Cisco ISR 4000 Family Routers Administrator Guidance
Page
15
of
66
into the vty lines. Reference password (line configuration) in Cisco IOS Security Command
Reference: Commands M to R -> pac key through port-misuse -> password (line configuration)
[8]
4 – Configure SNMP Network Management – No (this is the default). Note that this setting can be
confirmed after configuration is complete by examining the configuration file to ensure that there
is no “snmp-server” entry. To ensure there is no snmp server agent running, use the “
no snmp-
server
’ command as described in Configuring SNMP -> Disabling the SNMP Agent
[3]
Note, in
the evaluated configuration, SNMP should remain disabled.
3.2.2 Saving Configuration
IOS uses both a running configuration and a starting configuration. Configuration changes affect
the running configuration, in order to save that configuration the running configuration (held in
memory) must be copied to the startup configuration. This may be achieved by either using the
write memory
command or the
copy
system:running-config nvram:startup-config
command.
These commands should be used frequently when making changes to the configuration of the
Router. If the Router reboots and resumes operation when uncommitted changes have been made,
these changes will be lost and the Router will revert to the last configuration saved.
3.2.3 Enabling FIPS Mode
The TOE must be run in the FIPS mode of operation. The use of the cryptographic engine in any
other mode was not evaluated nor tested during the CC evaluation of the TOE. This is done by
setting the following in the configuration:
The value of the boot field must be 0x0102. This setting disables break from the console to the
ROM monitor and automatically boots the IOS image. From the ROMMON command line enter
the following:
confreg 0x0102
The self-tests for the cryptographic functions in the TOE are run automatically during power-on
as part of the POST. The same POST self-tests for the cryptographic operations can also be
executed manually at any time by the privileged administrator using the command:
test crypto self-test
If any of the self-tests fail, the TOE transitions into an error state. In the error state, all secure data
transmission is halted and the TOE outputs status information indicating the failure.
3.2.4 Administrator Configuration and Credentials
The ISR-4400
must be configured to use a username and password for each administrator and one
password for the enable command. Ensure all passwords are stored encrypted by using the
following command:
TOE-common-criteria(config)#
service password-encryption
Configures local AAA authentication:
TOE-common-criteria(config)#
aaa authentication login default local
TOE-common-criteria(config)#
aaa authorization exec default local
