Cisco ASR 1000 Series User Manual

Page 32 of 72
Crypto map entries also include transform sets. A transform set is an acceptable combination of
security protocols, algorithms, and other settings that can be applied to IPsec-protected traffic.
During the IPsec SA negotiation, the peers agree to use a particular transform set when
protecting a particular data flow.
4.6.1.1 IKEv1 Transform Sets
An Internet Key Exchange version 1 (IKEv1) transform set represents a certain combination of
security protocols and algorithms. During the IPsec SA negotiation, the peers agree to use a
particular transform set for protecting a particular data flow.
Privileged administrators can specify multiple transform sets and then specify one or more of
these transform sets in a crypto map entry. The transform set defined in the crypto map entry is
used in the IPsec SA negotiation to protect the data flows specified by that crypto map entry's
access list.
During IPsec security association negotiations with IKE, peers search for a transform set that is
the same at both peers. When such a transform set is found, it is selected and applied to the
protected traffic as part of both peers' IPsec SAs. (With manually established SAs, there is no
negotiation with the peer, so both sides must specify the same transform set.)
Note: If a transform set definition is changed during operation that the change is not applied to
existing security associations, but is used in subsequent negotiations to establish new SAs. If you
want the new settings to take effect sooner, you can clear all or part of the SA database by using
the clear crypto sa command.
The following settings must be set in configuring the IPsec with IKEv1 functionality for the
TOE:
TOE-common-criteria # conf t
TOE-common-criteria (config)#crypto isakmp policy 1
TOE-common-criteria (config-isakmp)# hash sha
TOE-common-criteria (config-isakmp)# encryption aes
This configures IPsec IKEv1 to use AES-CBC-128 for payload encryption. AES-
CBC-256 can be selected with ‘encryption aes 256’.
Note: the authorized administrator must ensure that the keysize for this setting is
greater than or equal to the keysize selected for ESP in Section 4.6.2 below. If
AES 128 is selected here, then the highest keysize that can be selected on the TOE
for ESP is AES 128 (either CBC or GCM).
Note: Both confidentiality and integrity are configured with the hash sha and
encryption aes commands respectively. As a result, confidentiality-only mode is
disabled.
TOE-common-criteria (config-isakmp)# authentication pre-share
This configures IPsec to use pre-shared keys. X.509 v3 certificates are also
supported for authentication of IPsec peers. See Section 4.6.3 below for additional
information.

Cisco ASR 1000 Series Specifications

General

Series	ASR 1000
Category	Network Router
Operating System	Cisco IOS XE
Memory	Up to 64 GB
Interfaces	10 Gigabit Ethernet
Power Supply	AC or DC options
Dimensions	Varies by model
Encryption	IPsec, SSL
Storage	Varies by model
Operating Temperature	32°F to 104°F (0°C to 40°C)
Humidity	5% to 95% non-condensing
MTBF	Varies by model

Summary

Document Introduction

Introduction to Cisco ASR 1000 Series Common Criteria Guidance

Supported Hardware and Software

Details the specific hardware and software versions compliant with CC evaluation.

Operational Environment

Lists supported external hardware, software, and firmware components for TOE operation.

Excluded Functionality

Identifies functionality not covered or excluded from the TOE's CC evaluation.

Secure Acceptance of the Target of Evaluation (TOE)

Secure Installation and Configuration Procedures

Physical Installation

Guides hardware installation using Cisco ASR 1000 Series Router Hardware Installation Guide.

Initial Setup via Direct Console Connection

Details initial configuration steps via console before network connection.

Network Protocols and Cryptographic Settings

Covers secure network protocols and cryptographic configurations.

Secure Management of the Cisco ASR

User Roles

Explains the different administrator roles and privilege levels on the ASR.

Passwords

Details password complexity requirements and configuration for secure authentication.

Virtual Private Networks (VPN)

Covers the configuration and use of IPsec VPNs for secure communication.

Security Relevant Events and Audit Records

Deleting Audit Records

Explains how privileged administrators can delete audit records using the clear logging command.

Network Services and Protocols Overview

Modes of Operation for the Cisco ASR

Operational Environment Security Measures

Related Documentation and Resources

World Wide Web Documentation

Provides URLs for accessing current Cisco documentation online.

Ordering Documentation

Explains methods for ordering Cisco product documentation.

Obtaining Technical Assistance