10
Cisco 1721 and Cisco 1760 Modular Access Routers with MOD1700-VPN FIPS 140-2 Non-Proprietary Security Policy
78-16315-01
The Cisco 1721/1760 Cryptographic Module
·
Status Functions--view the router configuration, routing tables, active sessions, use Gets to view
SNMP MIB II statistics, health, temperature, memory status, voltage, packet statistics, review
accounting logs, and view physical interface status.
·
Manage the router--log off users, shutdown or reload the outer, manually back up router
configurations, view complete configurations, manager user rights, and restore router
configurations.
·
Set Encryption/Bypass--set up the configuration tables for IP tunneling. Set keys and algorithms
to be used for each IP range or allow plaintext packets to be set from specified IP address.
·
Change WAN Interface Cards--insert and remove WICs in the WAN interface slot as described
User Services
A User enters the system by accessing the console port with a terminal program. The IOS prompts the
User for their password. If the password is correct, the User is allowed entry to the IOS executive
program. The services available to the User role consist of the following:
·
Status Functions--view state of interfaces, state of layer 2 protocols, version of IOS currently
running
·
Network Functions--connect to other network devices through outgoing telnet, PPP, etc. and
initiate diagnostic network services (i.e., ping, mtrace)
·
Terminal Functions--adjust the terminal session (e.g., lock the terminal, adjust flow control)
·
Directory Services--display directory of files kept in flash memory
Physical Security
The router is entirely encased by a thick steel chassis. Two WIC slots are provided on the rear of the
1721, and four WIC/VIC slots are provided on the front of the 1760. On-board LAN connectors and
Console/Auxiliary connectors are provided on the rear of the 1721 and the front of the 1760, and the
power cable connection and a power switch are provided on the rear of both models. The top portion of
the chassis may be removed to allow access to the motherboard, memory, and expansion slots.
Any WIC or VIC slot, which is not populated with a WIC or a VIC, must be populated with an
appropriate slot cover in order to operate in a FIPS compliant mode. The slot covers are included with
each router, and additional covers may be ordered from Cisco. The same procedure mentioned below to
apply tamper evidence labels for WICs and VICs must also be followed to apply tamper evidence labels
for the slot covers.
Once the router has been configured in to meet FIPS 140-2 Level 2 requirements, the router cannot be
accessed without signs of tampering. To seal the system, apply serialized tamper-evidence labels as
follows: