Cisco 7606 User Manual

Corporate Headquarters:
© 2005 Cisco Systems, Inc. All rights reserved.
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Catalyst 6509 Switch, Cisco 7606 Router, and
Cisco 7609 Router with VPN Services Module
Certification Note
This is the non-proprietary Cryptographic Module Security Policy for the Catalyst 6509 switch and the
Cisco 7606 and Cisco 7609 routers with the VPN Services Module:
• Hardware Version
– Catalyst 6509 switch
– Cisco 7606 router
– Cisco 7609 router
• Backplane chassis
– Hardware Version 3.0 (Catalyst 6509 switch)
– Hardware Version 1.0 (Cisco 7606 router)
– Hardware Version 1.0 (Cisco 7609 router)
• Supervisor Engine—Hardware Version 3.2
• VPN Services Module—Hardware Version 1.2; Firmware Version; 12.2(14)SY3
This security policy describes how the Catalyst 6509 switch and the Cisco 7606 and Cisco 7609 routers
with the VPN Services Module meet the security requirements of FIPS 140-2, and describes how to
operate the hardware devices in a secure FIPS 140-2 mode. This policy was prepared as part of the
Level 2 FIPS 140-2 validation of the Catalyst 6509 switch and the Cisco 7606 and Cisco 7609 routers
with the VPN Services Module.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2—Security Requirements for
Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the NIST website at
http://csrc.nist.gov/cryptval/.

Cisco 7606 Specifications

General

Product Type	Router
Form Factor	Rack-mountable
Number of Slots	6
Manageable	Yes
Model	7606
Redundancy	Yes
Operating Temperature	32°F to 104°F (0°C to 40°C)
Routing Protocol	BGP, OSPF, EIGRP, IS-IS, RIP, PIM
Product Series	7600
Operating System	Cisco IOS

Summary

Catalyst 6509/Cisco 7606/Cisco 7609 Cryptographic Module

Module Interfaces

The switch and router chassis physical interfaces are located on the supervisor engine front panel.

Roles and Services

Crypto Officer Role

The crypto officer role is responsible for the configuration and maintenance of the router.

User Services

A user enters the system by accessing the console port with a terminal program.

Installing the Opacity Shield on the Catalyst 6509 Switch

Installing the Opacity Shield on the Cisco 7600 Series Routers

Physical Security

Cryptographic Key Management

Key Zeroization

Self-Tests

Cisco IOS Software Self-Tests

Lists the self-tests performed by the Cisco IOS software on the module.

Secure Operation of the Catalyst 6509 Switch and the Cisco 7606 and Cisco 7609 Routers

Initial Setup

Details requirements for crypto officers before configuring the router or switch.

Initializing and Configuring the System

Outlines the operations crypto officers must perform for initial system configuration.

IPsec Requirements and Cryptographic Algorithms

Specifies allowed and disallowed IPsec algorithms for FIPS 140-2 configuration.

Protocols

Remote Access