Cisco Cat4K NDPP ST
11 March 2014
EDCS-1228241
78
TOE SFRs
How the SFR is Met
configuration exec mode via the privileged mode of operation of
the switch. The clock function is reliant on the system clock
provided by the underlying hardware. The timestamp is assumed
to be accurate to an official time source, such as Network Time
Protocol (NTP) server. Therefore, the TOE can optionally be set
to receive time from an NTP server. The NTP synchronizes the
TOE clock to the U.S. Naval Observatory Master Clocks in
Washington, DC and Colorado Springs CO. The NTP sends
periodic requests and adjusts the clock as necessary. If an NTP
server is used, the TOE supports signature verification of the
timestamp from the time server.
FPT_TUD_EXT.1
The TOE has specific versions that can be queried by an
administrator. When updates are made available by Cisco, an
administrator can obtain and install those updates. The
cryptographic checksums (i.e., public hashes) are used to verify
software/firmware update files (to ensure they have not been
modified from the originals distributed by Cisco) before they are
used to actually update the applicable TOE components.
FPT_TST_EXT.1
As a FIPS 140-2 validated product, the TOE runs a suite of self-
tests during initial start-up to verify its correct operation. If any of
the tests fail, the security administrator will have to log into the
CLI to determine which test failed and why. If the tests pass
successfully the login prompt is displayed and the administrator
will be able to login and administer the TOE. Refer to the FIPS
Security Policy for available options and management of the
cryptographic self-test.
For testing of the TSF, the TOE automatically runs checks and
tests at startup and during resets to ensure the TOE hardware and
software components are available and operating correctly. If all
components pass the tests, the login prompt will be displayed. If
any of the tests fail, the TOE will reboot to try to correct the
issue(s). Refer to the Guidance documentation for installation
configuration settings and information and troubling shooting if
issues are identified.
FRU_RSA.1
An administrator can configure a maximum number of
concurrent sessions for remote administrative interfaces.
FTA_SSL_EXT.1
and FTA_SSL.3
An administrator can configure maximum inactivity times for
both local and remote administrative sessions. When a session
is inactive (i.e., not session input) for the configured period of
time the TOE will terminate the session, flush the screen, and
no further activity is allowed requiring the administrator to log
in (be successfully identified and authenticated) again to
establish a new session.
