| NDcPP22e:FAU_GEN.1 |
Start-up and shut-down of the audit functions
Create, delete, and import the cryptographic keys
|
|
Shut-down:
2022-04-12T20:02:49Z ICX7150-48P Router -
- [meta sequenceId=10] BOM CLI CMD: "reload" by super user from
console
Start-up:
2022-04-12T20:00:34Z ICX7150-48P Router
ICX7150_Router - System [meta sequenceId=9] BOM System:
Interface ethernet mgmt1, state up
Key
Generation:
2024-03-14T19:47:41Z example.com ICX8200_Router BOM Crypto:
Successfully generated EC key pair
Key Deletion:
2024-03-14T19:56:37Z example.com ICX8200_Router BOM Crypto: EC
key pair is successfully deleted
Importing of Cryptographic Keys:
2024-03-22T13:36:35Z example.com ICX7150_Router BOM Download:
CERTIFICATE/KEY DOWNLOAD START
2024-03-22T13:36:39Z example.com ICX7150_Router BOM Download:
CERTIFICATE/KEY DOWNLOAD COMPLETED
|
| NDcPP22e:FIA_PMG_EXT.1 |
Resetting Passwords |
|
Resetting Passwords:
2024-04-03T17:14:28Z:I: example.com - - [meta sequenceId=480]
BOM CLI CMD: "username testuser password ....." by admin user
from ssh
|
| MACsec10:FCS_MACSEC_EXT.1 |
Session establishment |
Secure Channel Identifier (SCI) |
2022-04-28T17:26:59Z ICX7550-48P Router ICX7550_Router - General
[meta sequenceId=58] BOM MACsec: communication is now secured for
port 1/3/3 Session SCI - 3420e30008290082, CKN -
acbf98acd980bf385193871209184001 |
| MACsec10:FCS_MACSEC_EXT.3 |
e1: Creation and update of Secure Association Key |
e1: Creation and update times |
2022-04-28T17:26:59Z ICX7550-48P Router ICX7550_Router - General
[meta sequenceId=60] BOM MACsec: new SAK generated for port
1/3/3 |
| MACsec10:FCS_MACSEC_EXT.4 |
e4: Creation of Connectivity Association (per TD0509) |
e4: Connectivity Association Key Names (per TD0509) |
2022-04-28T17:26:59Z ICX7550-48P Router ICX7550_Router - General
[meta sequenceId=58] BOM MACsec: communication is now secured for
port 1/3/3 Session SCI - 3420e30008290082, CKN -
acbf98acd980bf385193871209184001 |
| NDcPP22e:FCS_NTP_EXT.1 |
Configuration of a new time server Removal of configured time
server |
Identity if new/removed time server |
Added:
2022-04-29T19:24:59Z ICX7150-48P Router -
- [meta sequenceId=17] BOM CLI CMD: "server 192.168.144.254 key
..... 4 " by super user from console
Removed:
2022-04-29T19:24:53Z ICX7150-48P Router -
- [meta sequenceId=14] BOM CLI CMD: "no server 192.168.144.254
key ..... 4 " by super user from console
|
| NDcPP22e:FCS_SSHS_EXT.1 |
Failure to establish an SSH session. |
Reason for failure. |
2022-03-25T16:44:51Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=4] BOM sshd: SSH
access by user admin from src 192.168.144.254 rejected, 0
attempt(s)
2022-04-20T17:00:19Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=15] BOM sshd: Unable
to negotiate with 192.168.144.254 port 41458: no matching cipher
found. Their offer: aes128-gcm@openssh.com
2022-04-20T17:42:16Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=5] BOM sshd: Failed
publickey for admin from 192.168.144.254 port 42462 ssh2
|
| NDcPP22e:FCS_TLSC_EXT.1 |
Failure to establish a TLS Session. |
Reason for failure. |
2022-04-20T17:24:02Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=87] BOM System: SSL server
connection failed for host 192.168.144.254 (null)
2022-04-05T20:53:46Z ICX7150-48P Router
ICX7150_Router - -[meta sequenceId=7] BOM PKI: Trustpoint -
rootca-rsa : Remote Domain name (bar.foo.example.com) validation
failed with return code : 1 Cert ID - Serial No : 296, Issuer CN
: subsubca-rsa, Subject CN : *.example.com
2022-04-18T18:11:13Z ICX7150-48P Router
ICX7150_Router - -[meta sequenceId=79] BOM PKI: Trustpoint -
rootca-rsa : Extended key usage validation failed - Unsupported
certificate purpose Cert ID - Serial No : 161, Issuer CN :
subsubca-rsa, Subject CN : tl28-16x.example.com
2022-04-19T21:34:12Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=17] BOM System: SSL
connection failed to host 192.168.144.254, error:14092105:SSL
routines:SSL3_GET_SERVER_HELLO:wrong cipher returned
2022-04-20T17:27:27Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=193] BOM System: SSL server
connection failed for host 192.168.144.254 6514 : "unknown
cipher returned"
2022-04-22T21:46:07Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=264] BOM System: SSL server
connection failed for host 192.168.144.254 6514 : "wrong ssl
version"
2024-03-28T02:36:50Z example.com ICX7150_Router BOM System: SSL
server connection failed for host 172.16.16.254 6514 : "bad dh
pub key length"
2022-04-20T17:21:02Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=76] BOM System: SSL server
connection failed for host 192.168.144.254 bad signature
2024-04-09T14:05:30Z example.com ICX8200_Router BOM System: SSL
server connection failed for host 172.16.16.254 6514 : "digest
check failed"
|
| NDcPP22e:FIA_AFL.1 |
Unsuccessful login attempt limit is met or exceeded. |
Origin of the attempt (e.g., IP address). |
2022-04-13T15:17:23Z ICX7150-48P Router ICX7150_Router - General [meta sequenceId=16]
BOM sshd: username TestUser is disabled |
| NDcPP22e:FIA_UAU_EXT.2 |
All use of identification and authentication mechanism. |
Origin of the attempt (e.g., IP address). |
SSH Success:
2022-04-11T13:23:31Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=51] BOM Security: ssh
login by super from src IP 192.168.144.254 from src MAC
0015.5d90.1701 to USER EXEC mode
SSH Password Failure:
2022-03-25T16:44:51Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=4] BOM sshd: SSH
access by user admin from src 192.168.144.254 rejected, 0
attempt(s)
SSH Pubkey Failure:
2022-04-20T17:42:16Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=5] BOM sshd: Failed
publickey for admin from 192.168.144.254 port 42462 ssh2
Console Success:
2022-04-11T13:22:16Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=17] BOM Security:
console login by super to PRIVILEGED EXEC mode
Console Failure:
2024-03-20T19:06:12Z example.com
ICX7150_Router BOM login: Console login by user admin failed
|
| NDcPP22e:FIA_UIA_EXT.1 |
All use of identification and authentication mechanism. |
Origin of the attempt (e.g., IP address). |
See NDcPP22e:FIA_UAU_EXT.2 above |
| NDcPP22e:FIA_X509_EXT.1/Rev |
Unsuccessful attempt to validate a certificate. Any addition,
replacement or removal of trust anchors in the TOE's trust store |
Reason for failure of certificate validation Identification of
certificates added, replaced or removed as trust anchor in the TOE's
trust store |
Cert Validation Failure:
2022-04-06T15:07:19Z ICX7150-48P Router
ICX7150_Router - -[meta sequenceId=5] BOM PKI: Trustpoint -
rootca-rsa : Certificate validation failed - self signed
certificate in certificate chain Cert ID - Serial No : 157,
Issuer CN : rootca-unacceptable-rsa, Subject CN :
tl28-16x.example.com
2022-04-06T15:33:27Z ICX7150-48P Router
ICX7150_Router - -[meta sequenceId=53] BOM PKI: Trustpoint -
rootca-rsa : Certificate validation failed - certificate has
expired Cert ID - Serial No : 19, Issuer CN : rootca-rsa,
Subject CN : subca-expired-rsa
2022-04-06T15:38:10Z ICX7150-48P Router
ICX7150_Router - -[meta sequenceId=71] BOM PKI: Trustpoint -
rootca-rsa : OCSP - Certificate not valid, Reason : Revoked,
code : -1 Cert ID - Serial No : 209, Issuer CN : subsubca-rsa,
Subject CN : tl28-16x.example.com
2024-03-27T18:04:13Z example.com ICX7150_Router sequenceId=13632]
BOM PKI: Trustpoint - rootca-rsa : Extended key usage validation
failed - Unsupported certificate purpose Cert ID - Serial No :
165, Issuer CN : subsubca-rsa, Subject CN :
tl24-16x.example.com
2022-04-06T16:02:32Z ICX7150-48P Router
ICX7150_Router - -[meta sequenceId=152] BOM PKI: Trustpoint -
rootca-rsa : Certificate validation failed - certificate
signature failure Cert ID - Serial No : 103, Issuer CN :
subsubca-rsa, Subject CN : tl28-16x.example.com
2022-04-20T17:16:32Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=70] BOM System: SSL server
connection failed for host 192.168.144.254 wrong tag
2022-04-20T17:19:32Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=74] BOM System: SSL server
connection failed for host 192.168.144.254 block type is not
01
Added Trust:
2022-02-16T16:31:13Z ICX7150-48P Router
ICX7150_Router - -[meta sequenceId=123] BOM PKI: Trustpoint
rootca-rsa: Successfully loaded certificate file
rootca-rsa.pem
Removed Trust:
2022-04-29T17:45:27Z ICX7150-48P Router
ICX7150_Router - -[meta sequenceId=8] BOM PKI: Successfully
deleted trustpoint rootca-rsa certificate file. Cert ID - Serial
No : 65537, Issuer CN : rootca-rsa, Subject CN : rootca-rsa
|
| NDcPP22e:FMT_MOF.1/ManualUpdate |
Any attempt to initiate a manual update. |
|
2022-04-06T19:52:50Z ICX7150-48P Router -
- [meta sequenceId=184] BOM CLI CMD: "copy scp flash
192.168.144.254 /tmp/SPR09010bdevufi.bin primary" by super user
from console
2022-04-06T19:52:57Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=185] BOM Download: COPY
IMAGE TO FLASH START
2022-04-06T19:54:20Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=186] BOM Download: FIPS
IMAGE VERIFICATION PASSED AND STORED IN FLASH
2022-04-06T19:54:20Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=187] BOM Download: COPY
APPLICATION IMAGE FROM BUNDLE START
2022-04-06T19:54:20Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=188] BOM Download: COPY
BOOTROM IMAGE FROM BUNDLE START
2022-04-06T19:54:41Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=189] BOM Download: COPY
BUNDLE IMAGE COMPLETED
|
| NDcPP22e:FMT_SMF.1 |
All management activities of TSF data. |
|
Every admin command is logged and tagged with CLI_CMD so all
maanagment functions are covered by that. Below is an example
audit:
2022-04-11T12:59:50Z ICX7150-48P Router -
- [meta sequenceId=6221] BOM CLI CMD: "logging buffered 50" by
super user from conso
|
| MACsec10:FMT_SMF.1 |
All management activities of TSF data. |
|
See NDcPP22e:FMT_SMF.1 above |
| MACsec10:FPT_RPL.1 |
Detected replay attempt |
|
2022-03-09T22:48:02Z ICX7550-48P Router MACSEC: Warning!
Late-Pkts[Count 5] are received Port[1/3/1] |
| NDcPP22e:FPT_STM_EXT.1 |
Discontinuous changes to time - either Administrator actuated or
changed via an automated process. (Note that no continuous changes
to time need to be logged. See also application note on
FPT_STM_EXT.1) |
For discontinuous changes to time: The old and new values for the
time. Origin of the attempt to change time for success and failure
(e.g., IP address). |
NTP:
2022-03-09T20:27:33Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=177] BOM Security:
Time is updated by NTP server "192.168.144.254" from
"20:27:32.524 GMT+00 Wed Mar 09 2022 " to "20:27:33.013 GMT+00
Wed Mar 09 2022
Manual:
2022-04-12T19:26:00Z ICX7150-48P Router
ICX7150_Router - System [meta sequenceId=2782] BOM Clock Changed
from old time 14:47:39.387 Eastern Tue Apr 12 2022 to new time
19:26:00.001 Eastern Tue Apr 12 2022 by super user from console
session
|
| NDcPP22e:FPT_TUD_EXT.1 |
Initiation of update; result of the update attempt (success or
failure). |
|
Success shown in FMT_MOF.1/ManualUpdate
Failure:
2022-04-29T17:12:17Z ICX7150-48P Router
ICX7150_Router - System [meta sequenceId=381] BOM Download: COPY
BUNDLE IMAGE VALIDATION FAILED
|
| NDcPP22e:FTA_SSL.3 |
The termination of a remote session by the session locking
mechanism. |
|
2022-02-14T13:54:05Z ICX7150-48P Router ICX7150_Router - General [meta sequenceId=1]
BOM Security: ssh timed out by admin from src IP 192.168.144.254
from src MAC 0015.5d90.1701 from USER EXEC mode |
| NDcPP22e:FTA_SSL.4 |
The termination of an interactive session. |
|
SSH:
2022-04-11T12:12:09Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=5845] BOM Security:
ssh logout by super from src IP 192.168.144.254 from src MAC
0015.5d90.1701 from PRIVILEGED EXEC mode
Console:
2022-04-11T12:59:00Z ICX7150-48P Router
ICX7150_Router - General [meta sequenceId=6217] BOM Security:
console logout by super from PRIVILEGED EXEC mode
|
| NDcPP22e:FTA_SSL_EXT.1 |
(if 'lock the session' is selected) Any attempts at unlocking of
an interactive session. (if 'terminate the session' is selected) The
termination of a local session by the session locking mechanism. |
|
2022-02-15T12:38:06Z ICX7150-48P Router ICX7150_Router - General [meta sequenceId=222]
BOM Security: console timed out by admin from USER EXEC mode |
| NDcPP22e:FTP_ITC.1 |
Initiation of the trusted channel. Termination of the trusted
channel. Failure of the trusted channel functions. |
Identification of the initiator and target of failed trusted
channels establishment attempt. |
Initiation:
2022-04-06T20:04:44Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=32] BOM System: SSL server
192.168.144.254 6514 is now connected
Termination:
2022-04-06T20:06:39Z ICX7150-48P Router
ICX7150_Router - - [meta sequenceId=33] BOM System: SSL server
192.168.144.254 6514 is disconnected
For failure see NDcPP22E:FCS_TLSC_EXT.1
|
| NDcPP22e:FTP_TRP.1/Admin |
Initiation of the trusted path. Termination of the trusted path.
Failure of the trusted path functions. |
|
See NDcPP22e:FIA_UAU_EXT.2 for SSH initiation
See NDcPP22e:FTA_SSL.4 for SSH termination
See NDcPP22e:FCS_SSHS_EXT.1 for SSH failure
|