26|
Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
Data input and output, control input, status output, and power interfaces are defined as follows:
Data input and output are the packets that use the networking functionality of the module.
Control input consists of manual control inputs for power and reset through the power interfaces (power
supply or POE). It also consists of all of the data that is entered into the access point while using the
management interfaces. A reset button is present which is used to reset the AP to factory default settings.
Status output consists of the status indicators displayed through the LEDs, the status data that is output
from the module while using the management interfaces, and the log file.
o
LEDs indicate the physical state of the module, such as power-up (or rebooting), utilization level,
and activation state. The log file records the results of self-tests, configuration errors, and
monitoring data.
The module may be powered by an external power supply. Operating power may also be provided via a
Power Over Ethernet (POE) device, when connected, the power is provided through the connected
Ethernet cable.
The Console port is disabled when operating in FIPS mode by a TEL.
The module distinguishes between different forms of data, control, and status traffic over the network ports by
analyzing the packets header information and contents.
7. Roles, Authentication and Services
7.1
Roles
The module supports role-based authentication. There are two roles in the module (as required by FIPS 140-2 Level 2)
that operators may assume: a Crypto Officer role and a User role. The Administrator maps to the Crypto-Officer role
and the wireless client maps to the User role. A Slave IAP can also function under User role. Slave IAPs are non-
Approved by policy in FIPS mode.
7.1.1 Crypto Officer Role
The Crypto Officer role has the ability to configure, manage, and monitor the controller. One management interface
can be used for this purpose:
•
SSHv2 CLI
The Crypto Officer can use the CLI to perform non-security-sensitive and security-sensitive monitoring and
configuration. The CLI can be accessed remotely by using the SSHv2 secured management session over
the Ethernet ports or locally over the serial port. In FIPS Approved Mode, the serial port is disabled. The
Crypto Officer can also create another “View Only” Crypto Officer User, which would have view only access
to the CLI and would authenticate in the same manner.
•
Web Interface
The Crypto Officer can use the Web Interface as an alternative to the CLI. The Web Interface provides a
highly intuitive, graphical interface for a comprehensive set of management tools. The Web Interface can
be accessed from a TLS-enabled Web browser using HTTPS (HTTP with Secure Socket Layer).
7.1.2 User Role
The User role can access the module’s wireless services using WPA2.
