Cisco 2811 User Manual

23
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Related Documentation
• RADIUS and TACACS+ shared secret key sizes must be at least 8 characters long, and must include
at least one number and one letter.
IPSec Requirements and Cryptographic Algorithms
• The only type of key management that is allowed in FIPS mode is Internet Key Exchange (IKE).
• Although the IOS implementation of IKE allows a number of algorithms, only the following
algorithms are allowed in a FIPS 140-2 configuration:
– ah-sha-hmac
– esp-des
– esp-sha-hmac
– esp-3des
– esp-aes
• The following algorithms are not FIPS approved and should not be used during FIPS-approved
mode:
– RSA
– MD-5 for signing
– MD-5 HMAC
Protocols
• SNMP v3 over a secure IPSec tunnel may be employed for authenticated, secure SNMP gets and
sets. Since SNMP v2C uses community strings for authentication, only gets are allowed under
SNMP v2C.
• SSL is not an Approved protocol, and shall not be used in FIPS mode.
Remote Access
• Telnet access to the module is only allowed via a secure IPSec tunnel between the remote system
and the module. The Crypto officer must configure the module so that any remote connections via
telnet are secured through IPSec, using FIPS-approved algorithms. Note that all users must still
authenticate after remote access is granted.
• SSH access to the module is only allowed if SSH is configured to use a FIPS-approved algorithm.
The Crypto officer must configure the module so that SSH uses only FIPS-approved algorithms.
Note that all users must still authenticate after remote access is granted.
Related Documentation
For more information about the Cisco 2811 and Cisco 2821 Integrated Services Routers, refer to the
following documents:
• Cisco 2800 Series Integrated Services Routers Quick Start Guides
• Cisco 2800 Series Hardware Installation documents

Cisco 2811 Specifications

General

Full duplex	Yes
Networking standards	-
Ethernet LAN data rates	10, 100 Mbit/s
Supports ISDN connection	No
Safety	UL 60950, CAN/CSA C22.2 No. 60950, IEC 60950, EN 60950-1, AS/NZS 60950
Flash memory	128 MB
Internal memory	256 MB
I/O ports	2 x USB\\r 2 x 10/100 Base-T
Ethernet LAN (RJ-45) ports	2
Storage temperature (T-T)	-40 - 70 °C
Firewall security	Cisco IOS
Security algorithms	128-bit AES, 192-bit AES, 256-bit AES, 3DES, DES
Product color	Blue, Stainless steel
Rack capacity	1U

Weight and Dimensions

Depth	416.6 mm
Width	438.2 mm
Height	44.5 mm
Weight	6400 g