Cisco 2811 User Manual

12
Cisco 2811 and Cisco 2821 Integrated Services Router FIPS 140-2 Non Proprietary Security Policy
OL-8663-01
Cisco 2811 and Cisco 2821 Routers
Crypto Officer Services
During initial configuration of the router, the Crypto Officer password (the “enable” password) is
defined. A Crypto Officer can assign permission to access the Crypto Officer role to additional accounts,
thereby creating additional Crypto Officers.
The Crypto Officer role is responsible for the configuration and maintenance of the router. The Crypto
Officer services consist of the following:
• Configure the router—Define network interfaces and settings, create command aliases, set the
protocols the router will support, enable interfaces and network services, set system date and time,
and load authentication information.
• Define Rules and Filters—Create packet Filters that are applied to User data streams on each
interface. Each Filter consists of a set of Rules, which define a set of packets to permit or deny based
on characteristics such as protocol ID, addresses, ports, TCP connection establishment, or packet
direction.
• View Status Functions—View the router configuration, routing tables, active sessions, use gets to
view SNMP MIB statistics, health, temperature, memory status, voltage, packet statistics, review
accounting logs, and view physical interface status.
• Manage the router—Log off users, shutdown or reload the router, manually back up router
configurations, view complete configurations, manage user rights, and restore router configurations.
• Set Encryption/Bypass—Set up the configuration tables for IP tunneling. Set keys and algorithms
to be used for each IP range or allow plaintext packets to be set from specified IP address.
Physical Security
The router is entirely encased by a metal, opaque case. The rear of the unit contains HWIC/WIC/VIC
connectors, LAN connectors, a CF drive, power connector, console connector, auxiliary connector, USB
port, and fast Ethernet connectors. The front of the unit contains the system status and activity LEDs.
The top, side, and front portion of the chassis can be removed to allow access to the motherboard,
memory, AIM slot, and expansion slots.
Once the router has been configured in to meet FIPS 140-2 Level 2 requirements, the router cannot be
accessed without signs of tampering. To seal the system, apply serialized tamper-evidence labels as
follows:
To apply serialized tamper-evidence labels to the Cisco 2811:
Step 1 Clean the cover of any grease, dirt, or oil before applying the tamper evidence labels. Alcohol-based
cleaning pads are recommended for this purpose. The temperature of the router should be above 10 C.
Step 2 The tamper evidence label should be placed so that one half of the label covers the front panel and the
other half covers the enclosure.
Step 3 The tamper evidence label should be placed over the CF card in the slot so that any attempt to remove
the card will show sign of tampering.
Step 4 The tamper evidence label should be placed so that the one half of the label covers the enclosure and the
other half covers the port adapter slot.

Cisco 2811 Specifications

General

Full duplex	Yes
Networking standards	-
Ethernet LAN data rates	10, 100 Mbit/s
Supports ISDN connection	No
Safety	UL 60950, CAN/CSA C22.2 No. 60950, IEC 60950, EN 60950-1, AS/NZS 60950
Flash memory	128 MB
Internal memory	256 MB
I/O ports	2 x USB\\r 2 x 10/100 Base-T
Ethernet LAN (RJ-45) ports	2
Storage temperature (T-T)	-40 - 70 °C
Firewall security	Cisco IOS
Security algorithms	128-bit AES, 192-bit AES, 256-bit AES, 3DES, DES
Product color	Blue, Stainless steel
Rack capacity	1U

Weight and Dimensions

Depth	416.6 mm
Width	438.2 mm
Height	44.5 mm
Weight	6400 g