Applying TELs
The Crypto Officer should employ TELs as follows:
•
Before applying a TEL, make sure the target surfaces are clean and dry.
•
Do not cut, trim, punch, or otherwise alter the TEL.
•
Apply the wholly intact TEL firmly and completely to the target surfaces.
•
Press down firmly across the entire label surface, making several back-and-forth passes to ensure that the label
securely adheres to the chassis.
•
Ensure that TEL placement is not defeated by simultaneous removal of multiple modules.
•
Allow 24 hours for the TEL adhesive seal to completely cure.
•
Record the position and serial number of each applied TEL in a security log.
Once the TELs are applied, the Crypto Officer (CO) should perform initial setup and configuration as described in the next
chapter.
Ongoing Management
The Aruba 7XXX Controllers meet FIPS 140-2 Level 2 requirements. The information below describes how to keep the
controller in FIPS-approved mode of operation. The Crypto Officer must ensure that the controller is kept in a FIPS-
approved mode of operation.
Crypto Officer Management
The Crypto Officer must ensure that the controller is always operating in a FIPS-approved mode of operation. This can be
achieved by ensuring the following:
•
FIPS mode must be enabled on the controller before Users are permitted to use the controller (see
“Enabling FIPS
Mode” on page 37
)
•
The admin role must be root.
•
Passwords must be at least eight characters long.
•
VPN services can only be provided by IPsec or L2TP over IPsec.
•
Access to the controller Web Interface is permitted only using HTTPS over a TLS tunnel. Basic HTTP and HTTPS
over SSL are not permitted.
•
Only SNMP read-only may be enabled.
•
Only FIPS-approved algorithms can be used for cryptographic services (such as HTTPS, L2, AES-CBC, SSH, and
IKEv1/IKEv2-IPSec), which include AES, Triple-DES, SHA-1, HMAC SHA-1, and RSA signature and verification.
•
TFTP can only be used to load backup and restore files. These files are: Configuration files (system setup
configuration), the WMS database (radio network configuration), and log files. (FTP and TFTP over IPsec can be used
to transfer configuration files.)
•
The controller logs must be monitored. If a strange activity is found, the Crypto Officer should take the controller off
line and investigate.
•
The Tamper-Evident Labels (TELs) must be regularly examined for signs of tampering.
•
When installing expansion or replacement modules for the Aruba 7200, use only FIPS-approved modules, replace
TELs affected by the change, and record the reason for the change, along with the new TEL locations and serial
numbers, in the security log.
•
The Crypto Officer shall not configure the Diffie-Hellman algorithm with 768-bits (Group 1) in FIPS mode for
IKEv1/IKEv2-IPSec and SSHv2.
42
|
Aruba 7XXX Series Controllers FIPS 140-2 Level 2 Security Policy