Cisco Catalyst 3560-X and 3750-X Switches
FIPS 140-2 Level 2
Non-Proprietary Security Policy
Overall Level 2 Validation
Version 0.54
April 25, 2012
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
2
Introduction......................................................................................................................... 3
References....................................................................................................................... 3
FIPS 140-2 Submission Package .................................................................................... 4
Module Description ............................................................................................................ 5
Module Validation Level................................................................................................ 5
Cryptographic Boundary..................................................................................................... 6
Cryptographic Module Ports and Interfaces ....................................................................... 6
Roles, Services, and Authentication ................................................................................... 8
User Role ........................................................................................................................ 8
CO Role .......................................................................................................................... 9
Services........................................................................................................................... 9
Cryptographic Key/CSP Management.............................................................................. 11
Cryptographic Algorithms ................................................................................................ 13
Approved Cryptographic Algorithms ........................................................................... 13
Non-Approved Algorithms ........................................................................................... 14
Self-Tests ...................................................................................................................... 14
Physical Security............................................................................................................... 16
Module Opacity ............................................................................................................ 16
Tamper Evidence .......................................................................................................... 17
Secure Operation............................................................................................................... 19
Initial Setup................................................................................................................... 19
System Initialization and Configuration....................................................................... 19
Remote Access.............................................................................................................. 20
Related Documentation..................................................................................................... 21
Obtaining Documentation................................................................................................. 21
Cisco.com...................................................................................................................... 21
Product Documentation DVD....................................................................................... 21
Ordering Documentation .............................................................................................. 22
Documentation Feedback ................................................................................................. 22
Cisco Product Security Overview..................................................................................... 22
Reporting Security Problems in Cisco Products........................................................... 23
Obtaining Technical Assistance........................................................................................ 23
Cisco Technical Support & Documentation Website ................................................... 23
Submitting a Service Request....................................................................................... 24
Definitions of Service Request Severity....................................................................... 24
Obtaining Additional Publications and Information......................................................... 25
Definition List................................................................................................................... 26
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
3
Introduction
This is a non-proprietary Cryptographic Module Security Policy for the Cisco Catalyst
3560-X and 3750-X Switches; referred to in this document as the modules or switches.
This security policy describes how the modules meet the security requirements of FIPS
140-2 and how to run the modules in a FIPS 140-2 mode of operation and may be freely
distributed.
Models:
• 3560-X and 3750-X switches
o WS-C3560X-24P
o WS-C3560X-24T
o WS-C3560X-48P
o WS-C3560X-48PF
o WS-C3560X-48T
o WS-C3750X-12S
o WS-C3750X-24P
o WS-C3750X-24S
o WS-C3750X-24T
o WS-C3750X-48P
o WS-C3750X-48PF
o WS-C3750X-48T
• With Field Replaceable Uplink (FRUlink) Modules1
:
o C3KX-NM-1G
o C3KX-NM-10G
o C3KX-NM-BLANK
o C3KX-NM-10GT
• IOS version 15.0(1)SE2
References
This document deals only with operations and capabilities of the module in the technical
terms of a FIPS 140-2 cryptographic module security policy. More information is
available on the module from the following sources:
• The Cisco Systems website (http://www.cisco.com) contains information on the
full line of products from Cisco Systems.
• The NIST Cryptographic Module Validation Program website
(http://csrc.nist.gov/groups/STM/cmvp/index.html) contains contact information
for answers to technical or sales-related questions for the module.
• FIPS 140-2 (Federal Information Processing Standards Publication 140-2 —
Security Requirements for Cryptographic Modules) details the U.S. Government
requirements for cryptographic modules. More information about the FIPS 140-2
11
The FRUlink modules implement no FIPS 140-2 security functions and are considered equivalent for the
purposes of this security policy with the exception of physical security opacity requirements.
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
4
standard and validation program is available on the NIST website at
http://csrc.nist.gov/groups/STM/cmvp/index.html.
FIPS 140-2 Submission Package
The security policy document is one document in a FIPS 140-2 Submission Package. In
addition to this document, the submission package includes:
• Vendor Evidence
• Finite State Machine
• Other supporting documentation as additional references
With the exception of this non-proprietary security policy, the FIPS 140-2 validation
documentation is proprietary to Cisco Systems, Inc. and is releasable only under
appropriate non-disclosure agreements. For access to these documents, please contact
Cisco Systems, Inc. See “Obtaining Technical Assistance” section for more information.
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
5
Module Description
Cisco Catalyst 3750-X and 3650-X Series Switches are enterprise-class stackable
switches that provide high availability, scalability, security, energy efficiency, and ease
of operation with innovative features such as Cisco StackPower, Power over Ethernet
Plus (PoE+), optional network modules, redundant power supplies, and MAC security.
The Catalyst 3750-X and 3650-X Series Switches meet FIPS 140-2 overall Level 2
requirements as multi-chip standalone modules.
The switches include cryptographic algorithms implemented in IOS software as well as
hardware ASICs. The module provides 802.1X-rev with MACSec and MACSec Key
Agreement (MKA), RADIUS, TACACS+, HTTPS, SNMPv3 and SSHv2. The module
implements Layer 2 MACsec / IEEE 802.1AE on the downlink ports using a hardware
cryptographic implementation (MACsec PHY) of AES-GCM. The module’s IOS
software implements 128 bit AES-CBC, CTR-DRBG, SHA-1, HMAC-SHA-1 and RSA.
Media Access Control Security (MACsec), defined in 802.1AE, provides MAC-layer
encryption over wired networks by using out-of-band methods for encryption keying. The
MACsec Key Agreement (MKA) Protocol provides the required session keys and
manages the required encryption keys. MKA and MACsec are implemented after
successful key establishment using the 802.1x Extensible Authentication Protocol (EAP)
framework.
Module Validation Level
The following table lists the level of validation for each area in the FIPS PUB 140-2.
Table 1: Module Validation Level
No. Area Title Level
1 Cryptographic Module Specification 2
2 Cryptographic Module Ports and Interfaces 2
3 Roles, Services, and Authentication 2
4 Finite State Model 2
5 Physical Security 2
6 Operational Environment N/A
7 Cryptographic Key management 2
8 Electromagnetic Interface/Electromagnetic Compatibility 2
9 Self-Tests 2
10 Design Assurance 2
11 Mitigation of Other Attacks N/A
Overall Overall module validation level 2
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
6
Cryptographic Boundary
The cryptographic boundary for the switches is defined as encompassing the "top,"
"front," "left," "right," “back,” and "bottom" surfaces of the chassis; including the opacity
shields.
Cryptographic Module Ports and Interfaces
Each module provides a number of physical and logical interfaces to the device, and the
physical interfaces provided by the module are mapped to four FIPS 140-2 defined
logical interfaces: data input, data output, control input, and status output. The module
also supports a power interface.
The following table identifies the differences between the models of switches covered by
this Security Policy:
Table 2 - Model Physical Ports
Model MACsec
1G
Ethernet
Ports
StackWise
Ports
Console Port AC Power
Supply
Rating
PoE Power
WS-C3560X-24P 24 N/A 1 715W 370W
WS-C3560X-24T 24 N/A 1 350W N/A
WS-C3560X-48P 48 N/A 1 715W 370W
WS-C3560X-48PF 48 N/A 1 1100W 740W
WS-C3560X-48T 48 N/A 1 350W N/A
WS-C3750X-12S 12 2 1 350 W N/A
WS-C3750X-24P 24 2 1 715W 370W
WS-C3750X-24S 24 2 1 350 W N/A
WS-C3750X-24T 24 2 1 350W N/A
WS-C3750X-48P 48 2 1 715W 370W
WS-C3750X-48PF 48 2 1 1100W 740W
WS-C3750X-48T 48 2 1 350W N/A
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
7
The following table identifies the physical ports on the FRUlink modules:
Table 3 - FRUlink Physical Ports
Model 1G SFP Ports 10G SFP+
Ports
C3KX-NM-1G 4 0
C3KX-NM-10G 0 2
C3KX-NM-10GT 0 2
C3KX-NM-
BLANK
N/A N/A
The logical interfaces and their mapping to physical ports are described in the following
table:
Table 4: Physical To Logical Interfaces
Physical Interface Logical Interface
MACsec 1G Ethernet Ports,
FRUlink 1G SFP Ports,
FRUlink 10G SFP+ Ports
Stackwise+ ports (only on 3750-x
models)
Type A USB port
Console Port (RJ45 and USB Type
B)
Mgmt Port
Data Input Interface
MACsec 1G Ethernet Ports,
FRUlink 1G SFP Ports,
FRUlink 10G SFP+ Ports
Stackwise+ ports (only on 3750-x
models)
Type A USB port
Console Port (RJ45 and USB Type
B)
Mgmt Port
Data Output Interface
Console Port (RJ45 and USB Type
B),
Mgmt Port
MACsec 1G Ethernet Ports,
FRUlink 1G SFP Ports,
FRUlink 10G SFP+ Ports
Control Input Interface
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
8
Stackwise+ ports (only on 3750-x
models),
Reset Button
Console Port (RJ45 and USB Type
B)
Mgmt Port
Type A USB port
MACsec 1G Ethernet Ports,
FRUlink 1G SFP Ports,
FRUlink 10G SFP+ Ports,
LEDs
Stackwise+ ports (only on 3750-x
models),
Status Output Interface
Power Plug,
PoE+ Ethernet Ports
Stackwise+ ports (only on 3750-x
models)
Power Interface
Roles, Services, and Authentication
Authentication is role-based. Each user is authenticated upon initial access to the module.
There are two roles in the Switch that may be assumed the Crypto Officer (CO) role and
the User role. The administrator of the Switch assumes the CO role in order to configure
and maintain the Switch using CO services, while the Users exercise security services
over the network.
User Role
The role assumed by users obtaining general security services. From a logical view, user
activity exists in the data-plane. Users are authenticated using EAP methods and 802.1X-
REV, and their data is protected with 802.1AE protocols.
EAP and 802.1X-REV can use password based credentials for User role authentication –
in such a case the user passwords must be at least eight (8) characters long, including at
least one letter and at least one number character, in length (enforced procedurally). If six
(6) integers, one (1) special character and one (1) alphabet are used without repetition for
an eight (8) digit PIN, the probability of randomly guessing the correct sequence is one
(1) in 832,000,000. In order to successfully guess the sequence in one minute would
require the ability to make over 13,000,000 guesses per second, which far exceeds the
operational capability of the console port. Including the rest of the alphanumeric
characters drastically decreases the odds of guessing the correct sequence.
EAP and 802.1X-REV can also authenticate User role via certificate credentials by using
1024 bit RSA keys – in such a case the security strength is 80 bits, so an attacker would
have a 1 in 280
chance of a successful authentication which is much stronger than the one
in a million chance required by FIPS 140-2. To exceed a one in 100,000 probability of a
successful random key guess in one minute, an attacker would have to be capable of
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
9
approximately 1.8 x 1021
attempts per minute, which vastly exceeds the operational
capabilities of the module to support.
CO Role
The role assumed by an authorized CO connecting to the switch via CLI through the
console port and performing management functions and module configuration.
Additionally the stack master (in stacking scenario for 3750-X switches) is considered
CO for stack members. From a logical view, CO activity exists only in the control plane.
IOS prompts the CO for their username and password, if the password is validated
against the CO’s password in IOS memory, the user is allowed entry to the IOS executive
program. A CO can assign permission to access the CO role to additional accounts,
thereby creating additional COs. The module supports RADIUS and TACACS+ for
authentication of COs.
CO passwords must be at least eight (8) characters long, including at least one letter and
at least one number character, in length (enforced procedurally). If six (6) integers, one
(1) special character and one (1) alphabet are used without repetition for an eight (8) digit
PIN, the probability of randomly guessing the correct sequence is one (1) in 832,000,000.
In order to successfully guess the sequence in one minute would require the ability to
make over 13,000,000 guesses per second, which far exceeds the operational capability
of the console port. Including the rest of the alphanumeric characters drastically
decreases the odds of guessing the correct sequence.
Additionally on a stack, the CO is authenticated via possession of SESA Authorization
key that is 128 bits long. So an attacker would have a 1 in 2128
chance of a successful
authentication which is much stronger than the one in a million chance required by FIPS
140-2. To exceed a one in 100,000 probability of a successful random key guess in one
minute, an attacker would have to be capable of approximately 3.4 x 1038
attempts per
minute, which vastly exceeds the operational capabilities of the module to support.
Services
Table 5 - Services
Role Authentication
Method
Services
User EAP and 802.1X-
REV
Authentication,
Local database,
TACACS+ or
RADIUS
MACsec Network Functions: authentication, access control,
confidentiality and data integrity services provided by the
MACsec protocol.
Cryptographic
Officer
Local database,
TACACS+ or
RADIUS, SESA
Configure the switch: define network interfaces and settings,
create command aliases, set the protocols the switch will
support, enable interfaces and network services, set system date
and time, and load authentication information.
Management protocols: remote access to the switch via TLS or
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
10
SSH.
Status functions: view the switch configuration, routing tables,
and active sessions; view health, temperature, memory status,
voltage, and packet statistics; review accounting logs, and view
physical interface status.
Set Encryption/Bypass: Place module into Encryption or Bypass
state.
Perform Self Tests: Perform the FIPS 140 start-up tests on
demand
Unauthenticated N/A Show status (viewing LEDs), passing traffic through the device,
power-cycling the device.
Perform Self Tests: occurs upon system startup
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
11
Cryptographic Key/CSP Management
The module securely administers both cryptographic keys and other critical security
parameters such as passwords. The tamper evidence seals provide physical protection for
all keys. All keys are also protected by the password-protection on the CO role login, and
can be zeroized by the CO. Keys are exchanged and entered electronically. Persistent
keys are entered by the CO via the console port CLI, transient keys are generated or
established and stored in DRAM.
Note that the command fips zeroize all will zeroize all CSPs.
The module supports the following secret and private keys and critical security
parameters (CSPs):
Table 6 – Secret and private keys and CSPs
ID Algorithm Size Description Storage
Zeroization
Method
General Keys/CSPs
User
Password
Password Variable (8+
characters)
Used to authenticate
local users
NVRAM
(plaintext)
Zeroized by
overwriting
with new
password
Enable
Password
Password Variable (8+
characters)
Used to authenticate
local users at a higher
privilege level
NVRAM
(plaintext)
Zeroized by
overwriting
with new
password
RADIUS
secret
Shared
Secret
Variable (8+
characters)
The RADIUS Shared
Secret
NVRAM
(plaintext)
# no radius‐
server key
RADIUS Key
wrap key
AES 128/256 bits Used to protect SAK DRAM
(plaintext)
Zeroized when
data structure
is freed
TACACS+
secret
Shared
Secret
Variable (8+
characters)
The TACACS+ shared
secret
NVRAM
(plaintext)
# no tacacs‐
server key
RNG Seed ANSI X9.31
Appendix
2.4 using 3‐
key TDES
16 bytes This is the seed for
ANSI X9.31 RNG
DRAM
(plaintext)
power cycle
the device
RNG Seed
Key
ANSI X9.31
Appendix
2.4 using 3‐
key TDES
24 bytes This is the seed key for
ANSI X9.31 RNG
DRAM
(plaintext)
power cycle
the device
Diffie‐
Hellman
private
exponent
DH 1024‐4096 bits The private exponent
used in Diffie‐Hellman
(DH) exchange.
DRAM
(plaintext)
Automatically
after shared
secret
generated.
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
12
Diffie‐
Hellman
Shared
Secret
DH 1024‐4096 bits This is the shared
secret agreed upon as
part of DH exchange
DRAM
(plaintext0
Zeroized upon
deletion
SSH
SSH RSA
private key
RSA 1024/1536/20
48 bits
modulus
SSH key NVRAM
(plaintext)
# fips zeroize
all
SSH session
key
Triple‐
DES/AES
168‐bits/256‐
bits
This is the SSH session
symmetric key.
DRAM
(plaintext)
Automatically
when SSH
session
terminated
SSH session
authenticati
on key
HMAC SHA‐
1
160‐bits This is the SSH session
authentication key
DRAM
(plaintext)
Automatically
when SSH
session
terminated
TLS
TLS Server
RSA private
key
RSA 1024/1536/20
48 bits
modulus
Identity certificates for
module itself and also
used in TLS
negotiations.
NVRAM
(plaintext)
# fips zeroize
all
TLS pre‐
master
secret
Shared
Secret
384‐bits Shared secret created
using asymmetric
cryptography from
which new HTTPS
session keys can be
created.
DRAM
(plaintext)
Automatically
when session
terminated.
TLS session
key
Triple‐
DES/AES
168‐bits/256‐
bits
This is the TLS session
key
DRAM
(plaintext)
Automatically
when session
terminated.
MacSec
MACsec
Security
Association
Key (SAK)
AES‐GCM 128/256 bits Used for creating
Security Associations
(SA) for
encrypting/decrypting
the MACSec traffic in
the MACSec hardware.
MACsec PHY
(plaintext)
Automatically
when session
expires
MACsec
Connectivity
Association
Key (CAK)
AES‐GCM 128/256 bits A secret key possessed
by members of a
MACSec connectivity
association.
MACsec PHY
(plaintext)
Automatically
when session
expires
MACsec
KEK
AES‐GCM 128/256 bits Used to transmit SAKs
to other members of a
MACSec connectivity
association
MACsec PHY
(plaintext)
Automatically
when session
expires
MACsec
ICK
secret 128/256 bits Used to verify the
integrity and
authenticity of MPDUs
MACsec PHY
(plaintext)
Automatically
when session
expires
SESA
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
13
SESA
Authorizatio
n Key
AES 128 bits Used to authorize
members of a single
stack on Incredible
Units.
Used as input to
SP800‐108 derivation
methods to derive
four additional 128
fields to transfer the
Master Session Key
and additional
aggressive exchange
material
NVRAM
(plaintext)
“no fips
authorization‐
key”
SESA
Master
Session Key
AES 128 bits Used to derive SESA
session key
DRAM
(plaintext)
Upon
completion of
key exchange
SESA
Derived
Session Keys
AES and
HMAC‐
SHA‐1
128 bits and
192 bits
Used to protect traffic
over stacking ports
DRAM
(plaintext)
Upon bringing
down the stack
The services accessing the CSPs, the type of access and which role accesses the CSPs are
listed below.
Table 7: Role CSP Access
Role Service Critical Security Parameters
User Role MACsec Network Functions RNG Seed, RNG Seed key, DH private
exponent, DH Shared Secret MACsec Security
Association Key, MACsec Connectivity
Association Key, MACsec KEK, MACsec ICK (X)
Crypto‐Officer Role Manage the Switch TLS Server RSA private key, SSH RSA private
key, RADIUS secret, TACACS+ secret, RADIUS
key wrap key, User Password, Enable
Password, SESA Authorization Key (R/W/D)
Crypto‐Officer Role Management Protocols TLS Server RSA private key, TLS pre‐master
secret, TLS session key, SSH RSA private key,
SSH session key, RADIUS secret, TACACS+
secret, SESA Master Session Key, SESA
Derived Session key (X)
R=Read, W=Write, D=Zeroize, X=Execute
Cryptographic Algorithms
Approved Cryptographic Algorithms
The Cisco Switches support many different cryptographic algorithms. However, only
FIPS approved algorithms may be used while in the FIPS mode of operation. The
following table identifies the approved algorithms included in the Switches for use in the
FIPS mode of operation.
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
14
Table 8: FIPS-Approved Algorithms for use in FIPS Mode
Algorithm Modes Implementation CAVP Certificate
AES CBC
GCM
CBC – IOS Software
ECB – MACsec PHY
GCM – MACsec PHY
1749
1024
1275
HMAC SHA‐1 IOS Software 1026
RNG X9.31, 3‐
Key Triple‐
DES
IOS Software 932
RSA Sign
Verify
PKCS #1, v1.5, 1024‐2048 mod size,
SHA‐1, SHA‐256, SHA‐512 ‐ IOS
software
869
SHS SHA‐1,
SHA‐256,
SHA‐512
IOS Software 1536
Triple‐DES CBC IOS Software 1133
Non-Approved Algorithms
The cryptographic module implements the following non-approved algorithms that are
not permitted for use in FIPS 140-2 mode of operations:
• DES
• HMAC-MD5
• MD5
• RC4
In addition, the modules support the following key establishment schemes allowed in
FIPS mode:
• Diffie-Hellman (key agreement; key establishment methodology provides
between 80 and 156 bits of encryption strength).
• RSA (key wrapping; key establishment methodology provides between 80 and
112 bits of encryption strength)
• AES (Cert. #1749, key wrapping; key establishment methodology provides 128
bits or 256 bits of encryption strength)
Self-Tests
The modules include an array of self-tests that are run during startup and periodically
during operations to prevent any secure data from being released and to ensure all
components are functioning correctly. The modules implement the following power-on
self-tests:
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
15
• IOS Known Answer Tests:
o AES KAT
o AES-CMAC KAT
o HMAC-SHA-1 KAT
o RNG KAT
o SHA-1/SHA-256/SHA-512 KAT
o RSA (sign/verify) KAT
o Triple-DES KAT
• MAC PHY crypto Known Answer Tests:
o AES-GCM KAT
• Firmware Integrity Test (32-bit EDC)
The modules perform all power-on self-tests automatically at boot. All power-on self-
tests must be passed before any operator can perform cryptographic services. The power-
on self-tests are performed after the cryptographic systems are initialized but prior any
other operations; this prevents the module from passing any data during a power-on self-
test failure.
In addition, the modules also provide the following conditional self-tests:
• Continuous Random Number Generator Test for the FIPS-approved RNG
• Continuous Random Number Generator Test for the non-approved RNG
• Pairwise Consistency Test for generation of RSA keys
• Conditional Bypass Test
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
16
Physical Security
This module is a multi-chip standalone cryptographic module.
The FIPS 140-2 level 2 physical security requirements for the modules are met by the use
of opacity shields covering the front and side panels of modules to provide the required
opacity and tamper evident seals to provide the required tamper evidence. The following
sections illustrate the physical security provided by the module.
The following table shows the number of tamper evident labels and opacity shields that
shall be shall be installed for the module to operate in a FIPS approved mode of
operation. The CO is responsible for securing and having control at all times of any
unused tamper evident labels.
Table 9 - Tamper Evident Labels and Opacity Shields – All Models
Face Tamper Evident
Labels
Opacity Shields
Front 5 22
Left 6 2
Right 6 2
Back 5 N/A
Total 22 6
Module Opacity
To install an opacity shield on the Catalyst 3560-X and 3750-X switches, follow these
steps:
1. Open the FIPS kit (part number: FIPS Kit (C3KX-FIPS-KIT)). The kit contains:
a. Opacity shields for front and sides
b. Tamper evident labels
2. Apply the opacity shields as per the diagram below
2
WS-C3750X-12S and WS-C3750X-24S modules do not need opacity shields on the front face
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
17
Figure 1 - Opacity Shields3
Tamper Evidence
Once the module has been configured to meet overall FIPS 140-2 Level 2 requirements,
the module cannot be accessed without signs of tampering. The CO shall inspect for signs
of tampering periodically.
To seal the system, apply serialized tamper-evidence labels as depicted in the figures
below. This label placement is applicable to all models included in this validation.
3
WS-C3750X-12S and WS-C3750X-24S modules do not need opacity shields on the front face
6 7 8
9 10 11
1 2
3 4 5
Figure 2 - Front face
Figure 3 - Right side
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
18
4
4
TEL #20 is used to protect the power supply unit
12 13 14
15 16 17
18 19 20 21
22
Figure 4 - Left side
Figure 5 - Rear face4
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
19
Secure Operation
The switches meet all the overall Level 2 requirements for FIPS 140-2. Follow the setup
instructions provided below to place the module in FIPS-approved mode. Operating this
Switch without maintaining the following settings will remove the module from the FIPS
approved mode of operation.
Initial Setup
1. The CO must apply opacity shield and tamper evidence labels as described above.
System Initialization and Configuration
1. The value of the boot field must be 0x0102. This setting disables break from the
console to the ROM monitor and automatically boots. From the “configure terminal”
command line, the CO enters the following syntax:
config-register 0xF
2. The CO must create the “enable” password for the CO role. Procedurally, the
password must be at least 8 characters, including at least one letter and at least one
number, and is entered when the CO first engages the “enable” command. The CO
enters the following syntax at the “#” prompt:
Switch(config)# enable secret [PASSWORD]
3. The CO must always assign passwords (of at least 8 characters, including at least one
letter and at least one number) to users. Identification and authentication on the
console/auxiliary port is required for Users. From the “configure terminal” command
line, the CO enters the following syntax:
Switch(config)# line con 0
Switch(config)# password [PASSWORD]
Switch(config)# login local
4. To ensure all FIPS 140-2 logging is received, set the log level:
Switch(config)# logging console error
5. The CO enables secure stacking (SESA) but configuring the Authorization key:
Switch(config)# fips authorization-key <128 bit, i.e, 16 hex byte key>
6. The CO may configure the module to use RADIUS or TACACS+ for authentication.
If the module is configured to use RADIUS, the Crypto-Officer must define RADIUS
or shared secret keys that are at least 8 characters long, including at least one letter
and at least one number.
7. To enable MACsec:
a. First configure the MKA Protocol:
Switch(config)# mka policy policy-name
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
20
Switch(config-mka-policy)# replay-protection window-size 300
Switch(config-mka-policy)# end
b. Then configure MACsec on the desired interfaces:
Switch(config-if)# macsec
Switch(config-if)# authentication host-mode multi-domain
Switch(config-if)# authentication linksec policy must-secure
Switch(config-if)# authentication port-control auto
Switch(config-if)# authentication violation protect
Switch(config-if)# mka policy policy-name
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# end
8. Firmware update is not allowed in FIPS mode.
9. The CO shall only assign users to a privilege level 1 (the default).
10. The CO shall not assign a command to any privilege level other than its default.
Remote Access
1. Remote access is permitted via SSHv2 and TLS. While in FIPS 140-2 Mode of
Operations the switches will enforce use of Approved algorithms for the management
protocols.
2. SNMPv3 is allowed in FIPS mode of operation. SNMPv3 uses FIPS approved
cryptographic algorithms however from a FIPS perspective SNMPv3 is considered to
be a plaintext session since the key derivation used as by SNMPv3 is not FIPS
compliant.
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
21
Related Documentation
This document deals only with operations and capabilities of the security appliances in
the technical terms of a FIPS 140-2 cryptographic device security policy. More
information is available on the security appliances from the sources listed in this section
and from the following source:
• The NIST Cryptographic Module Validation Program website
(http://csrc.nist.gov/groups/STM/cmvp/index.html) contains contact information
for answers to technical or sales-related questions for the security appliances.
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also
provides several ways to obtain technical assistance and other technical resources. These
sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/techsupport
You can access the Cisco website at this URL:
http://www.cisco.com
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Product Documentation DVD
Cisco documentation and additional literature are available in the Product Documentation
DVD package, which may have shipped with your product. The Product Documentation
DVD is updated regularly and may be more current than printed documentation.
The Product Documentation DVD is a comprehensive library of technical product
documentation on portable media. The DVD enables you to access multiple versions of
hardware and software installation, configuration, and command guides for Cisco
products and to view technical documentation in HTML. With the DVD, you have access
to the same documentation that is found on the Cisco website without being connected to
the Internet. Certain products also have .pdf versions of the documentation available.
The Product Documentation DVD is available as a single unit or as a subscription.
Registered Cisco.com users (Cisco direct customers) can order a Product Documentation
DVD (product number DOC-DOCDVD=) from Cisco Marketplace at this URL:
http://www.cisco.com/go/marketplace/
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
22
Ordering Documentation
Beginning June 30, 2005, registered Cisco.com users may order Cisco documentation at
the Product Documentation Store in the Cisco Marketplace at this URL:
http://www.cisco.com/go/marketplace/
Nonregistered Cisco.com users can order technical documentation from 8:00 a.m. to 5:00
p.m. (0800 to 1700) PDT by calling 1 866 463-3487 in the United States and Canada, or
elsewhere by calling 011 408 519-5055. You can also order documentation by e-mail at
tech-doc-store-mkpl@external.cisco.com or by fax at 1 408 519-5001 in the United
States and Canada, or elsewhere at 011 408 519-5001.
Documentation Feedback
You can rate and provide feedback about Cisco technical documents by completing the
online feedback form that appears with the technical documents on Cisco.com.
You can send comments about Cisco documentation to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover
of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate your comments.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
From this site, you can perform these tasks:
• Report security vulnerabilities in Cisco products.
• Obtain assistance with security incidents that involve Cisco products.
• Register to receive security information from Cisco.
A current list of security advisories and notices for Cisco products is available at this
URL:
http://www.cisco.com/go/psirt
If you prefer to see advisories and notices as they are updated in real time, you can access
a Product Security Incident Response Team Really Simple Syndication (PSIRT RSS)
feed from this URL:
http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
23
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before
we release them, and we strive to correct all vulnerabilities quickly. If you think that you
might have identified a vulnerability in a Cisco product, contact PSIRT:
• Emergencies — security-alert@cisco.com
An emergency is either a condition in which a system is under active attack or a condition
for which a severe and urgent security vulnerability should be reported. All other
conditions are considered nonemergencies.
• Nonemergencies — psirt@cisco.com
In an emergency, you can also reach PSIRT by telephone:
• 1 877 228-7302
• 1 408 525-6532
Tip
We encourage you to use Pretty Good Privacy (PGP) or a compatible product to encrypt
any sensitive information that you send to Cisco. PSIRT can work from encrypted
information that is compatible with PGP versions 2.x through 8.x. Never use a revoked or
an expired encryption key. The correct public key to use in your correspondence with
PSIRT is the one linked in the Contact Summary section of the Security Vulnerability
Policy page at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
The link on this page has the current PGP key ID in use.
Obtaining Technical Assistance
Cisco Technical Support provides 24-hour-a-day award-winning technical assistance.
The Cisco Technical Support & Documentation website on Cisco.com features extensive
online support resources. In addition, if you have a valid Cisco service contract, Cisco
Technical Assistance Center (TAC) engineers provide telephone support. If you do not
have a valid Cisco service contract, contact your reseller.
Cisco Technical Support & Documentation Website
The Cisco Technical Support & Documentation website provides online documents and
tools for troubleshooting and resolving technical issues with Cisco products and
technologies. The website is available 24 hours a day, at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support & Documentation website requires a
Cisco.com user ID and password. If you have a valid service contract but do not have a
user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Note
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
24
Use the Cisco Product Identification (CPI) tool to locate your product serial number
before submitting a web or phone request for service. You can access the CPI tool from
the Cisco Technical Support & Documentation website by clicking the Tools &
Resources link under Documentation & Tools. Choose Cisco Product Identification
Tool from the Alphabetical Index drop-down list, or click the Cisco Product
Identification Tool link under Alerts & RMAs. The CPI tool offers three search options:
by product ID or model name; by tree view; or for certain products, by copying and
pasting show command output. Search results show an illustration of your product with
the serial number label location highlighted. Locate the serial number label on your
product and record the information before placing a service call.
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service
requests. (S3 and S4 service requests are those in which your network is minimally
impaired or for which you require product information.) After you describe your
situation, the TAC Service Request Tool provides recommended solutions. If your issue
is not resolved using the recommended resources, your service request is assigned to a
Cisco engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco
TAC by telephone. (S1 or S2 service requests are those in which your production
network is down or severely degraded.) Cisco engineers are assigned immediately to S1
and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)EMEA: +32 2 704 55 55USA:
1 800 553-2447
For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established
severity definitions.
Severity 1 (S1) – Your network is “down,” or there is a critical impact to your
business operations. You and Cisco will commit all necessary resources around
the clock to resolve the situation.
Severity 2 (S2) – Operation of an existing network is severely degraded, or
significant aspects of your business operation are negatively affected by
inadequate performance of Cisco products. You and Cisco will commit full-time
resources during normal business hours to resolve the situation.
Severity 3 (S3) – Operational performance of your network is impaired, but most
business operations remain functional. You and Cisco will commit resources
during normal business hours to restore service to satisfactory levels.
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
25
Severity 4 (S4) – You require information or assistance with Cisco product
capabilities, installation, or configuration. There is little or no effect on your
business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from
various online and printed sources.
• Cisco Marketplace provides a variety of Cisco books, reference guides,
documentation, and logo merchandise. Visit Cisco Marketplace, the company
store, at this URL:
http://www.cisco.com/go/marketplace/
• Cisco Press publishes a wide range of general networking, training and
certification titles. Both new and experienced users will benefit from these
publications. For current Cisco Press titles and other information, go to Cisco
Press at this URL:
http://www.ciscopress.com
• Packet magazine is the Cisco Systems technical user magazine for maximizing
Internet and networking investments. Each quarter, Packet delivers coverage of
the latest industry trends, technology breakthroughs, and Cisco products and
solutions, as well as network deployment and troubleshooting tips, configuration
examples, customer case studies, certification and training information, and links
to scores of in-depth online resources. You can access Packet magazine at this
URL:
http://www.cisco.com/packet
• iQ Magazine is the quarterly publication from Cisco Systems designed to help
growing companies learn how they can use technology to increase revenue,
streamline their business, and expand services. The publication identifies the
challenges facing these companies and the technologies to help solve them, using
real-world case studies and business strategies to help readers make sound
technology investment decisions. You can access iQ Magazine at this URL:
http://www.cisco.com/go/iqmagazine
• or view the digital edition at this URL:
http://ciscoiq.texterity.com/ciscoiq/sample/
• Internet Protocol Journal is a quarterly journal published by Cisco Systems for
engineering professionals involved in designing, developing, and operating public
and private internets and intranets. You can access the Internet Protocol Journal at
this URL:
http://www.cisco.com/ipj
• Networking products offered by Cisco Systems, as well as customer support
services, can be obtained at this URL:
© Copyright 2011 Cisco Systems, Inc.
This document may be freely reproduced and distributed whole and intact including this Copyright Notice.
26
http://www.cisco.com/en/US/products/index.html
• Networking Professionals Connection is an interactive website for networking
professionals to share questions, suggestions, and information about networking
products and technologies with Cisco experts and other networking professionals.
Join a discussion at this URL:
http://www.cisco.com/discuss/networking
• World-class networking training is available from Cisco. You can view current
offerings at this URL:
http://www.cisco.com/en/US/learning/index.html
Definition List
AES – Advanced Encryption Standard
CMVP – Cryptographic Module Validation Program
CSEC – Communications Security Establishment Canada
CSP – Critical Security Parameter
FIPS – Federal Information Processing Standard
HMAC – Hash Message Authentication Code
HTTP – Hyper Text Transfer Protocol
KAT – Known Answer Test
LED – Light Emitting Diode
MAC – Message Authentication Code
MACsec – IEEE MAC Security protocol 802.1AE
NIST – National Institute of Standards and Technology
NVRAM – Non-Volatile Random Access Memory
PoE+ – Power over Ethernet Plus
RAM – Random Access Memory
RNG – Random Number Generator
SHA – Secure Hash Algorithm
Triple-DES – Triple Data Encryption Standard