Table Of Contents
Supported Hardware and Software Versions
Organizational Security Policy
Security Implementation Considerations
Potential Insecure Configurations
Trusted and Untrusted Networks
Auditing Component Requirements
AAA Server and Authentication Policy per the IT Environment
Determining the Software Version
Verification of Hardware and Software Image
Configuration Notes (IOS/Supervisor)
Configuring Authentication on the Supervisor
Configuring System Log Messaging from the Supervisor to PFSS
Configuring Authentication on FWSM
Configuring Console Access on FWSM to Use AAA (Optional)
Configuring AAA for Telnet and FTP
Verifying the Correct Version of PFSS
Using the Syslog Server (PFSS Active Mode)
Changing the Syslog Server Parameters at the Windows 2000 System
Recovering from the Syslog Server Disk-Full Condition
Configuring System Log Message Search Functions Using the System Log Message Search
Setting Up the System Log Message Search Display
Searching System Log Messages Based on Syslog ID
Searching System Log Messages for Specific Commands Entered by the Administrator on the Supervisor
Searching System Log Messages Based on User ID
Searching Windows Audit Events
Searching System Log Messages Based on IP Address
Searching System Log Messages with the Advanced Option Feature
MD5 Hash Value for the Evaluated Configuration
Obtaining Documentation, Obtaining Support, and Security Guidelines
Installation and Configuration for Common Criteria EAL4 Evaluated Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module Version 3.1(3.17)
April 2007Contents
This document describes how to install and configure the Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module (FWSM) as certified by Common Criteria Evaluation Assurance Level 4 (EAL4).
In this guide, "FWSM"or "Firewall Services Module" applies to all models of the Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module, unless specifically noted otherwise.
Note
Failure to follow the information provided in this document will result in the Firewall Services Module not being compliant with the evaluation, and may make it insecure.
This document includes the following sections:
•
•
•
•
•
Introduction
This document is an addendum to the Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module documentation set, which should be read before configuring the FWSM.
Cisco product documentation includes:
•
–
•
–
•
–
•
–
•
–
•
–
For a complete list of documentation for the Catalyst 6500 series switch, go to:
•
For a complete list of documentation for the Cisco 7600 series routers, go to:
•
The FWSM documentation is available in printed-paper form, and online (in both HTML and PDF formats).
Audience
This document is written for administrators configuring the Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module software. This document assumes you are familiar with networks and network terminology, that you are a trusted individual, and that you are trained to use the Internet and its associated terms and applications.
Supported Hardware and Software Versions
Only the following combinations of hardware and software listed in Table 1 are compliant with the FWSM 3.1(3.17) EAL4 evaluation. Using hardware and software not specified invalidates the secure configuration.
Security Information
In addition to the Regulatory Compliance and Safety Information document, the sections that follow provide additional security information for use with a Common Criteria Certified Firewall Services Module.
•
•
Organizational Security Policy
Ensure that your FWSM is delivered, installed, managed, and operated in a manner that maintains an organizational security policy.
Security Implementation Considerations
The sections that follow provide implementation considerations that need to be addressed to administer the FWSM in a secure manner.
Note
The threat of malicious attacks aimed at discovering exploitable vulnerabilities is considered moderate. A moderate attack potential for the certified configuration makes the following assumptions:
Identification
•
•
•
•
•
Exploitation
•
•
Other Factors
•
•
•
Certified Configuration
Use only the FWSM software Version 3.1(3.17). Only the hardware and software version combinations listed in Table 1 can be used to implement an evaluated configuration. Changing the software or hardware to a different version invalidates the evaluated status of a particular hardware platform.
The Certified Common Criteria Firewall Services ModuleVersion 3.1(3.17) excludes the following features:
•
•
•
•
The features that are specifically excluded must be disabled while the FWSM and Supervisor are operating in the evaluated configuration.
All other hardware and software features and functions of the FWSM are included in the evaluated product configuration and thus can be used in conjunction with the Target of Evaluation (TOE) Security Functions as long as the TOE functions are configured, operated, and managed in accordance with this document.
The FWSM Target of Evaluation relies on a Windows 2000 or Windows XP computer to act as an audit server. Windows is configured in the EAL4 evaluated configuration to support this TOE. Microsoft Windows Evaluated Configuration documentation can be found by clicking the following links:
Windows 2000 Documentation
Windows 2000 Common Criteria Evaluated Configuration User's Guide:
http://www.microsoft.com/technet/security/prodtech/Windows2000/w2kccug/default.mspx
Windows 2000 Common Criteria Evaluated Configuration Administrator's Guide:
http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/default.mspx
Windows 2000 Common Criteria Security Configuration Guide:
http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccscg/default.mspx
Windows XP Documentation
Windows XP Common Criteria Evaluated Configuration User's Guide:
Windows XP Common Criteria Evaluated Configuration Administrator's Guide:
Windows XP Common Criteria Security Configuration Guide:
The configuration of the FWSM should be reviewed on a regular basis to ensure that the configuration continues to meet the organizational security policy when considering the following:
•
•
•
•
Potential Insecure Configurations
This section includes the following topics:
•
•
•
Uncommitted Changes
FWSM loads the saved startup configuration and automatically copies this configuration into the running configuration.
You can configure the running configuration to a specific need and save the running configuration. You can also save the updated configuration to the startup configuration. The running configuration is held in volatile memory so if the FWSM reboots and resumes operation when uncommitted changes were made, these changes will be lost and the FWSM will revert to the last configuration saved. For more information, see Saving Your Configuration.
Default Flow Policy
By default, the FWSM is configured with a default flow policy. The outbound interface refuses all external to internal flow of data. Administrators must take note of this, and ensure that the correct policy for the organization is followed when installing before users are permitted to use the FWSM. Set up access lists to enable traffic to flow through the FWSM. Specific permit or deny rules are required to be applied to a protocol, a source and destination IP address or network and optionally, the source and destination ports. For more information, see the Organizational Security Policy section to implement a suitable security policy.
Physical Security
The FWSM must be located in a physically secure environment to which only a trusted administrator has access. The secure configuration of the FWSM can be compromised if an intruder gains physical access to the FWSM. Similarly, the audit server used to store and manage the FWSM system log messages must be protected physically and with suitable identification and authentication mechanisms to ensure that only trusted administrators have access.
Administration Access
There are only two methods by which the administrator can manage the FWSM:
•
•
The FWSM does not have an external console port. You must session in to the FWSM to perform configuration by first connecting to the console on the Supervisor, and then executing the session command. For this certified configuration, there are two modules that are used to provide the certified configuration security functions: the FWSM itself and the Supervisor executing IOS. Each module has its own interfaces and executing operating system.
Servers and Proxies
To ensure complete security when the FWSM is shipped, inbound access to all proxies and servers is initially disabled. After the installation, you must explicitly permit each service and enable the services necessary for your security policy. See the configuration guides for information on how to configure the FWSM. Certification requires a completely controlled environment in which specified services are allowed and all others denied.
Logging and Messages
Monitoring activity in the log files is an important aspect of your network security and should be conducted regularly. Monitoring the log files lets you take appropriate and timely action when you detect security breaches or events that are likely to lead to a security breach in the future. Use the show logging command or the syslog server to view log files messages. See Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Logging Configuration and System Log Messages for information about sending messages, and archiving.
Access Lists
The access-list command operates on a first-match basis. Therefore, the last rule added to the access list is the last rule checked. Administrators must take note of this when entering the initial rules during the configuration, because it may impact the remainder of the rule parsing.
Trusted and Untrusted Networks
The FWSM can be used to isolate your network from the Internet or from another network. A trusted network is usually your internal network and an untrusted network may be the Internet or any other network. For this certified configuration, VLANs provide logical separation between various networks. The configuration of VLANs takes place on the Supervisor as the Supervisor is in control of all the network interfaces that exist on the platform. The Supervisor also can be configured to perform routing functions for the network.
The FWSM must be configured so that it acts as the only network connection between your internal network and any external networks. The FWSM will deny any information flows for which no rule is defined. Your security implementation is based on the control of traffic from one network to the other, and should support your security policy.
See "Assigning VLANs to the FWSM in Cisco IOS Software" in the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for additional information about configuring VLANs.
Note
In the default configuration, traffic types observe the default policy for inside to outside traffic. Table 2 shows the traffic types and their supported modes for inside to outside traffic.
In the default configuration, traffic types observe the default policy for outside to inside traffic. Table 3 shows the traffic types and their supported modes for outside to inside traffic.
PFSS is the Windows system log messaging service that provides the system audit store for the firewall. The PFSS shall be configured to communicate with the firewall according to the mode in which the firewall is operating.The PFSS server is required to have its own defined VLAN and interface for communications. The logging host command in this instance is configured to log messages over TCP to the audit server on the VLAN interface. Figure 1 shows the network topology for a single context.
Figure 1 Network Topology for Single Context
If the firewall is operating in multiple context mode, each context shall be defined to communicate with the audit server and configuration settings established to protect the audit server from receiving any other traffic other than that which is specifically allowed per policy. Figure 2 shows the network topology for multiple contexts.
Warning
Note
Figure 2 Network Topology for Multiple Contexts
Note
Routed Mode
In routed mode, the audit VLAN is connected through an IOS VLAN for a minimum of three defined interfaces: external, internal, and audit. The access lists within the FWSM are responsible for protecting the audit server in routed mode.
Transparent Mode
In transparent mode, a BVI management interface provides a third interface to the context for communication with the PFSS and the RADIUS or TACACS+ server. The external and internal interfaces in this configuration are running in transparent mode and do not have an IP address assigned. The BVI is owned or managed by FWSM and has an IP address. One IP address must be configured in order for that context to send system log messages through the BVI and authentication traffic to reach the RADIUS/TACACS+ server. Access-lists on the Supervisor are used to protect the audit and authentication traffic. Strict ACEs must be applied to each BVI to only permit system log messages and RADIUS/TACACS+ traffic from the single host IP of the transparent mode context to the specific host IPs of the PFSS and AAA servers.
Note
hostname(config)# interface VLAN192hostname(config-if)# ip address 192.168.50.254 255.255.255.252hostname(config-if)# ip access-group 101 inhostname(config-if)# ip access-group 102 outA transparent firewall does not participate in IP routing. The only IP configuration required for the FWSM is to set the management IP address for each bridge group. This address is required because the FWSM uses this address as the source address for traffic originating on the FWSM, such as system messages or communications with AAA servers. You can also use this address for remote management access.
hostname(config)# interface vlan 50hostname(config-if)# nameif insidehostname(config-if)# security-level 100hostname(config-if)# bridge-group 1hostname(config-if)# interface vlan 500hostname(config-if)# nameif outsidehostname(config-if)# security-level 0hostname(config-if)# bridge-group 1hostname(config-if)# interface bvi1hostname(config-if)# ip address 192.168.50.1 255.255.255.252A route must be configured on the FWSM to pass traffic from the current context to the syslog server via the VLAN on the Supervisor.
hostname(config)# route inside 0.0.0.0 255.255.255.255 192.168.50.1
Note
Transparent contexts using a BVI interface require static ARP entries for the IOS VLAN IP/MAC, which acts as the route gateway to the PFSS and AAA servers. The same IOS MAC addresses are visible in the transparent mode context on both sides of the firewall. If a static entry is not defined, then the firewall context will periodically move the MAC address back and forth between the inside MAC address table to the outside MAC address table. This movement breaks the route to the PFSS and AAA servers, and causes the context to stop passing traffic, because the context will see the PFSS logging host as down.hostname(config)# mac-address-table static inside 00d0.02de.040a
Note
MAC address spoofing and IP address spoofing (for local subnets or VLANs) within each transparent mode context are to be specifically denied in the evaluated configuration.hostname(config)# arp-inspection outside enable no-floodhostname(config)# arp-inspection inside enable no-floodWarning
Inspection Policy
A default inspection policy must be specified for each context in the evaluated configuration. This policy is determined by the protocols that are included in this evaluation and must be enabled by default. Enter the following commands:
hostname(config)# policy-map global_policyhostname(config)# class inspection_defaulthostname(config)# inspect ctiqbehostname(config)# inspect esmtphostname(config)# inspect ftp stricthostname(config)# inspect gtphostname(config)# inspect h323hostname(config)# inspect httphostname(config)# inspect icmphostname(config)# inspect icmp errorhostname(config)# inspect ilshostname(config)# inspect mgcphostname(config)# inspect rshhostname(config)# inspect rtsphostname(config)# inspect siphostname(config)# inspect skinnyhostname(config)# inspect sunrpchostname(config)# inspect tftphostname(config)# inspect xdmcphostname(config)# inspect dnshostname(config)# inspect smtpPublic Access Servers
If you are planning to host public access servers, you must decide where they will be located in relation to the FWSM. Placing servers on the network outside the FWSM leaves them open to attack. Placing servers on the internal network means you must open up your FWSM to allow access.
Using FTP and Telnet
File Transfer Protocol (FTP) is used to retrieve or deposit files on a remote system. Telnet is used to access a remote server using a console like connection over the network. The Common Criteria Security Target document requires that Telnet and FTP traffic through the FWSM must be authenticated before traffic is allowed to pass through. See Configuring AAA for Telnet and FTP for more information about how to configure the FWSM correctly to authenticate Telnet and FTP.
Note
To enforce compliance of FTP traffic with the FTP RFC, the strict option for the FTP inspection must be enabled in the evaluated configuration.hostname(config)# policy-map global_policyhostname(config)# class inspection_defaulthostname(config)# inspect ftp strictMonitoring and Maintenance
The FWSM software provides several ways to monitor the FWSM, from logs to messages.
•
•
•
–
–
–
Administrative Roles
The certified configuration contains three administrative roles (shown in the following table) for use in the evaluated configuration.
Note
Auditing Component Requirements
The FWSM interacts with Windows 2000 for the purpose of storing the audit data. The server should be running Windows 2000 with Service Pack 4. The auditing machine will provide suitable audit records to the administrator, protect the stored audit records from unauthorized deletion, and will detect modifications to the audit records. It is the responsibility of the administrator to regularly review the audit records provided by the FWSM, and to take any relevant action as necessary to ensure the security of the Firewall Services Module. The location of the auditing machine and records should only be accessible to the administrator.
Password Complexity
Passwords must be 8 to 16 characters in length. The minimum password length must be enforced by the administrator. The following list of characters may be used in passwords:
•
•
•
•
To construct a password, 94 characters are available for use, except for the space character, which is prohibited.
The password guidance included in this section applies to the creation and management of user passwords. Users must ensure that when creating or changing a password, the following requirements are met. Passwords must:
•
•
•
Passwords must not include:
•
•
•
•
AAA Server and Authentication Policy per the IT Environment
The AAA server specified for this certified configuration is included within the environment. The administrator must ensure that during installation, the AAA server is capable of the following:
•
•
•
•
•
•
The IT environment section from the security target document requires that the administrator follow guidance concerning what authentication types are required for each request to administer the certified configuration.
Determining the Software Version
Use the show version command to verify the software version of your FWSM unit. The certified configuration will return 3.1(3)17 as the software version.
Installation Notes
Read the appropriate installation guides before installing the FWSM.
Verification of Hardware and Software Image
To verify that the FWSM software and hardware were not tampered with during delivery, perform the following steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
•
•
•
Step 8
Step 9
Step 10
a.
b.
Step 11
The following is sample output from the show version command, which displays the FWSM version:
hostname# show versionFWSM Firewall Version 3.1(3)17 <system>Compiled on Tue 31-Oct-06 19:49 by daleckiFWSM up 9 mins 0 secsfailover cluster up 9 mins 0 secsHardware: WS-SVC-FWM-1, 1024 MB RAM, CPU Pentium III 1000 MHzFlash LEXAR ATA FLASH @ 0xc321, 20MB0: Int: Not licensed : irq 51: Int: Not licensed : irq 72: Int: Not licensed : irq 11Licensed features for this platform:Maximum Interfaces : 1000Inside Hosts : UnlimitedFailover : Active/ActiveVPN-DES : EnabledVPN-3DES-AES : EnabledCut-through Proxy : EnabledGuards : EnabledURL Filtering : EnabledSecurity Contexts : 250GTP/GPRS : DisabledVPN Peers : UnlimitedSerial Number: SBQ1234567Running Activation Key: <1 2 3 4 5>Configuration has not been modified since last system restart.
Configuration Notes (IOS/Supervisor)
This section includes the following topics:
•
•
Saving Your Configuration
IOS uses both a running configuration and a starting configuration. Configuration changes affect the running configuration. To save that configuration, the running configuration (held in memory) must be copied to the start-up configuration. This may be achieved by either using the write memory command or the copy system:running-config nvram:startup-config command. These commands should be used frequently when making changes to the configuration of the IOS router. If the IOS router reboots and resumes operation when uncommitted changes have been made, these changes will be lost, and the IOS router will revert to the last saved configuration.
Service Password Encryption
Ensure all passwords on the local router are stored encrypted by entering the following commands:
Router# configure terminalEnter configuration commands (one per line). End with Ctrl + Z.Router(config)# service password-encryptionLayer 2 Security
To maintain the integrity of configured VLANs, implement the following guidelines:
•
•
•
To implement these features and prevent VLAN hopping, use the following commands on each port enabled in access mode:
hostname(config)# interface GigabitEthernet 1/10hostname(config-if)# switchporthostname(config-if)# switchport mode accesshostname(config-if)# switchport access vlan
Note
hostname(config-if)# switchport trunk native vlan
Note
hostname(config-if)# switchport mode trunkhostname(config-if)# switchport nonegotiatehostname(config-if)# no ip addresshostname(config-if)# no cdp enablehostname(config-if)# no udld porthostname(config-if)# spanning-tree portfasthostname(config-if)# spanning-tree bpduguard enablehostname(config-if)# vtp mode transparenthostname(config)# no mls qosWarning
Prune VLAN 1 from all the trunks and from all the access ports that do not require it (including unconnected and shutdown ports).
Do not configure the management VLAN on any trunk or access port that does not require it (including not connected and shut-down ports).
Layer 3 Security
IOS requires explicit ACLs to deny IP spoofing attempts and protect the PFSS and RADIUS/TACACS+ servers. Only one IP address can be assigned to an IOS interface in the evaluated configuration. It is not permitted for more than one interface of any type to have an IP address assigned to it, including any VLAN interface, Ethernet interface, or Loopback interface.
Warning
Use of more than one IP within IOS would be necessary only when FWSM is in multiple context mode. If more than one IP is applied to any interface on IOS that has an IP address assigned, apply an inbound ACL to do the following:
•
•
•
•
Access control lists on the IOS must be configured to protect the PFSS (TCP system log message) traffic between the firewall contexts and the PFSS server. The IOS VLAN interface for the audit VLAN must have inbound and outbound ACLs applied. This ACL must also include permit statements for UDP system log messages to reach the PFSS from the Supervisor.
To add an ACL to allow traffic from the firewall to the PFSS server, enter the following command:
hostname(config)# access-list 101 permit tcp 192.168.50.254 0.0.0.0 192.168.0.26 0.0.0.0 eq 1470To add an ACL to allow the UDP system log message to be sent from the Supervisor to the PFSS server, enter the following command:
hostname(config)# access-list 101 permit udp 192.168.0.254 0.0.0.0 192.168.0.26 0.0.0.0 eq 514To allow return traffic from the PFSS server, enter the following command:
hostname(config)# access-list 102 permit tcp 192.168.0.26 0.0.0.0 192.168.50.254 0.0.0.0 gt 1024To add an ACL to allow traffic from the firewall context to the RADIUS/TACACS+ server, enter the following commands:
hostname(config)# access-list 103 permit udp 192.168.50.254 0.0.0.0 192.168.26.2 0.0.0.0 eq 1645hostname(config)# access-list 103 permit udp 192.168.50.254 0.0.0.0 192.168.26.2 0.0.0.0 eq 1646hostname(config)# access-list 103 permit udp 192.168.50.254 0.0.0.0 192.168.26.2 0.0.0.0 eq 49To add an ACL to allow traffic from the Supervisor to the RADIUS/TACACS+ server, enter the following commands:
hostname(config)# access-list 103 permit udp 192.168.0.254 0.0.0.0 192.168.26.2 0.0.0.0 eq 1645<hostname(config)# access-list 103 permit udp 192.168.0.254 0.0.0.0 192.168.26.2 0.0.0.0 eq 1646
Guest
