SV3800, SV3800B, and SV3800B-20 Security Policy
2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
18
For FIPS 140-2 Level 2 validation the SV3800B-20 was tested with the following
configuration:
•
SV3800B chassis with 2 x NFE acceleration card installed
2 x Intel E5-2640 V3, 8 core CPU and 128GB of memory
This configuration is model number SV3800B-20.
The module is a multi-chip standalone module that meets overall FIPS 140-2 Level
2 requirements. The module is validated to the following FIPS 140-2 section levels:
Table 2
–3 Security Levels Per FIPS 140-2 Section
FIPS 140-2 Section
Section Title
Validated Level
1
Cryptographic Module Specification
2
2
Cryptographic Module Ports and Interfaces
2
3
Roles, Services and Authentication
2
4
Finite State Model
2
5
Physical Security
2
6
Operational Environment
Not applicable
7
Cryptographic Key Management
2
8
Electromagnetic Interference /
Electromagnetic Compatibility
2
9
Self-Tests
2
10
Design Assurance
3
11
Mitigation of Other Attacks
Not applicable
2.3 Module Interfaces
The logical cryptographic boundary of the module is shown in the following
pictures and diagrams. All of the Netmod interfaces and the switching module
that plug into the front of the SV3800/SV3800B/SV3800B-20 connect to the
network segments on which traffic is being monitored/inspected. These ports
are only used to access the network data that is being processed by the
SV3800/SV3800B/SV3800B-20; they do not allow access to the management
services of the SV3800/SV3800B/SV3800B-20. The Netmods and associated
switch are therefore outside the logical cryptographic boundary. Data
input/output to the module from the Netmods and associated switch is via four
internal 10Gbps Ethernet connections carried over iPass connectors/cables.
The two pluggable power supply units and the bays that they plug into are not
associated with any cryptographic processes, keys, critical security parameters
(CSP), or any FIPS relevant data, and are therefore deemed to be outside of the
cryptographic boundary.
