Cisco ISR 4000 Family Routers Administrator Guidance
Page
62
of
66
7.
Modes of Operation
An IOS router has several modes of operation, these modes are as follows:
Booting
– while booting, the routers drop all network traffic until the router image and
configuration has loaded. This mode of operation automatically progresses to the Normal
mode of operation. During booting, an administrator may press the break key on a console
connection within the first 60 seconds of startup to enter the ROM Monitor mode of
operation. This Booting mode is referred to in the IOS guidance documentation as “ROM
Monitor Initialization”. Additionally if the Router does not find a valid operating system
image it will enter ROM Monitor mode and not normal mode therefore protecting the
router from booting into an insecure state.
Normal
- The IOS router image and configuration is loaded and the router is operating as
configured. It should be noted that all levels of administrative access occur in this mode
and that all router based security functions are operating. While operating the router have
little interaction with the administrator. However, the configuration of the router can have
a detrimental effect on security. Misconfiguration of the router could result in the
unprotected network having access to the internal/protected network
ROM Monitor
– This mode of operation is a maintenance, debugging, and disaster
recovery mode. While the router is in this mode, no network traffic is routed between the
network interfaces. In this state the router may be configured to upload a new boot image
from a specified TFTP server, perform configuration tasks and run various debugging
commands. It should be noted that while no administrator password is required to enter
ROM monitor mode, physical access to the router is required; therefore, the router should
be stored in a physically secure location to avoid unauthorized access which may lead to
the router being placed in an insecure state.
Following operational error, the TOE reboots (once power supply is available) and enters
booting mode. The only exception to this is if there is an error during the Power on Startup
Test
(
POST) during bootup, then the TOE will shut down. If any component reports failure
for the POST, the system crashes and appropriate information is displayed on the screen,
and saved in the crashinfo file. Within the POST, self-tests for the cryptographic
operations are performed. The same cryptographic POSTs can also be run on-demand as
described in section 3.2.3
,
and when the tests are run on-demand after system startup has
completed (and the syslog daemon has started), error messages will be written to the log.
All ports are blocked from moving to forwarding state during the POST. Only when all
components of all modules pass the POST is the system placed in FIPS PASS state and
ports are allowed to forward data traffic.
If any of the POST fails, the following actions should be taken:
If possible, review the crashinfo file. This will provide additional information on the
cause of the crash
