Avaya G250-BRI, User Manual

Page 1: ...eproduced only in its original entirety without revision Page 1 of 23 CID 108398 Avaya G250 and G250 BRI Branch Office Media Gateways w FIPS Non Proprietary Security Policy Avaya Inc Revision Date 14 December 2005 Version 1 2 ...

Page 2: ... 6 3 PORTS AND INTERFACES 8 3 1 G250 PORTS AND INTERFACES 8 3 2 G250 BRI PORTS AND INTERFACES 10 4 IDENTIFICATION AND AUTHENTICATION POLICY 11 4 1 ASSUMPTION OF ROLES 11 4 2 STRENGTHS OF AUTHENTICATION MECHANISMS 12 5 ACCESS CONTROL POLICY 13 5 1 SERVICES 13 5 2 ROLES AND SERVICES 15 5 3 DEFINITION OF CRITICAL SECURITY PARAMETERS CSPS 16 5 4 DEFINITION OF CSPS MODES OF ACCESS 17 6 OPERATIONAL ENVI...

Page 3: ...be administered from a central location The G250 and G250 BRI share common hardware and firmware compatibility other than that G250 BRI contains additional ISDN B circuitry with 2 ISDN BRI trunks plus 1 Analog trunk versus 4 Analog trunks in G250 The rules in this policy generally apply to all the above devices Exceptions are explicitly rendered by device name otherwise general cryptographic modul...

Page 4: ...module cryptographic boundary includes all of the components within the physical enclosure of the chassis without any expansion modules plugged in The figure below Figure 2 illustrates G250 BRI cryptographic module Figure 2 G250 BRI Cryptographic module 1 Security Level The module cryptographic module meets the overall requirements applicable to Level 1 security of FIPS 140 2 Security Requirements...

Page 5: ...umber exchange c AES CBC 128 192 256 bit for IPSec and IKE encryption d SHA 1 for hashing download image digest license file digest e HMAC SHA 1 for message authentication codes for IKE and IPSEC f DES CBC for encryption of IPSec and IKE only supported for communication with legacy systems transitional phase only valid until May 19 2007 g Diffie Hellman key agreement protocol groups 2 5 14 used to...

Page 6: ... d Avaya Media Encryption AEA for encryption decryption e SSH v2 use of MD5 DH group 786 2048 non compliant TDES non compliant DES in non FIPS mode only commercially available key establishment protocol f HMAC SHA 1 used in non compliant manner in SNMPv3 in non FIPS mode only 2 3 Entering FIPS Mode To enter FIPS mode the Crypto Officer must follow the procedure outlined in the Table 2 below Step D...

Page 7: ...need to be removed New secret need to be assigned to Radius and PPPoE 21 Activate enhanced security mode 22 Define an Access Control list that block packets with IP destination address of any of the module interfaces for the following protocols TELNET FTP TFTP SNMP Activate the ACL on the inbound direction of all clear text interfaces 23 Configure packet forwarding static routes dynamic routes lea...

Page 8: ...igure 3 G250 faceplate The G250 cryptographic module provides the physical ports and logical interfaces defined in Table 3 below Interface Qty Logical interface definition Comments 1 ETH LAN POE 8 Data input data output status output control input power outout Supports local area network connectivity 2 ETH WAN 1 Data input data output status output control input Supports wide area network connecti...

Page 9: ...e administration 7 USB 1 Control inputs Status output Power output Supports cryptographic module administration for modem dial in connection Disabled in FIPS Approved mode 8 Media Module Connectors 2 Data input data output status output control input Provide the ability to communicate using Serial TDM Data Ethernet PCI CPU Device Bus facilitates Power 9 AC Power Input 1 Power Input Provides power ...

Page 10: ...a input data output status output control input Supports wide area network connectivity 3 CCA 1 Power output Contact Closure Adjunct Powers two contact closure relays 4 Analog Line 2 Analog Phones Line1 Line2 Data input output power output Line 2 ceases to be a data input output from the module and is directly connected to Analog Trunk providing a power interface when an emergency state occurs a P...

Page 11: ...Control Input Resets the device 13 ASB Button 1 Control Input When pressed with the reset button cause the device to boot from an alternate firmware image bank 14 System LEDs 4 Status Output Indicates Power Modem connection through Console interface CPU activity and Alarm state 15 LEDs on ETH WAN 2 Status Output Link state and activity indication on the associated data interface 16 LEDs on ETH LAN...

Page 12: ...D5 hash of the packet and the secret An entity authenticates to the module for the purpose of permitting denying access to services PPPoE client Role based operator authentication Chap Pap Secrets Simple password authentication is used for PAP based authentication Gateway use MD5 function to hash the challenge and the secret value in the response message to PPPoE Server An entity that facilitates ...

Page 13: ...to power cycle via a remote command Read all status indications obtain all statuses securely via IPSEC console port and LEDs on the front panel of a Gateway This service also reports about the status of the bypass capability Bypass status is reported by CLI commands show ip active lists crypto show ip crypto list show crypto ipsec transform set available from the console and remote telnet Read sub...

Page 14: ...n over an Ethernet link Radius authentication authenticate communication between the module and a primary or secondary Radius server Unauthenticated Services Show status provide the status of the cryptographic module the status is shown using the LEDs on the front panel Constantly lit CPU led indicates normal operation Flashing CPU led indicates operation in error state Self tests execute the suit...

Page 15: ... Radius Client IKE Peer OSPF Router peer PPPoE client Serial Number Peer Enable FIPS mode X Firmware Update X CSPs Management X X User Management X Module configuration X X Reset X X Read all status indications X Read subset of status indications X X X Module configuration backup X X Module configuration Restore X Zeroization X IKE negotiation X X X X IPSec traffic processing X X X X Serial Number...

Page 16: ...DH exchange Generated for VPN IKE Phase 1 key establishment IKE Session Phase 1 Secret SKEYID_d Phase 1 key used to derive keying material for IPSec Sas IKE Session Phase 1 HMAC Key SKEYID_a Key used for integrity and authentication of the ISAKMP SA IKE Session Phase 1 Encrypted Key SKEYID_e Shared key used for extraction of encryption keys protecting the ISAKMP SA IKE Session Phase 1 TDES key Key...

Page 17: ...9 31 PRNG Table 8 CSPs and private keys The following are the public keys contained in the module Key Description Usage IKE Ephemeral DH Phase 1 public keys Generated for VPN IKE Phase 1 key establishment IKE Ephemeral DH Phase 2 public keys Generated for VPN IKE Phase 2 PFS key renewal Image download certificate Avaya root CA RSA public key Used for authentication of software download The Avaya R...

Page 18: ...tions OSPF routing PPPoE Service Radius Authentication Serial Number Exchange PRNG keys RWZ ZW Z R IKE Pre shared Keys RWZ W Z Z R Pre shared Session Key SKEYID Z Z RW Ephemeral DH private key Z Z RW Ephemeral DH shared secret Z Z RW HASH_I HASH_R Z Z RW IKE session Phase 1 Secret SKEYID_d Z Z RW IKE Phase 1 HMAC Key SKEYID_a Z Z RW IKE Session Phase 1 SKEYID_e Z Z RW IKE Session Phase 1 TDES Z Z ...

Page 19: ...oot password RW RW R W R R R R R W R OSPF Secret WZ WZ Z Z R Radius Secret WZ WZ Z R PPPoE Chap PAP Secret WZ W Z Z R SNMPv3 authentication password WZ R R WZ R R R R R Z Fixed Serial Number secret W Z R Ephemeral Serial Number secret Z Z RW IKE Ephemeral DH public keys Z Z RW IKE Ephemeral DH Phase 2 public keys Z Z RW Avaya root CA RSA public key RW License RSA public key R RW Table 10 CSP Acces...

Page 20: ... Software Integrity Test 32 bit CRC verification and Booter Integrity Test 32 bit CRC verification Critical Functions Tests Non Volatile Random Memory NVRAM Integrity test EEPROM Integrity Test 3 The cryptographic module shall perform the Conditional Self Tests Continuous Random Number Generator RNG test performed on all RNGs supporting crypto activities in FIPS Approved mode Done for PRNG x9 31 a...

Page 21: ...Details Production grade components and production grade enclosure N A N A Table 8 Inspection Testing of Physical Security Mechanisms 9 Mitigation of Other Attacks Policy The FIPS 140 2 Area 11 requirements are not applicable because the cryptographic module has not been designed to mitigate specific attacks outside of the scope of FIPS 140 2 Other Attacks Mitigation Mechanism Specific Limitations...

Page 22: ...e Adjunct CLI Command Line Interface CNA Converged Network Analyzer DES Data Encryption Standard DH Diffie Hellman DSS Digital Signature Standard FTP File Transfer Protocol HMAC Hash Message Authentication Code IKE Internet Key Exchange IP Internet Protocol ISDN Integrated Services Digital Network LAN Local Area Network KAT Known Answer Test OSPF Open Shortest Path First PFS Perfect Forward Secrec...

Page 23: ...S Non Proprietary Security Policy Version 1 2 Wednesday 14 December 2005 2005 Avaya Inc May be reproduced only in its original entirety without revision Page 23 of 23 CID 106595 TFTP Trivial File Transfer Protocol USB Universal Serial Bus WAN Wide Area Network ...