Cisco ISR 4000 series Manual de usuario

Cisco Integrated Services Routers (ISR) 4000 Family

CC Configuration Guide

Version 0.2

May 22, 2017

Cisco ISR 4000 Family Routers Administrator Guidance

Page 2of 66

Table of Contents

1. Introduction 7

1.1 Audience 7

1.2 Purpose 7

1.3 Document References 7

1.4 Supported Hardware and Software 9

1.5 Operational Environment 9

1.5.1 Supported non-TOE Hardware/ Software/ Firmware 9

1.6 Excluded Functionality 10

2. Secure Acceptance of the TOE 11

3. Secure Installation and Configuration 14

3.1 Physical Installation 14

3.2 Initial Setup via Direct Console Connection 14

3.2.1 Options to be chosen during the initial setup of the ISR 4000 Family Routers 14

3.2.2 Saving Configuration 15

3.2.3 Enabling FIPS Mode 15

3.2.4 Administrator Configuration and Credentials 15

3.2.5 Session Termination 16

3.2.6 User Lockout 16

3.3 Network Protocols and Cryptographic Settings 17

3.3.1 Remote Administration Protocols 17

3.3.2 Authentication Server Protocols 19

3.3.3 Logging Configuration 19

3.3.4 Usage of Embedded Event Manager 20

3.3.5 Logging Protection 21

3.3.6 Base Firewall Rule set Configuration 23

3.3.7 Routing Protocols 25

3.3.8 MACSEC and MKA Configuration 25

4. Secure Management 26

4.1 User Roles 26

4.2 Passwords 26

4.3 Clock Management 29

Cisco ISR 4000 Family Routers Administrator Guidance

Page 3of 66

4.4 Identification and Authentication 29

4.5 Login Banners 29

4.6 Virtual Private Networks (VPN) 29

4.6.1 IPsec Overview 29

4.6.2 IPsec Transforms and Lifetimes 34

4.6.3 NAT Traversal 35

4.6.4 X.509 Certificates 35

4.6.5 Information Flow Policies 40

4.7 Product Updates 40

Configure Reference Identifier 40

5. Security Relevant Events 43

5.1 Deleting Audit Records 57

6. Network Services and Protocols 59

7. Modes of Operation 62

8. Security Measures for the Operational Environment 64

9. Obtaining Documentation and Submitting a Service Request 65

9.1 Documentation Feedback 65

9.2 Obtaining Technical Assistance 65

Cisco ISR 4000 Family Routers Administrator Guidance

Page 4of 66

List of Tables

Table 1 Acronyms.......................................................................................................................... 5

Table 2 Cisco Documentation........................................................................................................ 7

Table 3 IT Environment Components............................................................................................ 9

Table 4 Excluded Functionality................................................................................................... 10

Table 5 TOE External Identification............................................................................................ 11

Table 6 Evaluated Software Images ............................................................................................ 13

Table 7 General Auditable Events............................................................................................... 44

Table 8 Auditable Administrative Events.................................................................................... 53

Table 9 Protocols and Services.................................................................................................... 59

Table 10 Operational Environment Security Measures............................................................... 64

Cisco ISR 4000 Family Routers Administrator Guidance

Page 5of 66

List of Acronyms

The following acronyms and abbreviations are used in this document:

Table 1 Acronyms

Acronyms /

Abbreviations

Definition

AAA

Administration, Authorization, and Accounting

AES

Advanced Encryption Standard

FIPS

Federal Information Processing Standards

EAL

Evaluation Assurance Level

HTTPS

Hyper-Text Transport Protocol Secure

Internet Protocol

NTP

Network Time Protocol

RADIUS

Remote Authentication Dial In User Service

SFP

Security Function Policy

SSHv2

Secure Shell (version 2)

TCP

Transport Control Protocol

TOE

Target of Evaluation

Cisco ISR 4000 Family Routers Administrator Guidance

Page 6of 66

DOCUMENT INTRODUCTION

Prepared By:

Cisco Systems, Inc.

170 West Tasman Dr.

San Jose, CA 95134

DOCUMENT INTRODUCTION

This document provides supporting evidence for an evaluation of a specific Target of Evaluation

(TOE), the Cisco Integrated Services Routers (ISR) 4000 (4321, 4331 and 4351) Family. This

Operational User Guidance with Preparative Procedures addresses the administration of the TOE

software and hardware and describes how to install, configure, and maintain the TOE in the

Common Criteria evaluated configuration. Administrators of the TOE will be referred to as

administrators, authorized administrators, TOE administrators, semi-privileged administrators,

and privileged administrators in this document.

Cisco ISR 4000 Family Routers Administrator Guidance

Page 7of 66

1. Introduction

This Operational User Guidance with Preparative Procedures documents the administration of the

Cisco Integrated Services Routers (ISR) 4000 Family (4321, 4331 and 4351), the TOE, as it was

certified under Common Criteria. The Cisco Integrated Services Routers (ISR) 4000 Family may

be referenced below as the ISR 4000 Family Router, TOE, or simply router.

1.1 Audience

This document is written for administrators configuring the TOE. This document assumes that you

are familiar with the basic concepts and terminologies used in internetworking, and understand

your network topology and the protocols that the devices in your network can use, that you are a

trusted individual, and that you are trained to use the operating systems on which you are running

your network.

1.2 Purpose

This document is the Operational User Guidance with Preparative Procedures for the Common

Criteria evaluation. It was written to highlight the specific TOE configuration and administrator

functions and interfaces that are necessary to configure and maintain the TOE in the evaluated

configuration. This document is not meant to detail specific actions performed by the

administrator but rather is a road map for identifying the appropriate locations within Cisco

documentation to get the specific details for configuring and maintaining ISR 4000 operations.

All security relevant commands to manage the TSF data are provided within this documentation

within each functional section.

1.3 Document References

This document makes reference to several Cisco Systems documents. The documents used are

shown below in Table 2. Throughout this document, the guides will be referred to by the “#”, such

as [1].

Table 2 Cisco Documentation

Title

Link

[1]

Loading and Managing

System Images

Configuration Guide

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sys-image-

mgmt/configuration/xe-16/sysimgmgmt-xe-16-book.html

[2]

Hardware Installation Guide

for the Cisco 4000 Series

Integrated Services Router

http://www.cisco.com/c/en/us/td/docs/routers/access/440

0/hardware/installation/guide4400-4300/C4400_isr.html

[3]

Configuration Fundamentals

Configuration Guide

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/fundamentals/configuration/xe-16/fundamentals-xe-

16-book.html

Cisco ISR 4000 Family Routers Administrator Guidance

Page 8of 66

Title

Link

[4]

Basic System Management

Configuration Guide

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/bsm/configuration/xe-16/bsm-xe-16-book.html

[5]

RADIUS Configuration

Guide

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/sec_usr_rad/configuration/xe-16/sec-usr-rad-xe-16-

book.html

[6]

Using Setup Mode to

Configure a Cisco

Networking Device

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/fundamentals/configuration/15-s/fundamentals-15-s-

book.html

[8]

Cisco IOS Security

Command Reference

http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-

a1-cr-book.html

http://www.cisco.com/en/US/docs/ios-xml/ios/security/d1/sec-

d1-cr-book.html

http://www.cisco.com/en/US/docs/ios-xml/ios/security/m1/sec-

m1-cr-book.html

http://www.cisco.com/en/US/docs/ios-xml/ios/security/s1/sec-

s1-cr-book.html

[9]

Public Key Infrastructure

Configuration Guide

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/sec_conn_pki/configuration/xe-16/sec-pki-xe-16-

book.html

[11]

IPsec Data Plane

Configuration Guide

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/sec_conn_dplane/configuration/xe-16/sec-ipsec-data-

plane-xe-16-book.html

[12]

FlexVPN and Internet Key

Exchange Version 2

Configuration Guide

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/sec_conn_ike2vpn/configuration/xe-16/sec-flex-vpn-

xe-16-book.html

[13]

Cisco IOS Configuration

Fundamentals Command

Reference

http://www.cisco.com/en/US/docs/ios-

xml/ios/fundamentals/command/Cisco_IOS_Configuration_Fu

ndamentals_Command_Reference.html

[14]

Release Notes for the Cisco

4000 Series ISRs

http://www.cisco.com/c/en/us/td/docs/routers/access/4400/rele

ase/xe-16-rn/isr4k-rel-notes-xe-16_3.html

[15]

Cisco 4000 Series ISRs

Software Configuration

Guide

http://www.cisco.com/c/en/us/td/docs/routers/access/4400/soft

ware/configuration/guide/isr4400swcfg.pdf

Cisco ISR 4000 Family Routers Administrator Guidance

Page 9of 66

Title

Link

[16]

Removed

[17]

MACSEC and MKA

Configuration Guide

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/macsec/configuration/xe-16/macsec-xe-16-book.html

[18]

IP Addressing: NAT

Configuration Guide

http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/ipaddr_nat/configuration/xe-16/nat-xe-16-book.html

1.4 Supported Hardware and Software

Only the hardware and software listed in section 1.5 of the Security Target (ST) is compliant with

the Common Criteria evaluation. Using hardware not specified in the ST invalidates the secure

configuration. Likewise, using any software version other than the evaluated software listed in the

ST will invalidate the secure configuration. The TOE is a hardware and software solution that

makes up the Cisco Integrated Services Routers (ISR) 4000 Family (4321, 4331 and 4351) model.

The network, on which they reside, is considered part of the environment. The software is pre-

installed and is comprised of the Cisco IOS-XE software image Release 16.3.2. In addition, the

software image is also downloadable from the Cisco web site.

1.5 Operational Environment

1.5.1 Supported non-TOE Hardware/ Software/ Firmware

The TOE supports (in some cases optionally) the following hardware, software, and firmware in

its environment:

Table 3 IT Environment Components

Component

Required

Usage/Purpose Description for TOE performance

RADIUS

AAA Server

This includes any IT environment RADIUS AAA server that provides single-

use authentication mechanisms. This can be any RADIUS AAA server that

provides single-use authentication. The TOE correctly leverages the services

provided by this RADIUS AAA server to provide single-use authentication

to administrators.

Management

Workstation

with SSH

Client

Yes

This includes any IT Environment Management workstation with a SSH

client installed that is used by the TOE administrator to support TOE

administration through SSH protected channels. Any SSH client that

supports SSHv2 may be used.

Local

Console

This includes any IT Environment Console that is directly connected to the

TOE via the Serial Console Port and is used by the TOE administrator to

support TOE administration.

Cisco ISR 4000 Family Routers Administrator Guidance

Page 10 of 66

Component

Required

Usage/Purpose Description for TOE performance

Certification

Authority

This includes any IT Environment Certification Authority on the TOE

network. This can be used to provide the TOE with a valid certificate during

certificate enrolment.

Remote VPN

Endpoint

Yes

This includes any VPN peer or client with which the TOE participates in

VPN communications. Remote VPN Endpoints may be any device or

software client that supports IPsec VPN communications. Both VPN clients

and VPN gateways are considered to be Remote VPN Endpoints by the TOE.

NTP Server

The TOE supports communications with an NTP server in order to

synchronize the date and time on the TOE with the NTP server’s date and

time. A solution must be used that supports secure communications with up

to a 32 character key.

Syslog Server

Yes

This includes any syslog server to which the TOE would transmit syslog

messages.

1.6 Excluded Functionality

The following functionality is excluded from the evaluation.

Table 4 Excluded Functionality

Excluded Functionality

Exclusion Rationale

Non-FIPS 140-2 mode of operation

This mode of operation includes non-FIPS allowed

operations.

Telnet for management purposes.

Telnet passes authentication credentials in clear text.

SSHv2 is to be used instead.

These services will be disabled by configuration. The exclusion of this functionality does not

affect compliance to the U.S. Government Protection Profile for Security Requirements for

Network Devices.

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Enrutador de red de Cisco

Cisco

Cisco Small Business RV320 Manual de usuario

Cisco

Cisco uBR925 Guía de configuración

Cisco

Cisco ISR G2 Series Manual de usuario

Cisco

Cisco 3825 - Voice Bundle Router Instrucciones de funcionamiento

Cisco

Cisco WRT54G2 Linksys Manual de usuario

Cisco

Cisco ASR 9000 Series Manual de usuario

Cisco

Cisco CRS-1 - Carrier Routing System Router Manual de usuario

Cisco

Cisco 2611 - Router - EN Manual de usuario

Cisco

Cisco Linksys WET610N Manual de usuario

Cisco

Cisco Linksys SE2800 Manual de usuario

Cisco

Cisco WS-C2950-24 Manual de usuario

Cisco

Cisco ASR 9001 Manual

Cisco

Cisco NCS 500 Series Instrucciones originales

Cisco

Cisco 12406 series Manual de usuario

Cisco

Cisco 2851 - Integrated Services Router Manual de usuario

Cisco

Cisco NCS 6000 Series Manual de usuario

Cisco

Cisco ASR 1000 Series Manual del operador

Cisco

Cisco ASR 903 Manual

Cisco

Cisco Linksys E1550 Guía de inicio rápido

Cisco

Cisco WIC-1ENET - 1700 Access Routers 1port10bt Enet Wan... Manual de usuario

Cisco

Cisco 6000 series Manual de usuario

Cisco

Cisco 2691 - VPN Bundle Router Manual

Cisco

Cisco Nexus 9000 Series Manual de usuario

Cisco

Cisco NCS 4216 Manual de instrucciones

Manuales populares de Enrutador de red de otras marcas

Allnet

Allnet ALL0333AU Manual de usuario

HomeSeer

HomeSeer HT-SEL Manual de usuario

Sercomm

Sercomm Genesis OC3505D Manual de usuario

Billion

Billion BIPAC 5102 Series Manual de usuario

TP-Link

TP-Link TD-8817 Manual de usuario

Motorola

Motorola MR1900 Manual de usuario

Digi

Digi IX14 Manual de usuario

XAVi

XAVi X8821e Manual de usuario

BEC

BEC 6200WZL Manual de usuario

MikroTik

MikroTik hAP ac3 Series Manual de usuario

Korenix

Korenix JetNet 5428G Series Manual de usuario

NETGEAR

NETGEAR FS526T - Switch Manual de usuario

Korenix

Korenix JetNet 5710G Series Manual de usuario

Automated Logic

Automated Logic ZN551 Manual del propietario

EnGenius

EnGenius ESR-9710 Manual de usuario

LevelOne

LevelOne FBR-1416 Manual de usuario

Dynacord

Dynacord Promatrix 6000 Manual de usuario

Lorex

Lorex F5D8230-4 Manual de usuario