Traffic that does not match a
permit acl in the crypto map, but does match a non-crypto permit acl would be
allowed to BYPASS the tunnel. For example, a non-crypto permit acl for icmp
would allow ping traffic to flow unencrypted if a permit crypto map was not
configured that matches the ping traffic.
After the two peers agree upon a policy, the security parameters of the policy are
identified by an SA established at each peer, and these IKE SAs apply to all
subsequent IKE traffic during the negotiation.
The TOE will be configured to not support aggressive mode for IKEv1 exchanges
and to only use main mode. The TOE can be configured to not allow confidentiality
only” ESP mode by ensuring the IKE Policies configured include ESP-encryption.
The TOE supports configuration lifetimes of both Phase 1 SAs and Phase 2 SAs.
The TOE supports Diffie-Hellman Group 14 (2048-bit keys). Group 14 (2048-bit
keys) can be set to a minimum key size of 2048 using the ‘ip ssh dh min size’
command. Peer authentication is done using rDSA.
Preshared keys can be configured using the ‘crypto isakmp key’ key command and
may be proposed by each of the peers negotiating the IKE establishment. Pre-shared
keys are required to be a combination of upper and lower case letters, numbers, and
special characters are required as well as 22 characters.
FCS_SSH_EXT.1 The TOE implementation of SSHv2 supports the following:
 Compliance with RFCs 4251, 4252, 4253, and 4254;
 Dropping packets greater than 65,535 bytes, as such packets would violate
the IP packet size limitations;
 Encryption algorithms AES-CBC-128, and AES-CBC-256 to ensure
confidentiality of the session;
 Use of the SSH_RSA public key algorithms for authentication;
 Password-based authentication;
 Hashing algorithms hmac-sha1 and hmac-sha1-96 to ensure the integrity of
Cisco Catalyst 6K Series Switches Security Target
45
TOE SFRs How the SFR is Met
the session and
 Enforcement of DH Group 14 (diffie-hellman-group-14-sha1) as the only
allowed key exchange method.
FCS_RBG_EXT.1 The TOE implements a NIST-approved AES-CTR Deterministic Random Bit
Generator (DRBG), as specified in SP 800-90. The TOE implements a NIST-
approved AES-CTR Deterministic Random Bit Generator (DRBG), as specified in
SP 800-90. The entropy source used to seed the Deterministic Random Bit
Generator (e.g. based on SP 800-90A/B/C) is a random set of bits or bytes that are
regularly supplied to the DRBG by randomly poll the General Purpose Registers and
capture entropy from it.
All RNG entropy source samplings are continuously health tested by the NIST
DRBG as per SP 900-90A before using them as a seed. Any initialization or system
errors during bring-up or processing of this system causes a reboot. Finally, the
system will be zeroizing any entropy seeding bytes, which will not be available after
the current collection.
FDP_RIP.2 The TOE ensures that packets transmitted from the TOE do not contain residual
information from data deallocated from previous packets. Packets that are not the
required length use zeros for padding. Residual data is never transmitted from the
TOE. Once packet handling is completed its content is zeroized (overwritten with
0x00) before deallocation from the memory buffer which previously contained the
packet is reused. This applies to both data plane traffic and administrative session
traffic.
FIA_PMG_EXT.1 The TOE supports the local definition of users with corresponding passwords. The
passwords can be composed of any combination of upper and lower case letters,
numbers, and special characters (that include: “!”, “@”, “#”, “$”, “%”, “^”, “&”,
“*”, “(“, and “)”. Minimum password length is settable by the Authorized
Administrator, and can be configured for minimum password lengths of 15
characters.
FIA_PSK_EXT.1 The TOE supports use of IKEv1 (ISAKMP) pre-shared keys for authentication of
IPsec tunnels. Pre-shared keys can be entered as ASCII characters (from 22 and up
to 128 characters long) using the “crypto isakmp key” command and are conditioned
by the TOE (using AES) to an encrypted string used by IKE.
To set the key for a tunnel, use the following command after configuring that tunnel
to authenticate using a pre-shared key instead of RSA:
crypto isakmp key <enc-type-digit> <keystring>
To enter the keystring in encrypted form (AES encrypted), specify 6 as the enc-type-
digit.
Cisco Catalyst 6K Series Switches Security Target
46
TOE SFRs How the SFR is Met
FIA_UIA_EXT.1
FIA_UAU_EXT.2
The TOE requires all users to be successfully identified and authenticated before
allowing any TSF mediated actions to be performed. Administrative access to the
TOE is facilitated through the TOE’s CLI. The TOE mediates all administrative
actions through the CLI. Once a potential administrative user attempts to access the
CLI of the TOE through either a directly connected console or remotely through an
SSHv2 connection, the TOE prompts the user for a user name and password. Only
after the administrative user presents the correct authentication credentials will
access to the TOE administrative functionality be granted. No access is allowed to
the administrative functionality of the TOE until an administrator is successfully
identified and authenticated.
The TOE provides a local password based authentication mechanism as well as
RADIUS and TACACS+ authentication.
The administrator authentication policies include authentication to the local user
database or redirection to a remote authentication server. Interfaces can be
configured to try one or more remote authentication servers, and then fail back to the
local user database if the remote authentication servers are inaccessible.
The process for authentication is the same for administrative access whether
administration is occurring via a directly connected console cable or remotely via
SSHv2. At initial login, the administrative user is prompted to provide a username.
After the user provides the username, the user is prompted to provide the
administrative password associated with the user account. The TOE then either
grants administrative access (if the combination of username and password is
correct) or indicates that the login was unsuccessful. The TOE does not provide a
reason for failure in the cases of a login failure.
FIA_UAU.7 When a user enters their password at the local console, the TOE displays only ‘*’
characters so that the user password is obscured. For remote session authentication,
the TOE does not echo any characters as they are entered.
FMT_MTD.1 The TOE provides the ability for Security Administrators (a.k.a Authorized
Administrators) to access TOE data, such as audit data, configuration data, security
attributes, session thresholds and updates. Each of the predefined and
administratively configured privilege level has a set of permissions that will grant
them access to the TOE data, though with some privilege levels, the access is
limited.
The TOE performs role-based authorization, using TOE platform authorization
mechanisms, to grant access to the privileged and semi-privileged levels. For the
purposes of this evaluation, the privileged level is equivalent to full administrative
access to the CLI, which is the default access for IOS privilege level 15; and the
semi-privileged level equates to any privilege level that has a subset of the privileges
assigned to level 15. Privilege levels 0 and 1 are defined by default and are
customizable, while levels 2-14 are undefined by default and are also customizable.
The term “Authorized Administrator” is used in this ST to refer to any user which
has been assigned to a privilege level that is permitted to perform the relevant
action; therefore has the appropriate privileges to perform the requested functions.
Therefore, semi-privileged administrators with only a subset of privileges can also
modify TOE data based on if granted the privilege.
Cisco Catalyst 6K Series Switches Security Target
47
TOE SFRs How the SFR is Met
In addition, network packets are permitted to flow, as configured by the authorized
administrator, through the switch prior to the identification and authentication of an
authorized administrator.
FMT_SMF.1 The TOE provides all the capabilities necessary to securely manage the TOE. The
administrative user can connect to the TOE using the CLI to perform these functions
via SSHv2, a terminal server, or at the local console.
The specific management capabilities available from the TOE include:
 Local and remote administration of the TOE and the services provided by
the TOE via the TOE CLI, as described above;
 The ability to update the IOS software
 Ability to configure the cryptographic functionality;
 Ability to configure the IPsec functionality,
 Ability to enable, disable, determine and modify the behavior of all the
security functions of the TOE via the CLI.
FMT_SMR.2 The TOE platform maintains privileged and semi-privileged administrator roles. The
TOE performs role-based authorization, using TOE platform authorization
mechanisms, to grant access to the semi-privileged and privileged roles. For the
purposes of this evaluation, the privileged role is equivalent to full administrative
access to the CLI, which is the default access for IOS privilege level 15; and the
semi-privileged role equates to any privilege level that has a subset of the privileges
assigned to level 15. Privilege levels 0 and 1 are defined by default and are
customizable, while levels 2-14 are undefined by default and are also customizable.
Note: the levels are not hierarchical.
The term “Authorized Administrator” is used in this ST to refer to any user which
has been assigned to a privilege level that is permitted to perform the relevant
action; therefore has the appropriate privileges to perform the requested functions.
The privilege level determines the functions the user can perform; hence the
Authorized Administrator with the appropriate privileges.
The TOE can and shall be configured to authenticate all access to the command line
interface using a username and password.
The TOE supports both local administration via a directly connected console cable
and remote authentication via SSH.
Cisco Catalyst 6K Series Switches Security Target
48
TOE SFRs How the SFR is Met
FPT_SKP_EXT.1
FPT_APW_EXT.1
The TOE stores all private keys in a secure directory that is not readily accessible to
administrators. All pre-shared and symmetric keys are stored in encrypted form
using AES encryption to additionally obscure access. This functionality is
configured on the TOE using the ‘password encryption aes’ command. The TOE is
configured to not display configured keys as part of configuration files using the
‘hidekeys’ command.
In this manner, the TOE ensures that plaintext user passwords will not be disclosed
even to administrators. Password encryption is configured using the ‘service
password-encryption’ command.
Please refer to the Common Criteria Operational User Guidance and Preparative
Procedures for command description and usage information.
FPT_STM.1 The TOE provides a source of date and time information used in audit event
timestamps. The clock function is reliant on the system clock provided by the
underlying hardware. The TOE can optionally be set to receive clock updates from
an NTP server. This date and time is used as the time stamp that is applied to TOE
generated audit records and used to track inactivity of administrative sessions. This
system clock is also used for cryptographic functions.
FPT_TUD_EXT.1 Authorized Administrator can query the software version running on the TOE, and
can initiate updates to (replacements of) software images. When software updates
are made available by Cisco, an administrator can obtain, verify the integrity of, and
install those updates. The updates can be downloaded from the software.Cisco.com.
The TOE image files are digitally signed so their integrity can be verified during the
boot process, and an image that fails an integrity check will not be loaded. The
digital certificates used by the update verification mechanism are contained on the
TOE. Detailed instructions for how to do this verification are provided in the
administrator guidance for this evaluation. Briefly, the software version and digital
signature information for the TOE specific image can be displayed using the
following commands:
The administrator in privileged EXEC mode enters
Switch# show version (this displays information about the Cisco IOS software
version running on the TOE the ROM Monitor and Bootflash software versions, and
the hardware configuration, including the amount of system memory)
Switch# show software authenticity running (displays software authenticity-related
information for the current ROMMON and the Cisco IOS image file used for
booting)
Switch# show software authenticity file {flash0:filename | flash1:filename |
flash:filename | nvram:filename | usbflash0:filename | usbflash1:filename} (displays
digital signature and software authenticity-related information for a specific image
file.)
Switch# show software authenticity keys (Displays the software public keys that are
in storage with the key types for digitally signed Cisco software).
Updates can also be verified by using published hash. The cryptographic checksums
(i.e., public hashes/SHA-256) are used to verify software/firmware update files (to
Cisco Catalyst 6K Series Switches Security Target
49
TOE SFRs How the SFR is Met
ensure they have not been modified from the originals distributed by Cisco) before
they are used to actually update the applicable TOE components. Once the file is
downloaded from the Cisco.com web site, verify that it was not tampered.
Instructions for how to do this verification are provided in the administrator
guidance for this evaluation. The hash value can be displayed by hovering over the
software image name under details on the Cisco.com web site. If the hashes do not
match, contact Cisco Technical Assistance Centre (TAC).
FPT_TST_EXT.1 The TOE runs a suite of self-tests during initial start-up to verify its correct
operation. If any of the tests fail, the Authorized Administrator will have to log into
the CLI to determine which test failed and why.
During the system bootup process (power on or reboot), all the Power on Startup
Test (POST) components for all the cryptographic modules perform the POST for
the corresponding component (hardware or software). These tests include:
• AES Known Answer Test
• RSA Signature Known Answer Test (both signature/verification)
• Power up bypass test
• RNG Known Answer Test
• Diffie Hellman test
• HMAC Known Answer Test
• SHA-1/256/512 Known Answer Test
• Triple-DES Known Answer Test
• Software Integrity Test
If any component reports failure for the POST, the system crashes and appropriate
information is displayed on the screen, and saved in the crashinfo file.
All ports are blocked from moving to forwarding state during the POST. If all
components of all modules pass the POST, the system is placed in FIPS PASS state
and ports are allowed to forward data traffic.
These tests are sufficient to verify that the correct version of the TOE software is
running as well as that the cryptographic operations are all performing as expected.
FTA_SSL_EXT.1
FTA_SSL.3
An administrator can configure maximum inactivity times individually for both local
and remote administrative sessions through the use of the “session-timeout” setting
applied to the console and virtual terminal (vty) lines. The configuration of the vty
lines sets the configuration for the remote console access. The line console settings
are not immediately activated for the current session. The current line console
session must be exited. When the user logs back in, the inactivity timer will be
activated for the new session. If a local user session is inactive for a configured
period of time, the session will be locked and will require re-authentication to
unlock the session. If a remote user session is inactive fr a configured period of
time, the session will be terminated and will require authentication to establish a
new session.
Administratively configurable timeouts are also available for the EXEC level access
(access above level 1) through use of the “exec-timeout” setting.
FTA_SSL.4 An administrator is able to exit out of both local and remote administrative sessions.
FTA_TAB.1 The TOE displays a privileged Administrator specified banner on the CLI
management interface prior to allowing any administrative access to the TOE. This
is applicable for both local and remote TOE administration.
Cisco Catalyst 6K Series Switches Security Target
50
TOE SFRs How the SFR is Met
FTP_ITC.1 The TOE protects communications with authorized IT entities with IPsec. This
protects the data from disclosure by encryption and by checksums that verify that
data has not been modified.
FTP_TRP.1 All remote administrative communications take place over a secure encrypted
SSHv2 session. The SSHv2 session is encrypted using AES encryption. The remote
users are able to initiate SSHv2 communications with the TOE.
Cisco Catalyst 6K Series Switches Security Target
51
7 ANNEX A: KEY ZEROIZATION
7.1 Key Zeroization
The following table describes the key zeroization referenced by FCS_CKM_EXT.4 provided by
the TOE.
Table 22: TOE Key Zeroization
Name Description Zeroization
Diffie-Hellman
Shared Secret
The value is zeroized after it has been given back to the
consuming operation. The value is overwritten by 0’s.
Automatically after
completion of DH
exchange.
Overwritten with: 0x00
Diffie Hellman
private exponent
The function returns the value to the RP and then calls the
function to perform the zeroization of the generated key pair
(p_dh_kepair) and then calls the standard Linux free (without the
poisoning). These values are automatically zeroized after
generation and once the value has been provided back to the
actual consumer.
Zeroized upon completion
of DH exchange.
Overwritten with: 0x00
skeyid The function calls the operation ike_free_ike_sa_chunk, which
performs the zeroization of the IKE structure. This structure
contains all of the SA items, including the skeyid, skeyid_d, IKE
Session Encryption Key and IKE Session Authentication Key.
All values overwritten by 0’s.
Automatically after IKE
session terminated.
Overwritten with: 0x00
skeyid_d The function calls the operation ike_free_ike_sa_chunk, which
performs the zeroization of the IKE structure. This structure
contains all of the SA items, including the skeyid, skeyid_d, IKE
Session Encryption Key and IKE Session Authentication Key.
All values overwritten by 0’s.
Automatically after IKE
session terminated.
Overwritten with: 0x00
IKE session
encrypt key
The function calls the operation ike_free_ike_sa_chunk, which
performs the zeroization of the IKE structure. This structure
contains all of the SA items, including the skeyid, skeyid_d, IKE
Session Encryption Key and IKE Session Authentication Key.
All values overwritten by 0’s.
Automatically after IKE
session terminated.
Overwritten with: 0x00
IKE session
authentication key
The function calls the operation ike_free_ike_sa_chunk, which
performs the zeroization of the IKE structure. This structure
contains all of the SA items, including the skeyid, skeyid_d, IKE
Session Encryption Key and IKE Session Authentication Key.
All values overwritten by 0’s.
Automatically after IKE
session terminated.
Overwritten with: 0x00
ISAKMP
preshared
The function calls the free operation with the poisoning
mechanism that overwrites the value with 0x0d.
Zeroized using the
following command:
# no crypto isakmp key
Overwritten with: 0x0d
IKE RSA Private
Key
The operation uses the free operation with the poisoning
mechanism that overwrites the value with 0x0d. (This function is
used by the module when zeroizing bad key pairs from RSA Key
generations.)
Zeroized using the
following command:
# crypto key zeroize rsa
Overwritten with: 0x0d
IPsec encryption The function zeroizes an _ike_flow structure that includes the Automatically when IPsec
Cisco Catalyst 6K Series Switches Security Target
52
Name Description Zeroization
key encryption and authentication keys. The entire object is
overwritten by 0’s using memset.
session terminated.
Overwritten with: 0x00
IPsec
authentication key
The function zeroizes an _ike_flow structure that includes the
encryption and authentication keys. The entire object is
overwritten by 0’s using memset.
Automatically when IPsec
session terminated.
Overwritten with: 0x00
RADIUS secret The function calls aaa_free_secret, which uses the poisoned free
operation to zeroize the memory from the secret structure by
overwriting the space with 0x0d and releasing the memory.
Zeroized using the
following command:
# no radius-server key
Overwritten with: 0x0d
SSH Private Key Once the function has completed the operations requiring the
RSA key object, the module over writes the entire object (no
matter its contents) using memset. This overwrites the key with
all 0’s.
Zeroized using the
following command:
# crypto key zeroize rsa
Overwritten with: 0x00
SSH Session Key The results zeroized using the poisioning in free to overwrite the
values with 0x00. This is called by the ssh_close function when a
session is ended.
Automatically when the
SSH session is terminated.
Overwritten with: 0x00
Cisco Catalyst 6K Series Switches Security Target
53
8 ANNEX B: REFERENCES
The following documentation was used to prepare this ST:
Table 23: References
Identifier Description
[CC_PART1] Common Criteria for Information Technology Security Evaluation – Part 1: Introduction
and general model, dated September 2012, version 3.1, Revision 4, CCMB-2012-009-001
[CC_PART2] Common Criteria for Information Technology Security Evaluation – Part 2: Security
functional components, dated September 2012, version 3.1, Revision 4, CCMB-2012-009-
002
[CC_PART3] Common Criteria for Information Technology Security Evaluation – Part 3: Security
assurance components, dated September 2012, version 3.1, Revision 4, CCMB-2012-009-
003
[CEM] Common Methodology for Information Technology Security Evaluation – Evaluation
Methodology, dated September 2012, version 3.1, Revision 4, CCMB-2012-009-004
[NDPP] U.S. Government Protection Profile for Security Requirements for Network Devices,
version 1.1, June 8, 2012
[ERRATA#3] Security Requirements for Network Devices Errata #3, 3 November 2014
[800-38A] NIST Special Publication 800-38A Recommendation for Block 2001 Edition
Recommendation for Block Cipher Modes of Operation Methods and Techniques December
2001
[800-56A] NIST Special Publication 800-56A, March, 2007
Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm
Cryptography (Revised)
[800-56B] NIST Special Publication 800-56B Recommendation for Pair-Wise, August 2009
Key Establishment Schemes Using Integer Factorization Cryptography
[FIPS 140-2] FIPS PUB 140-2 Federal Information Processing Standards Publication
Security Requirements for Cryptographic Modules May 25, 2001
[FIPS PUB 186-2] FIPS PUB 186-2 Federal Information Processing Standards Publication 2000 January 27
[FIPS PUB 186-3] FIPS PUB 186-3 Federal Information Processing Standards Publication Digital Signature
Standard (DSS) June, 2009
[FIPS PUB 198-1] Federal Information Processing Standards Publication The Keyed-Hash Message
Authentication Code (HMAC) July 2008
[800-90] NIST Special Publication 800-90A Recommendation for Random Number Generation
Using Deterministic Random Bit Generators January 2012
[FIPS PUB 180-3] FIPS PUB 180-3 Federal Information Processing Standards Publication Secure Hash
Standard (SHS) October 2008