Motorola S2500 User Manual Download

Page: 1 / 18

background image

Copyright © Motorola, Inc. 2009.

May be reproduced only in its original entirety [without revision].

Motorola Network Router (MNR)

S2500

Security

Policy

Document Version 1.3

Revision Date: 1/13/2009

1
2
3
...
»

Summary of Contents for S2500

Page 1: ...Copyright Motorola Inc 2009 May be reproduced only in its original entirety without revision Motorola Network Router MNR S2500 Security Policy Document Version 1 3 Revision Date 1 13 2009 ...

Page 2: ...OLICY 8 6 ACCESS CONTROL POLICY 10 AUTHENTICATED SERVICES 10 UNAUTHENTICATED SERVICES 10 ROLES AND SERVICES 11 DEFINITION OF CRITICAL SECURITY PARAMETERS CSPS 12 DEFINITION OF CSPS MODES OF ACCESS 13 7 OPERATIONAL ENVIRONMENT 15 8 SECURITY RULES 15 9 CRYPTO OFFICER GUIDANCE 16 10 PHYSICAL SECURITY POLICY 17 PHYSICAL SECURITY MECHANISMS 17 11 MITIGATION OF OTHER ATTACKS POLICY 17 12 DEFINITIONS AND...

Page 3: ...he photo blank plates cover slots that can hold optional network interface cards The FIPS validated firmware versions are XS 15 1 0 75 XS 15 1 0 76 XS 15 2 0 20 and XS 15 4 0 60 S2500 Base Unit S2500 Encryption Module Configurations P N Tanapa Number Revision P N Tanapa Number Revision FW Version 1 ST2500B CLN1713E B ST2516A CLN8262C C XS 15 1 0 75 2 ST2500B CLN1713E B ST2516A CLN8262C C XS 15 1 0...

Page 4: ...l Environment N A Cryptographic Key Management 1 EMI EMC 3 Self Tests 1 Design Assurance 1 Mitigation of Other Attacks N A Table 2 Module Security Level Specification 3 Modes of Operation Approved mode of operation In FIPS mode the cryptographic module supports the following FIPS Approved algorithms as follows Hardware Implementations a Triple DES CBC mode 112 or 168 bit for IPsec and FRF 17 encry...

Page 5: ...349 The MNR S2500 router supports the commercially available IKE and Diffie Hellman protocols for key establishment IPsec ESP and FRF 17 protocols to provide data confidentiality using FIPS approved encryption and authentication algorithms and SSHv2 for secure remote access Allowed Algorithms Diffie Hellman allowed for key agreement per Annex D key agreement methodology provides 80 to 112 bits of ...

Page 6: ...For FIPS mode the selector list must be configured to encrypt all packets on an encrypted port e g ADD CRYPTO SelectorLIst s1 1 Include ANY 0 0 0 0 0 0 0 0 0 0 4 If Ipsec is used configure Ipsec transform lists using the ADD CRYPTO TransformLIst command For FIPS mode only the following values are allowed Encryption Transform ESP 3DES or ESP AES and Authentication Transform ESP SHA 5 If FRF 17 is u...

Page 7: ...ge 7 SHOW CRYPTO CONFiguration This command shows a detailed summary of the cryptographic configuration and allows a user to verify that encryption is enabled on user determined ports and that only FIPS Approved algorithms are used for encryption and authentication ...

Page 8: ... input data output status output control input power output Optional conventional to IP E M Power Plug 1 Power input N A External Power input port LEDs 7 Status Output N A Provides LED status output Table 4 S2500 physical ports and logical interfaces 5 Identification and Authentication Policy Assumption of roles The MNR S2500 router supports five distinct operator roles Crypto Officer SuperUser Ad...

Page 9: ...module with full access to services of the module Network Manager Role based operator authentication Username and Password The module stores user identity information internally A user of the cryptographic module with almost full access to services of the module Admin Role based operator authentication Username and Password The module stores user identity information internally An assistant to the...

Page 10: ...nel establishment IPsec protocol FRF 17 tunnel establishment Frame Relay Privacy Protocol SSHv2 for remote access to the router Network configuration Configure networking capabilities Enable Ports Apply a security policy to a port File System Access file system Authenticated Show status Provide status to an authenticated operator Access Control Provide access control for all operators Unauthentica...

Page 11: ...Entry X X User Management X X IKE X X IPsec Tunnel Establishment X X FRF 17 Tunnel Establishment X X SSHv2 X X Reboot X X Zeroization X X Crypto Configuration X X Network Configuration X X Enable Ports X X File System X X Authenticated Show Status X X X X Unauthenticated Show Status X X X X X Power up Self Tests X X X X Monitor X X Access Control X X Table 7 Services to Roles mapping ...

Page 12: ...emeral DH Phase 2 private key a Phase 2 Diffie Hellman private keys used in PFS for key renewal IPSEC Session keys 128 192 256 bit AES CBC and 168 bit TDES keys are used to encrypt and authenticate IPSEC ESP packets FRF 17 Session Keys 168 bit TDES CBC and 128 192 256 bit AES CBC keys are used to encrypt and authenticate FRF 17 Mode 2 SSH RSA Private Key Key used to authenticate oneself to peer SS...

Page 13: ...uted to module used to authenticate peer IKE DH public key g a Generated for IKE Phase 1 key establishment IKE DH phase 2 public g a key Phase 2 Diffie Hellman public keys used in PFS for key renewal if configured SSH DH Key Generated for SSH key establishment Table 9 Public Keys Definition of CSPs Modes of Access Table 10 defines the relationship between access to CSPs and the different module se...

Page 14: ...ticated Show Status Access Control KEK R R Z R IKE Pre shared Key W R Z W RW R SKEYID RW Z Z SKEYID_d RW Z SKEYID_a RW Z SKEYID_e RW Z Ephemeral DH Phase 1 private key RW Z Ephemeral Phase 2 DH private key RW Z IPSEC Session Keys RW R Z FRF 17 Session Keys RW R Z SSH RSA Private Key RW Z RW SSH DSA Private Key RW Z RW SSH Session Keys RW Z SSH DH Private Key RW Z Root Password RW Z User Admin RW Z...

Page 15: ...e MNR S2500 router provides five distinct operator roles Crypto Officer SuperUser Admin Network Manager User and Maintenance The Crypto Officer role uses the root account 2 The MNR S2500 router encrypts message traffic using the AES or TDES algorithm 3 The MNR S2500 router performs the following tests A Power up Self Tests 1 Cryptographic algorithm tests Hardware Implementation a AES CBC Known Ans...

Page 16: ...r on the module and verify successful completion of power up self tests from console port or inspection of log file 2 Authenticate to the module using the default user acting as the Crypto Officer with the default password and username 3 Verify that the Hardware and Firmware P Ns and version numbers of the module are the FIPS approved versions 4 Change the Network Manager Crypto Officer and User p...

Page 17: ...itions and Acronyms AES Advanced Encryption Standard CBC Cipher Block Chaining CLI Command Line Interface CSP Critical Security Parameter DH Diffie Hellman DRNG Deterministic Random Number Generator FRF Frame Relay Forum FRF 17 Frame Relay Privacy Implementation Agreement FRPP Frame Relay Privacy Protocol HMAC Hash Message Authentication Code IKE Internet Key Exchange IP Internet Protocol IPsec In...

Page 18: ...Revision Date 1 13 2009 Page 18 PFS Perfect Forward Secrecy RNG Random Number Generator SHA Secure Hash Algorithm SSH Secure Shell SNMP Simple Network Management Protocol Tanapa The part number that is built and stocked for customer orders ...

Reviews:

No comments

Related manuals for S2500

Brand: N-Tron Pages: 101

Brand: IBM Pages: 72

Express Ethernetwork DI-704P

Brand: D-Link Pages: 2

Express Ethernetwork DI-704P

Brand: D-Link Pages: 17

Brand: D-Link Pages: 2

Brand: D-Link Pages: 7

Brand: D-Link Pages: 41

Brand: D-Link Pages: 267

Brand: D-Link Pages: 13

Brand: Watchguard Pages: 40

AirPlus DWL-810

Brand: D-Link Pages: 25

AirPlus DWL-810

Brand: D-Link Pages: 8

Brand: D-Link Pages: 11

Brand: D-Link Pages: 84

Verizon DSL-2750B

Brand: D-Link Pages: 2

Brand: D-Link Pages: 4

AirPlus G DWL-G710

Brand: D-Link Pages: 5

Brand: D-Link Pages: 12

Brands by name

0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Popular brands

Load more brands