Zte ZXR10 M6000 Series - Page 49

Chapter7RATIONALE
OBJECTIVESSFRRationale
lFTP_ITC.2(2)requiresthatatrustedchannel
betweentheTSFandtheRADIUS/TACACS+
beprovidedforuserauthentication.
O.MEDIATE
TheTOEshallcontroltheowofinformation
amongitsnetworkconnectionsaccordingto
routingrulesandBGPv4/OSPFv2/IS-IS/RIPv2
routingprotocol
Thisobjectiveismetby:
lFDP_IFC.1(1)identiestheentitiesinvolved
intheunauthenticatedInformationFlow
ControlSFP(i.e.externalITentitiessending
packets).
lFDP_IFF.1(1)identiestheconditions
underwhichinformationispermittedto
owbetweenentities(theunauthenticated
InformationFlowControlSFP).
lFDP_IFC.1(2)identiestheentitiesinvolved
intheexportInformationFlowControlSFP
(i.e.externalITentitiessendingpackets).
lFDP_IFF.1(2)identiestheconditions
underwhichinformationispermittedtoow
betweenentities(theexportInformationFlow
ControlSFP).
lFMT_MSA.1restrictstheabilitytomodify,
delete,orquerytheparametersforthe
unauthenticatedSFPtoanadministrator.
lFMT_MSA.3ensuresthatthereisa
default-denypolicyfortheunauthorizedSFP .
O.TOE_ACCESS
TheTOEwillprovidemechanismsthatcontrolan
administrator’slogicalaccesstotheTOEandto
explicitlydenyaccesstospecicadministrators
whenappropriate.
Thisobjectiveismetby:
lFTA_SSL.3TheTOEwillterminatean
interactivesessionafteranadministrator
denedtimeintervalofadministrator
inactivity.
lFTA_TSE.1providesrequirementsfor
denyinguser’saccesstotheTOEbasedon
attributes.
lFTP_ITC.1(1)requiresthatatrustedchannel
betweentheTSFandtheremoteclientbe
providedforremoteadministration.
O.ROUTE
TheTOEshallbeabletoacceptrouting
datafromtrustedroutersaccordingto
BGPv4/OSPFv2/IS-IS/RIPv2.
Thisobjectiveismetby:
lFDP_UIT.1transmitsandreceivesrouting
datato/fromtrustedroutersinamanner
protectedfrommodication,insertionand
replayerrors.
7-5
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION