17
Cisco 2691 and 3725 Modular Access Routers with AIM-VPN/EP II and Cisco 3745 Modular Access Router with AIM-VPN/HP II FIPS 140-2
OL-6084-01
The Cisco 2691, 3725 and 3745 Routers
Figure 7
Cisco 3725 and Cisco 3745 Tamper Evidence Label Placement
The tamper evidence seals are produced from a special thin gauge vinyl with self-adhesive backing. Any
attempt to open the router, remove Network Modules or WIC cards, or the front faceplate will damage
the tamper evidence seals or the painted surface and metal of the module cover. Since the tamper
evidence seals have non-repeated serial numbers, they may be inspected for damage and compared
against the applied serial numbers to verify that the module has not been tampered. Tamper evidence
seals can also be inspected for signs of tampering, which include the following: curled corners, bubbling,
crinkling, rips, tears, and slices. The word "OPEN" may appear if the label was peeled back.
Cryptographic Key Management
The router securely administers both cryptographic keys and other critical security parameters such as
passwords. The tamper evidence seals provide physical protection for all keys. All keys are also
protected by the password-protection on the Crypto Officer role login, and can be zeroized by the Crypto
Officer. Keys are exchanged manually and entered electronically via manual key exchange or Internet
Key Exchange (IKE).
The module contains a cryptographic accelerator card (the AIM-VPN/EP II for the 2691 and 3725, the
AIM-VPN/HP II for the 3745), which provides AES (128-bit), DES (56-bit) (only for legacy systems),
and 3DES (168-bit) IPSec encryption, MD5 and SHA-1 hashing, and has hardware support for DH.
SEE MANU
AL BEFORE
INSTALLA
TION
AL
CD
LP
RD
TD
SEE MANU
AL BEFORE
INSTALLA
TION
DSU
56K
AL
CD
LP
RD
TD
SEE MANU
AL BEFORE
INSTALLA
TION
DSU
56K
EN
V0
BANK 4
BANK 3
BANK 2
BANK 1 BANK
0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLAT
ION
CTRLR E2
CTRLR E1
AL
LP
CD
99508
EN
V0
BANK 4
BANK 3
BANK 2
BANK 1
BANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLA
TION
CTRLR E2
CTRLR E1
AL
LP
CD
EN
V0
BANK 4
BANK 3
BANK 2
BANK 1
BANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLA
TION
CTRLR E2
CTRLR E1
AL
LP
CD
EN
V0
BANK 4
BANK 3
BANK 2
BANK 1 B
ANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLA
TION
CTRLR E2
CTRLR E1
AL
LP
CD
EN
V0
BANK 4
BANK 3
BANK 2
BANK 1 B
ANK 0
NM-HDV
VWIC
2MFT-E1
SEE
MANUAL
BEFORE
INSTALLA
TION
CTRLR E2
CTRLR E1
AL
LP
CD
SEE MAN
UAL BEFO
RE INSTA
LLATION
SERIAL 1
SERIAL 0
CONN
CONN
WIC
2T
SEE MAN
UAL BEFO
RE INSTA
LLATION
SERIAL 1
SERIAL 0
CONN
CONN
WIC
2T
SEE MAN
UAL BEFO
RE INSTA
LLATION
DSU
56K
C
D
A
L
L
P
R
D
TD