Table Of Contents
FIPS 140-2 Non-Proprietary Security Policy for the Cisco ASA 5500 Series Security Appliance
Security Appliance Validation Level
Physical Characteristics and Security Appliance Interfaces
Crypto Officer Guidance - System Initialization
Crypto Officer Guidance - System Configuration
Approved Cryptographic Algorithms
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support & Documentation Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
FIPS 140-2 Non-Proprietary Security Policy for the Cisco ASA 5500 Series Security Appliance
Introduction
This is a non-proprietary Cryptographic Module Security Policy for Cisco ASA 5510, ASA 5520, and ASA 5540 security appliances. This policy describes how the Cisco ASA 5500 series security appliances meet the requirements of FIPS 140-2. This document also includes instructions for configuring the security appliance in FIPS 140-2 mode. This policy was prepared as part of the Level 2 FIPS 140-2 validation for the Cisco ASA 5500 series security appliances.
Note
This document may be copied in its entirety and without modification. All copies must include the copyright notice and statements on the last page.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2 — Security Requirements for Cryptographic Modules) details the U.S. Government requirements for cryptographic security appliances. More information about the FIPS 140-2 standard and validation program is available on the NIST website at http://csrc.nist.gov/cryptval/.
This document includes the following sections:
•
•
•
•
•
•
FIPS 140-2 Submission Package
The security policy document is one document in a complete FIPS 140-2 Submission Package. In addition to this document, the complete submission package contains:
•
•
•
With the exception of this non-proprietary security policy, the FIPS 140-2 validation documentation is proprietary to Cisco Systems, Inc. and is releasable only under appropriate non-disclosure agreements. For access to these documents, please contact Cisco Systems, Inc. See "Obtaining Technical Assistance" section for more information.
Overview
The Cisco ASA 5500 series security appliance leverages Cisco's expertise in security and VPN solutions, and integrates the latest technologies from Cisco PIX 500 series security appliances, Cisco IPS 4200 Series Intrusion Prevention Systems, and Cisco VPN 3000 series concentrators.
The Cisco ASA 5500 series security appliances provide multiple integrated security and networking services, including:
•
•
•
•
•
•
The Cisco ASA 5500 series security appliance is a high-performance, multifunction security appliance family delivering converged firewall, IPS, network anti-virus and VPN services. As a key component of the Cisco Self-Defending Network, it provides proactive threat mitigation that stops attacks before they spread through the network, controls network activity and application traffic, and delivers flexible VPN connectivity while remaining cost-effective and easy-to-manage.
In a single platform, the Cisco ASA 5500 series security appliance offers the following:
•
•
•
Security Appliance Validation Level
Table 4 lists the level of validation for each area in the FIPS PUB 140-2.
Physical Characteristics and Security Appliance Interfaces
The Cisco ASA 5500 series security appliance family delivers enterprise-class security for medium business-to-enterprise networks in a modular, purpose-built appliance. Its versatile one-rack unit (1RU) design supports up to 8 10/100/1000 Gigabit Ethernet interfaces (on the ASA5520 and ASA5540) and 1 10/100 Fast Ethernet Management interface, making it an excellent choice for businesses requiring a cost-effective, resilient security solution with demilitarized zone (DMZ) support.
Each appliance is a multi-chip standalone security appliance, and the cryptographic boundary is defined as encompassing the "top," "front," "left," "right," and "bottom" surfaces of the case; all portions of the "backplane" of the case which are not designed to accommodate a removable interface or Cisco ASA 5500 series security appliance; and the inverse of the three-dimensional space within the case that would be occupied by an installed Cisco ASA 5500 series security appliance. The cryptographic boundary includes the connection apparatus between the Cisco ASA 5500 series security appliance and the motherboard/daughterboard that hosts the Cisco ASA 5500 series security appliance, but the boundary does not include the Cisco ASA 5500 series security appliance itself. In other words, the cryptographic boundary encompasses all hardware components within the case of the device except any installed modular Cisco ASA 5500 series security appliance.
Figure 1 shows the ASA 5500 adaptive security appliance front panel LEDs.
Figure 1 ASA 5500 Adaptive Security Appliance Front Panel LEDs
Figure 2 shows the ASA 5500 adaptive security appliance rear panel LEDs and ports.
Figure 2 ASA 5500 Adaptive Security Appliance Rear Panel LEDs and Ports (AC Power Supply Model Shown)
Management port1
USB 2.0 interfaces2
External CompactFlash slot
Network interfaces3
Serial Console port
Power indicator LED
Power switch
Status indicator LED
Power indicator LED
Active LED
1 The management 0/0 interface is a FastEthernet interface designed for management traffic only.
2 Not supported at this time.
3 GigabitEthernet interfaces, from right to left, GigabitEthernet 0/0, GigabitEthernet 0/1, GigabitEthernet 0/2, and GigabitEthernet 0/3.
Figure 3 shows the adaptive security appliance rear panel LEDs.
Figure 3 ASA 5500 Adaptive Security Appliance Rear Panel Link and Speed Indicator LEDs
Table 2 lists the rear MGMT and Network LEDs.
Table 2 Link and Speed LEDs
Left side
Solid green
Physical link
Green flashing
Network activity
Right side
Not lit
10 Mbps
Green
100 Mbps
Amber
1000 Mbps
Note
Each security appliance provides a number of physical and logical interfaces to the device, and the physical interfaces provided by the security appliance are mapped to four FIPS 140-2 defined logical interfaces: data input, data output, control input, and status output.
The logical interfaces and their mapping are described in Table 3:
Table 3 Cisco ASA 5500 Series Security Appliance Physical Interface/Logical Interface Mapping
GigabitEthernet 0-3
Multi-Function Service Card (MFSC) Interface
MGMT Port
Compact Flash Type 1
Com 1 (Console Port)
Data Input Interface
GigabitEthernet 0-3
Multi-Function Service Card (MFSC) Interface
MGMT Port
Compact Flash Type 1
Com 1 (Console Port)
Data Output Interface
GigabitEthernet 0-3
Multiple Service Function (MFS) Interface
MGMT Port
Power Switch
Reset Switch
Com 1 (Console Port)
Control Input Interface
GigabitEthernet 0-3
Multi-Function Service Card (MFSC) Interface
MGMT Port
Ethernet LEDs
Power LED
Status LED
VPN LED
Active LED
CF Active LED
Com 1 (Console Port)
Status Output Interface
Power Plug
Power Interface
USB Port
Com 2 (Aux Port)1
Unused Interface
1 Physical interface not functional
Roles and Services
The security appliance can be accessed in one of the following ways:
•
•
•
•
As required by FIPS 140-2, there are two main roles in the security appliance that operators may assume: a Crypto Officer role and User role. The security appliance supports role-based authentication, and the respective services for each role are described in the "Crypto Officer Services" section, and the "User Services" section.
Crypto Officer Services
The Crypto Officer role is responsible for the configuration and maintenance of the security appliance and authenticates from the enable command (for local authentication) or the login command (for AAA authentication) from the user services. The Crypto Officer services consist of the following:
•
•
•
•
•
•
User Services
A user enters the system by accessing the console port with a terminal program or via IPSec protected Telnet or SSH session to a LAN port. The security appliance will prompt the user for their password. If the password is correct, the user is allowed entry to the executive program. The services available to the User role consist of the following:
•
•
•
The services accessing the Critical Service Parameters (CSP)s, the type of access and which role accesses the CSPs are listed in Table 4.
Table 4 Cisco ASA 5500 Series Adaptive Security Appliance Validation Level by Section
Authentication Mechanisms
The security appliance supports either a password or digital certificates for authenticating IPSec users. To log on to the appliances for management purposes, an operator must connect to it through one of the management interfaces (Console Port, SSH, Telnet, or ASDM) and provide a password.
Table 5 describes the estimated strength of the authentication mechanism.
Cryptographic Key Management
The appliances use a variety of Critical Security Parameters during operation.
Table 6 lists the cryptographic keys used by the Cisco ASA 5500 series security appliance.
Self-Tests
The security appliances include an array of self-tests that are run during startup and periodically during operations to prevent any secure data from being released and to insure all components are functioning correctly.
Table 7 lists the ASA 5500 adaptive security appliance power-on self-tests.
The security appliances perform all power-on self-tests automatically at boot when FIPS mode is enabled. All power-on self-tests must be passed before a User/Crypto Officer can perform services. The power-on self-tests are performed after the cryptographic systems are initialized but prior to the initialization of the LANs; this prevents the security appliance from passing any data during a power-on self-test failure. In the unlikely event that a power-on self-test fails, an error message is displayed on the console followed by a security appliance reboot.
Table 8 lists the conditional self-tests that the ASA 5500 adaptive security appliance performs.
Mitigation of Other Attacks
The security appliances do not claim to mitigate any attacks in a FIPS-approved mode of operation.
Secure Operation
The Cisco ASA 5510, ASA 5520, and ASA 5540 adaptive security appliances meet FIPS 140-2 Level 2 requirements. This section describes how to place and keep the security appliances in a FIPS-approved mode of operation. Operating the security appliances without maintaining the following settings will remove the security appliances from the FIPS-approved mode of operation.
Crypto Officer Guidance - System Initialization
The security appliances were validated with adaptive security appliance software Version (file name: asa704-k8.bin). This is the only allowable image for FIPS-approved mode of operation.
The Crypto Officer must configure and enforce the following initialization steps:
Step 1
(config)# mode singleStep 2
(config)# no firewall transparentStep 3
(config)#crashinfo console disableStep 4
Step 5
(config)#fips enableStep 6
(config)#no service password-recoveryStep 7
(config)# config-register 0x10011Step 8
(config)#failover key hex <key>
Note
Note
- Before upgrading to V7.0.4, copy the configuration to a location off the device
- Use a text editor to modify the interface configuration
- Change the failover cables to the specified failover interface
- Upgrade to V7.0.4 and reload the modified configurationStep 9
(config-terminal)#aaa authentication serial console LOCAL(config-terminal)#username <name> password <password>Step 10
(config-terminal)#aaa authentication ssh console LOCAL(config-terminal)#aaa authentication telnet console LOCALStep 11
(config-terminal)#aaa authentication enable console LOCALStep 12
(config-terminal)#username <name> password <password> privilege 15(config-terminal)#username <name> password <password> privilege 1Step 13
Step 14
Step 15
Note
Step 16
Crypto Officer Guidance - System Configuration
To operate in FIPS mode, the Crypto Officer must perform the following steps:
Step 1
Step 2
Note
Step 3
The following configuration settings are known to work when launching ASDM in a TLS-only environment with JRE 1.5.0_05:
a.
(config)# ssl server-version tlsv1-onlyb.
c.
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Approved Cryptographic Algorithms
The appliances support many different cryptographic algorithms; however, only FIPS approved algorithms may be used. Use the following cryptographic algorithms:
•
•
•
•
•
•
•
•
•
•
Note
Each cryptographic implementation adaptive security appliance software with on-board acceleration has achieved the certifications listed in Table 9.
Table 9 Algorithm Certificates
AES
320
105
3 DES
384
217
SHA-1
393
196
SHA-1 HMAC
124
125
RNG
143
144
RSA
105
106
DSA
150
151
Non-FIPS Approved Algorithms
The security appliances implement the following non-FIPS-approved cryptographic algorithms:
•
•
•
•
•
•
Tamper Evidence
All Critical Security Parameters are stored and protected within each appliance's tamper evident enclosure. The administrator is responsible for properly placing all tamper evident labels. The security labels recommended for FIPS 140-2 compliance are provided in the FIPS Kit (CVPNPIXASAFIPS/KIT). These security labels are very fragile and cannot be removed without clear signs of damage to the labels.
The Crypto Officer should inspect the tamper evident labels periodically to verify they are intact and the serial numbers on the applied tamper evident labels match the records in the security log.
Apply the serialized tamper evident labels as follows (see Figure 4):
Figure 4 Cisco ASA 5500 Series Security Appliance Tamper Evident Label Placement
Step 1
Step 2
Step 3
Step 4
Step 5
The tamper evident seals are produced from a special thin gauge vinyl with self-adhesive backing. Any attempt to open the device will damage the tamper evident seals or the material of the security appliance cover. Because the tamper evident seals have non-repeated serial numbers, they may be inspected for damage and compared against the applied serial numbers to verify that the security appliance has not been tampered with. Tamper evident seals can also be inspected for signs of tampering, which include the following: curled corners, rips, and slices. The word "OPEN" may appear if the label was peeled back.
Related Documentation
This document deals only with operations and capabilities of the security appliance in the technical terms of a FIPS 140-2 cryptographic security appliance security policy. More information is available on the security appliance from the sources listed in this section and from the following source:
•
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/techsupport
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Product Documentation DVD
Cisco documentation and additional literature are available in the Product Documentation DVD package, which may have shipped with your product. The Product Documentation DVD is updated regularly and may be more current than printed documentation.
The Product Documentation DVD is a comprehensive library of technical product documentation on portable media. The DVD enables you to access multiple versions of hardware and software installation, configuration, and command guides for Cisco products and to view technical documentation in HTML. With the DVD, you have access to the same documentation that is found on the Cisco website without being connected to the Internet. Certain products also have .pdf versions of the documentation available.
The Product Documentation DVD is available as a single unit or as a subscription. Registered Cisco.com users (Cisco direct customers) can order a Product Documentation DVD (product number DOC-DOCDVD=) from Cisco Marketplace at this URL:
http://www.cisco.com/go/marketplace/
Ordering Documentation
Beginning June 30, 2005, registered Cisco.com users may order Cisco documentation at the Product Documentation Store in the Cisco Marketplace at this URL:
http://www.cisco.com/go/marketplace/
Nonregistered Cisco.com users can order technical documentation from 8:00 a.m. to 5:00 p.m. (0800 to 1700) PDT by calling 1 866 463-3487 in the United States and Canada, or elsewhere by calling 011 408 519-5055. You can also order documentation by e-mail at tech-doc-store-mkpl@external.cisco.com or by fax at 1 408 519-5001 in the United States and Canada, or elsewhere at 011 408 519-5001.
Documentation Feedback
You can rate and provide feedback about Cisco technical documents by completing the online feedback form that appears with the technical documents on Cisco.com.
You can send comments about Cisco documentation to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
From this site, you can perform these tasks:
•
•
•
A current list of security advisories and notices for Cisco products is available at this URL:
If you prefer to see advisories and notices as they are updated in real time, you can access a Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed from this URL:
http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you might have identified a vulnerability in a Cisco product, contact PSIRT:
•
An emergency is either a condition in which a system is under active attack or a condition for which a severe and urgent security vulnerability should be reported. All other conditions are considered nonemergencies.
•
In an emergency, you can also reach PSIRT by telephone:
•
•
Tip
Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one linked in the Contact Summary section of the Security Vulnerability Policy page at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
The link on this page has the current PGP key ID in use.
Obtaining Technical Assistance
Cisco Technical Support provides 24-hour-a-day award-winning technical assistance. The Cisco Technical Support & Documentation website on Cisco.com features extensive online support resources. In addition, if you have a valid Cisco service contract, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not have a valid Cisco service contract, contact your reseller.
Cisco Technical Support & Documentation Website
The Cisco Technical Support & Documentation website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support & Documentation website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Note
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
http://www.cisco.com/go/marketplace/
•
•
•
http://www.cisco.com/go/iqmagazine
or view the digital edition at this URL:
http://ciscoiq.texterity.com/ciscoiq/sample/
•
•
http://www.cisco.com/en/US/products/index.html
•
http://www.cisco.com/discuss/networking
•
http://www.cisco.com/en/US/learning/index.html
Definition List
AES—Advanced Encryption Standard
ASA—Adaptive Security Appliance
CMVP—Cryptographic Module Validation Program
CSP—Critical Security Parameter
DES—Data Encryption Standard
FIPS—Federal Information Processing Standard
HTTP—Hyper Text Transfer Protocol
KAT—Known Answer Test
LED—Light Emitting Diode
MAC—Message Authentication Code
NIST—National Institute of Standards and Technology
NVLAP—National Voluntary Laboratory Accreditation Program
RAM—Random Access Memory
RSA—Rivest Shamir and Adleman method for asymmetric encryption
SCEP—Simple Certificate Enrollment Protocol
security appliance—A security appliance may provide additional interfaces, feature acceleration or additional services. Security appliances may take a Circuit Board form factor SSM (for ASA appliances)
SHA—Secure Hash Algorithm
SSL—Secure Sockets Layer
SSM—Security Services Module
TLS—Transport Layer Security
Guest
