AAA Servers in Common Criteria Mode

Common Criteria mode requires that devices support NDcPP version 2.2e or above. This standard requires the communication of the device with AAA servers to take place over a TLS-encrypted session.

Even though you can configure multiple TLS-encrypted RADIUS servers, only one connection can be active at any time. If another TLS-encrypted RADIUS session is attempted at the same time as the first RADIUS session, the connection attempt is rejected.

When the device is in Common Criteria Operational mode, and the device has been configured for a TLS encrypted RADIUS server for authentication, only one administrator is able to administer the device. In addition, accounting and authorizing using the TLS-encrypted RADIUS server are disabled.

In this section:

  1. Modifying the Common Criteria Policies to Use Non-encrypted AAA Servers
    If required, you can modify the Common Criteria policies to allow AAA servers that do not use TLS encryption to be configured, such as RADIUS servers. When non-encrypted AAA servers are allowed, you cannot configure TLS-encrypted TACACS+ servers on the device.
Parent topic: Common Criteria Certification