DEFENSE INFORMATION SYSTEMS AGENCY P. O. BOX 549 FORT MEADE, MARYLAND Joint Interoperability Test Command (JTE) 15 Jun 15

Transcription

1 DEFENSE INFORMATION SYSTEMS AGENCY P. O. BOX 549 FORT MEADE, MARYAND IN REPY REFER TO: Joint Interoperability Test Command (JTE) 5 Jun 5 MEMORANDUM FOR DISTRIBUTION SUBJECT: Joint Interoperability Certification of the Cisco Systems, Nexus 5500 with the Nexus 000, software release NX-OS 7.0(3)N() References: (a) Department of Defense Instruction , "DoD Unified Capabilities (UC)," 9 December 00 (b) Office of the Department of Defense Chief Information Officer, Department of Defense Unified Capabilities s 03, Errata, July 03 (c) through (d), see Enclosure. Certification Authority. References (a) and (b) establish the Joint Interoperability Test Command (JITC) as the Joint Interoperability Certification Authority for the Unified Capabilities (UC) products.. Conditions of Certification. The Cisco Systems, Nexus 5500 with Nexus 000, Assured Services ocal Area Network (ASAN), software release NX-OS 7.0(3)N(); hereinafter referred to as the System Under Test (SUT), meets the critical requirements of the Unified Capabilities s (UCR), Reference (c), and is certified for joint use as Assured Services ocal Area Network (ASAN) ayer /3 Access switch with the conditions described in Table, and Enclosure 3, Table 3-3. This certification expires upon changes that affect interoperability, but no later than three years from the date of the UC Approved Products ist (AP) memorandum.

2 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Systems, Nexus 5500 with the Nexus 000, software release NX-OS 7.0(3)N() Table. Conditions None Condition Operational Impact Remarks UCR Waivers Conditions of Fielding (CoF) Half-duplex transmission is not supported when the Cisco Nexus Fabric Extender NK-48TP-E is subtended from the Nexus Minor On 8 Mar 05, DISA adjudicated this minor with the CoF that half-duplex transmission is not supported on the NK-48TP-E subtended from the Nexus Does not support power over Ethernet, IAW EDG Minor On 8 Mar 05, DISA adjudicated this discrepancy as minor with the following CoF: When configured in the role of Access switch, the SUT does not provide Power over Ethernet (PoE) to support VVoIP hard phones and other PoE dependent subtending equipment. Access Control ists (ACs) must be used on this product and on interfaces on other products connecting. ACs will be used instead of IPsec to authenticate OSPFv3, whether IPv6 or OSPFv3 is used. Minor On 8 Mar 05, DISA adjudicated this discrepancy as minor with a CoF. The following RFCs are identified by Cisco as non-comply, IAW Table 7.- and Table 5.-6: 455, 4750, 587. The SUT is limited to supporting 96 priority or higher classification VoIP/UC users IAW Table 7.- (reference c). Minor On 8 Mar 05, DISA adjudicated this as minor with a CoF. It is possible to deploy a Nexus 5500 with Nexus 000 Fabric Extenders to achieve a port count greater than 96 user ports. The Nexus 5500 switch does not contain redundant processor or switch fabric. Deployment of the Nexus 5500 with Nexus 000 fabric extenders is limited to supporting 96 priority or higher VoIP/UC users, IAW Table 7.- (reference c). DoD sites deploying OSPFv3 should use ACs to secure OSPF until RFC 455 is supported. ACs must be used on this product and on interfaces on other propducts connecting to it instead of IPsec to authenticate OSPFv3. Partial comply with required Product and Routing Functions IAW 5.. IP , IP , IP and IP ; does not support OSPFv3 authentication. Minor with POA&M Open Test Discrepancies On 8 Mar 05, DISA adjudicated this as a minor, accepted the vendor s POA&M. None EGEND: AC Access Control ists AP Approved Product ist CoF Conditions of Fielding DISA Defense Information Systems Agency IAW In Accordance With IPv4 Internet Protocol version 4 IPv6 Internet Protocol version 6 oc etter of Compliance OSPFv3 Open Shortest Path First version 3 POA&M Plan of Action and Milestones PoE Power over Ethernet RFC Request for Comment UC Unified Capabilities UCR Unified Capabilities s VoIP Voice over Internet Protocol VVoIP Voice and Video over Internet Protocol 3. Interoperability Status. Table provides the SUT interface interoperability status. Table 3 provides the Capability s (CR) and Functional s (FR) status. Table 4 provides a Unified Capabilities (UC) Approved Products ist (AP) product summary.

3 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Systems, Nexus 5500 with the Nexus 000, software release NX-OS 7.0(3)N() Interface Table. ASAN Interface Status Applicability Co D A Threshold CRs/FRs (See note.) Status Remarks Network Management Interfaces (See note.) IEEE 80.3i (0BaseT UTP) C C C and 3. Met See note 3. IEEE 80.3u (00BaseT UTP) C C C and 3. Met IEEE 80.3ab (000BaseT UTP) C C C and 3. Met Access (User) Interfaces (See note.) IEEE 80.3i (0BaseT UTP) C C R,, and 3. Not Supported See note 4. IEEE 80.3u (00BaseT UTP) R R R,, and 3. Not Tested See note 5. IEEE 80.3u (00BaseFX) C C R,, and 3. Not Supported See note 4. IEEE 80.3ab (000BaseT UTP) C C R,, and 3. Met See note 5. IEEE 80.3z (000BaseX Fiber) R R R,, and 3. Met IEEE 80.3ae (0GBaseX) (C) O O O,, and 3 Met See note 6. Uplink (Trunk) Interfaces (See note.) IEEE 80.3u (00BaseT UTP) R R R,, 3, and 4. Not Tested See Note 5 IEEE 80.3u (00BaseFX) C C R,, 3, and 4. Not Supported See note 4. IEEE 80.3z (000BaseX Fiber) R R R,, 3, and 4. Met IEEE 80.3ae (0GBaseX Fiber) O O O,, 3, and 4. Met See note 6. IEEE 80.3ba (40GBaseX Fiber) O O O,, 3, and 4. Not Certified See note 7. IEEE 80.3ba (00GBaseX Fiber) O O O,, 3, and 4. Not Supported See note 4. NOTE(S):. The SUT high-level CR and FR numbers depicted in the Threshold CRs/FRs column can be cross-referenced in Table 3. These high-level CR/FR requirements refer to a detailed list of requirements provided in Enclosure 3.. Core and Distribution products must minimally support 00Base-X (80.3u) and 000Base-X (80.3z). Access products must minimally support one of the following standards: 80.3i (0BaseT), 80.3j (0BaseF), 80.3u (00BaseT/F), 80.3z (000BaseF), or 80.3ab (000BaseT). Other rates and standards may be provided as conditional interfaces. 3. The USAISEC TIC did not test the 0BaseT interface. JITC analysis determined that the 0BaseT interface is a low risk for certification based on the vendor s oc to the IEEE 80.3i and the testing data collected at other data rates. 4. The SUT does not support this interface. The UCR 03 defines minimum interface requirement, however, allows for additional interfaces BaseT/000BaseT interfaces were not submitted for testing. 6. The UCR03 defines minimum interface requirements, however, allows for additional interfaces. 7. DISA adjudicated the 40 Gpbs interfaces are not certified for connection to other nodes. But the 40 Gpbs interfaces may be used for intra-system connections to fabric extenders. EGEND: 80.3ab 000BaseT Gbps Ethernet over twisted pair at Gbps 80.3ae 0 Gbps Ethernet 80.3ba 40/00 Gbps Ethernet 80.3i 0BaseT 0 Mbps Ethernet over twisted pair 80.3u Standard for carrier sense multiple access with collision detection at 00 Mbps 80.3z Gigabit Ethernet Standard 0BaseT 0 Mbps (Baseband Operation, Twisted Pair) Ethernet 00BaseT 00 Mbps (Baseband Operation, Twisted Pair) Ethernet 00BaseFX 00 Mbps Ethernet over Fiber 000BaseX 000 Mbps Ethernet over Fiber or Copper 000BaseT 000 Mbps (Baseband Operation, Twisted Pair) Ethernet 0000BaseX 0000 Mbps Ethernet over Fiber or Copper 0GBaseX 0000 Mbps Ethernet over Fiber or Copper 40GBaseX Mbps Ethernet over Fiber or Copper 00GBaseX Mbps Ethernet over Fiber or Copper A Access ASAN Assured Services ocal Area Network C Conditional Co CRs D FRs Gbps IEEE IP JITC Mbps O R SUT TIC UCR USAISEC UTP Core Capability s Distribution Functional s Gigabits per second Identification Institute of Electrical and Electronics Engineers Internet Protocol Megabits per second Megabits per second Optional Required System Under Test Technology Integration Center Unified Capabilities s U.S. Army Information Systems Engineering Command Unshielded Twisted Pair 3

4 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Systems, Nexus 5500 with the Nexus 000, software release NX-OS 7.0(3)N() Table 3. ASAN Capability s and Functional s Status CR/FR UCR (High-evel) (See note.) UCR 03 Reference Status General AN Switch and Router Product s (R) 7.. Met (See note, 3.) AN Switch and Router Redundancy s (R) 7.. Met 3 AN Product s Summary (R) 7..3 Met (See note.) 4 Multiprotocol abel Switching in ASANs (O) 7..4 Not Tested (See note 4.) NOTE(S):. The annotation of required refers to a high-level requirement category. The applicability of each sub-requirement is provided in Enclosure 3.. The SUT met the requirements with the exceptions noted in Table. DISA adjudicated these exceptions as Minor with Condition of Fielding for Nexus 5500 with Nexus 000 switch. The Nexus 5500 with Nexus 000 switch is certified as a ayer/3 Access switch only. 3. Security is tested by a USAISEC TIC-led Information Assurance test team and the results published in a separate report, Reference (e). 4. Multiprotocol abel Switching is an optional requirement, was not tested, and therefore is not certified for use. EGEND: ASAN Assured Services ocal Area Network CR Capability DISA Defense Information Systems Agency FR Functional Identification AN ocal Area Network O Optional R Required SUT System Under Test TIC Technology Integration Center UCR Unified Capabilities s USAISEC United States Army Information Systems Engineering Command Table 4. UC AP Product Summary Product Identification Product Name Cisco Nexus 5500 with Nexus 000 Software Release UC Product Type(s) Product Description Product Components (See note.) NX-OS 7.0(3)N() ASAN Access ayer /3 IP Switch The Cisco Nexus 5500 with Nexus 000 is a ayer /3 Access switch that provides secure transport of Voice, Video, and Data traffic. Component Name (See note.) Version Remarks ASAN Access ayer /3 Switch Cisco N5K-C5596UP (See note 3.) Cisco N5K-C5596T (See note 3.) Cisco N5K-C5548UP (See Note 3.) Cisco N5K-C5548P (See Note 3.) NX-OS 7.0(3)N() None NOTE(S):. The detailed component and subcomponent list is provided in Enclosure 3.. Components bolded and underlined were tested by USAISEC TIC. The other components in the family series were not tested but are also certified for joint use. JITC certifies those additional components because they utilize the same software and similar hardware and JITC analysis determined them to be functionally identical for interoperability certification purposes. 3. The SUT met the requirements with the exceptions noted in Table. The Nexus 5500 with Nexus 000 switch is certified as an Access ayer /3 switch only. EGEND: AP ASAN CPU DISA IP JITC Approved Products ist Assured Services ocal Area Network Central Processing Unit Defense Information Systems Agency Internet Protocol Joint Interoperability Test Command SUT TIC UC USAISEC VoIP System Under Test Technology Integration Center Unified Capabilities U.S. Army Information Systems Engineering Command Voice over Internet Protocol 4

5 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Systems, Nexus 5500 with the Nexus 000, software release NX-OS 7.0(3)N() 4. Test Details. This certification is based on interoperability testing, review of the vendor s etters of Compliance (oc), DISA adjudication of open test discrepancy reports (TDRs), and DISA Certifying Authority (CA) recommendation for inclusion on the UC AP. Testing was conducted at the U.S. Army Information Systems Engineering Command (USAISEC) - Mission Engineering Directorate (MED), Technology Integration Center (TIC), hereafter referred to as USAISEC TIC, at Fort Huachuca, Arizona, from 0 October 04 through 6 November 04 using test procedures derived from Reference (d). DISA adjudication of outstanding TDRs was completed on 8 March 05. Review of the vendor s oc was completed on 8 December 04. Information Assurance (IA) testing was conducted by USAISEC TIC-led IA test teams and the results published in a separate report, Reference (e). Enclosure documents the test results and describes the tested network and system configurations. Enclosure 3 provides a detailed list of the interface, capability, and functional requirements. 5. Additional Information. JITC distributes interoperability information via the JITC Electronic Report Distribution (ERD) system, which uses Sensitive but Unclassified IP Data (formerly known as NIPRNet) . Interoperability status information is available via the JITC System Tracking Program (STP). STP is accessible by.mil/.gov users at Test reports, lessons learned, and related testing documents and references are on the JITC Joint Interoperability Tool (JIT) at Due to the sensitivity of the information, the Information Assurance Accreditation Package (IAAP) that contains the approved configuration and deployment guide must be requested directly from the Unified Capabilities Certification Office (UCCO), disa.meade.ns.list.unifiedcapabilities-certification-office@mail.mil. All associated information is available on the DISA UCCO website located at 6. Point of Contact (POC). The testing point of contact is Mr. James Hatch, commercial telephone (50) , DSN telephone 8-860; address james.d.hatch.civ@mail.mil. The JITC point of contact is Ms. Anita Brown, commercial telephone (50) , DSN telephone , FAX DSN ; address anita.l.brown53.civ@mail.mil; mailing address Joint Interoperability Test Command, ATTN: JTE (Ms. Anita Brown) P.O. Box 798, Fort Huachuca, AZ The UCCO tracking number for the SUT is FOR THE COMMANDER: 3 Enclosures a/s for RIC HARRISON Chief Networks/Communications and UC Portfolio 5

6 JITC Memo, JTE, Joint Interoperability Certification of the Cisco Systems, Nexus 5500 with the Nexus 000, software release NX-OS 7.0(3)N() Distribution (electronic mail): DoD CIO Joint Staff J-6, JCS USD(AT&) ISG Secretariat, DISA, JTA U.S. Strategic Command, J665 US Navy, OPNAV N/N6FP US Army, DA-OSA, CIO/G-6 ASA(AT), SAIS-IOQ US Air Force, A3CNN/A6CNN US Marine Corps, MARCORSYSCOM, SIAT, A&CE Division US Coast Guard, CG-64 DISA/TEMC DIA, Office of the Acquisition Executive NSG Interoperability Assessment Team DOT&E, Netcentric Systems and Naval Warfare Medical Health Systems, JMIS IV&V HQUSAISEC, EIE-ISE-ME UCCO 6

7 ADDITIONA REFERENCES (c) Joint Interoperability Test Command, Assured Services ocal Area Network (ASAN) Test Procedures Version.0 for Unified Capabilities s (UCR) 03 Errata, May 04 (d) Joint Interoperability Test Command, Information Assurance (IA) Assessment of Cisco Nexus 5500 with Nexus 000 Switch (Tracking Number 4780), January 05 Enclosure

8 CERTIFICATION SUMMARY. SYSTEM AND REQUIREMENTS ENTIFICATION. The Cisco Systems, Nexus 5500 with Nexus 000, software release NX-OS 7.0(3)N() is hereinafter referred to as the System Under Test (SUT). Table - depicts the SUT identifying information and requirements source. Table -. System and s Identification System Identification Sponsor Sponsor Point of Contact United States Army PM I3C, POC: Mr. Jordan Silk, USAISEC MED, Building 5330, Fort Huachuca, Arizona 8563; jordan.r.silk.civ@mail.mil. Vendor Point of Contact Cisco Systems Global Certification Team (GCT), 705- Kit Creek Rd., Research Triangle Park, North Carolina 7709, certteam@cisco.com, website: System Name Cisco Nexus 5500 with Nexus 000 Increment and/or Version Product Category System Background Tracking NX-OS 7.0(3)N() Previous certifications TN 6906 UCCO 4780 ASAN Access ayer /3 IP Switch System Tracking Program System # 5058, Test Activity # 79 s Source Unified Capabilities s Remarks Test Organization(s) EGEND: Unified Capabilities s 03, Errata Section 7. and Section 4. None ASAN Assured Services ocal Area Network I3C Installation Information Infrastructure Communications and Capabilities Identification IP Internet Protocol MED Mission Engineering Directorate USAISEC TIC, Fort Huachuca, Arizona PM POC TIC TN UCCO USAISEC Program Manager Point of Contact Technology Integration Center Tracking Number Unified Capabilities Connection Office United States Army Information Systems Engineering Command. SYSTEM DESCRIPTION. The Unified Capabilities s (UCR) 03, Errata, defines two types of ocal Area Networks (ANs): Assured Services ocal Area Networks (ASANs) and non-asans. The Unified Capabilities (UC) AN components are core, distribution, and access switches. The core layer is a high-speed switching backbone designed to switch packets as quickly as possible. The distribution layer is the demarcation point between the access and core layers. The distribution layer helps to define and differentiate the core, provides boundary definition, and is the place at which packet manipulation can take place. The access layer is the point at which local end users are allowed into the network. This layer may use access lists or filters to optimize further the needs of a particular set of users. The Cisco Nexus 5500 Series Switches comprise a family of line-rate, low-latency, lossless 0 Gigabit Ethernet switches for the data center. The Nexus 5500 utilizes a cut-through architecture to enable line-rate 0 Gigabit Ethernet on all ports while maintaining consistently low latency independent of packet size and the services enabled. The Cisco Nexus 5500 Platform is powered by Cisco NX-OS operating system. The Cisco Nexus 5596 has 48 fixed ports and the Nexus 5548 has 3 ports. These ports provide and 0 Gigabit connectivity. In addition to these fixed Enclosure

9 ports, the Nexus 5596 has three expansion slots and the Nexus 5548 has one expansion slot. The expansion slots can be used to add ayer 3 routing or additional port modules. The Nexus 5596UP switch supports up to 96 ports total and 90 Gbps of throughput using the expansion slots. The Nexus 5596T switch offers a combination of 0GBASE-T and SFP+ ports. The Cisco Nexus 000 Series Fabric Extenders act as remote I/O modules for a parent Cisco Nexus 5500 switch. The Fabric Extender is an extension of the parent Cisco Nexus 5500 switch fabric, forming a virtual modular system. The Nexus 000 forwards all traffic to the parent Nexus 5500 Switch over 0 Gigabit Ethernet uplinks. Passing all traffic to the parent switch allows traffic to be shaped according to policies established on the parent Nexus 5500 Switch with a single point of management. The Nexus 5500 with Nexus 000 is certified as an Access ayer /3 switch only. See Table for Conditions and Enclosure 3, Table 3-3 for a list of individual components and descriptions. 3. OPERATIONA ARCHITECTURE. The UC architecture is a two-level network hierarchy consisting of Department of Defense Information Network (DoDIN) backbone switches and Service/Agency installation switches. The Department of Defense (DoD) Chief Information Officer (CIO) and Joint Staff policy and subscriber mission requirements determine which type of switch can be used at a particular location. The UC architecture, therefore, consists of several categories of switches. Figure - depicts the notional operational UC architecture in which the SUT may be used. 4. TEST CONFIGURATION. The SUT was tested at USAISEC TIC, Fort Huachuca, Arizona in a manner and configuration similar to that of a notional operational environment. The system s required functions and features were tested using the test configurations depicted in Figure -. Information Assurance testing was conducted using the same configuration. 5. METHODOOGY. Testing of the ASAN components was conducted in heterogeneous testing configuration. Figure - depicts a test network configuration which is typically used for Phase, heterogeneous testing, and is performed by placing the ASAN SUT components into an ASAN which is produced by a different manufacturer. The SUT used in heterogeneous testing will verify the interoperability of the ASAN components within Voice and Video over IP network (VVoIP). -

10 EGEND: DCO Defense Connection Online DISA Defense Information Systems Agency DISN Defense Information Systems Network DoD Department of Defense EI End Instrument IAP Internet Access Point IM Instant Messaging IP Internet Protocol ISP Internet Service Provider AN ocal Area Network MCEP Multi Carrier Entry Point NETOPS PKI PSTN QoS SBC SC SS STEP UC VVoIP XMPP Network Operations Public Key Infrastructure Public Switched Telephone Network Quality of Service Session Border Controller Session Controller Softswitch Standardized Tactical Entry Point Unified Capabilities Voice and Video over IP Extensible Messaging and Presence Protocol Figure -. Notional UC Network Architecture -3

11 EGEND: Gig AG SUT TMDE Gigabits Per Second ink Aggregation Group System Under Test Test, Measurement, and Diagnostic Equipment Figure -. SUT Heterogeneous Test Configuration -4

12 6. INTEROPERABIITY REQUIREMENTS, RESUTS, AND ANAYSIS. The interface, Capability s (CR) and Functional s (FR), Information Assurance (IA), and other requirements for UC ASAN are established by UCR 03, Errata, sections 4, and 5, and 7.. a. The UCR 03, Errata, section 7.. includes the General AN Switch and Router Product s. The core, distribution, and access products shall be capable of meeting the following parameters: () The general requirements are listed in the subparagraphs below. (a) Non-blocking. All core, distribution, and access products shall be non-blocking for their ports based on the following traffic engineering. Non-blocking is defined as the capability to send and receive a mixture of 64 to 58 byte packets at full duplex rates from ingress ports to egress ports through the component s backplane without losing any packets. In a non-blocking switch, all ports can run at full wire speed without any loss of packets. Blocking factor is defined as the ratio of all traffic to non-blocked traffic (i.e., a blocking factor of -to- means that 50 percent of the traffic must be non-blocking). The blocking factor includes all hardware and software components. Each Core, Distribution, and Access product has up to three levels of performance: Minimum, Medium, and Maximum.. Access Products. Access products shall not have a blocking factor that exceeds 8 to (minimum). Medium performance level Access products shall not have a blocking factor that exceeds to. Maximum performance level Access products shall be nonblocking. The SUT met this requirement with testing and the vendor s oc. The non-blocking test results for the SUT met the Minimum Performance level for a UC ASAN Access product. Therefore, the Cisco Nexus 5500 with Nexus 000 is certified as a ayer /3 Access switch only. The blocking ratio rating of Minimum (8:) was based upon the testing at USAISEC TIC. The non-blocking results for all tested components are listed in Enclosure 3, Table Distribution and Core Products. These products shall not have a blocking factor that exceeds to (minimum). Medium performance level products shall not have a blocking factor that exceeds.5 to. Maximum performance level products shall be nonblocking. The Cisco Nexus 5500 with Nexus 000 was submitted as an Access switch and was not tested s a Core or Distribution switch. (b) atency. All core, distribution, and access products shall have the capability to transport prioritized packets (media and signaling) as follows. The latency shall be achievable over any five-minute period measured from ingress ports to egress ports under congested conditions. A congested condition is defined as 00 percent bandwidth utilization. Prioritized packets are defined as packets having a service class above best effort. Voice packets may have no more than milliseconds (ms) latency. Voice and video signaling packets may have no more than ms latency. Video packets may have no more than 0 milliseconds (ms) latency. The SUT met this requirement with testing. The SUT measured latencies are shown in Table -. -5

13 Interface Table -. SUT Measured atency SUT Measured atency UCR for Voice/Video 0Base-X Not Supported (See note.) ms / 0 ms 00Base-X Not Tested (See note.) ms / 0 ms 000Base-X Not Tested (See note.) ms / 0 ms 0000Base-X ms voice / ms video latency measured EE (See note 3.) ms / 0 ms 40000Base-X ms voice / ms video latency measured EE (See note 3.) ms / 0 ms 00000Base-X Not Supported (See note.) ms / 0 ms NOTE(S):. The SUT does not support this interface.. USAISEC TIC tested the 0 Gbps and 40 Gbps, not the 00/000 Mbps interfaces. The SUT, as presented for testing, contained only 0 and 40 Gigabit Fiber interfaces. JITC analysis determined the 00 and 000 Mbps interfaces are low risk for certification based on the vendor s etters of Compliance to comply with the IEEE 80.3u and IEEE 80.3ab standards and the testing data collected at all other data rates. 3. The SUT measured latency was captured EE. Based on analysis of the EE measurement, USAISEC TIC determined that the SUT met the component latency requirements. EGEND: 0Base-X 00Base-X 000Base-X 0000Base-X 40000BaseX 00000Base-X EE Gbps 0 Mbps Ethernet over Fiber or Copper 00 Mbps Ethernet over Fiber or Copper 000 Mbps Ethernet over Fiber or Copper 0000 Mbps Ethernet over Fiber or Copper Mbps Ethernet over Fiber or Copper Mbps Ethernet over Fiber or Copper end-to-end Gigabits per second IEEE JITC Mbps ms SUT TIC UCR USAISEC Institute of Electrical and Electronics Engineers Joint Interoperability Test Command Megabits per second millisecond System Under Test Technology Integration Center Unified Capabilities s U.S. Army Information Systems Engineering Command (c) Jitter. All core, distribution, and access products shall have the capability to transport prioritized packets (media and signaling) as follows. The jitter shall be achievable over any five-minute period measured from ingress ports to egress ports under congested conditions. Congested condition is defined as 00 percent bandwidth utilization. Voice packets may have no more than ms jitter. Video packets may have no more than 0 ms jitter. The SUT met this requirement with testing. The SUT measured jitter for each interface is shown in Table

14 Interface Table -3. SUT Measured Jitter SUT Measured Jitter UCR for Voice/Video 0Base-X Not Supported (See note.) ms / 0 ms 00Base-X Not Tested (See note.) ms / 0 ms 000Base-X Not Tested (See note.) ms / 0 ms 0000Base-X 0.04 ms voice / 0.09 ms video jitter measured EE (See note 3.) ms / 0 ms 40000Base-X 0.04 ms voice / 0.09 ms video jitter measured EE (See note 3.) ms / 0 ms 00000Base-X Not Supported (See note.) ms / 0 ms NOTE(S):. The SUT does not support this interface.. USAISEC TIC tested the 0 Gbps and 40 Gbps, not the 00/000 Mbps interfaces. The SUT, as presented for testing, contained only 0 and 40 Gigabit Fiber interfaces. JITC analysis determined the 00 and 000 Mbps interfaces are low risk for certification based on the vendor s etters of Compliance to comply with the IEEE 80.3u and IEEE 80.3ab standards and the testing data collected at all other data rates. 3. The SUT measured latency was captured EE. Based on analysis of the EE measurement, USAISEC TIC determined that the SUT met the component latency requirements. EGEND: 0Base-X 00Base-X 000Base-X 0000Base-X 40000BaseX 00000Base-X EE Gbps 0 Mbps Ethernet over Fiber or Copper 00 Mbps Ethernet over Fiber or Copper 000 Mbps Ethernet over Fiber or Copper 0000 Mbps Ethernet over Fiber or Copper Mbps Ethernet over Fiber or Copper Mbps Ethernet over Fiber or Copper end-to-end Gigabits per second IEEE JITC Mbps ms SUT TIC UCR USAISEC Institute of Electrical and Electronics Engineers Joint Interoperability Test Command Megabits per second millisecond System Under Test Technology Integration Center Unified Capabilities s U.S. Army Information Systems Engineering Command (d) Packet oss. All core, distribution, and access products shall have the capability to transport prioritized packets (media and signaling) as follows. The packet loss shall be achievable over any five-minute period measured from ingress ports to egress ports under congested conditions. Congested condition is defined as 00 percent bandwidth utilization. The SUT met this requirement with testing. The SUT measured packet loss for each interface is shown in Table

15 Interface Table -4. SUT Measured Packet oss SUT Measured Packet oss UCR Voice Video Preferred Best Effort Preferred Voice Video Data Data Data 0Base-X Not Supported (See note.) 0.05% 0.05% 0.05% 00Base-X Not Tested (See note.) 0.05% 0.05% 0.05% 000Base-X Not Tested (See note.) 0.05% 0.05% 0.05% 0000Base-X 0.00% 0.00% 0.00% 0.00% 0.05% 0.05% 0.05% 40000Base-X 0.00% 0.00% 0.00% 0.00% 0.05% 0.05% 0.05% 00000Base-X Not Supported (See note.) 0.05% 0.05% 0.05% NOTE(S):. The SUT does not support this interface. Best Effort Data No minimum requirement in the UCR. USAISEC TIC tested the 0 Gbps and not the 0BaseT, 00BaseT or 000BaseT interfaces. The SUT, as presented for testing, contained only 0 and 40 Gigabit Fiber interfaces. JITC analysis determined the 0BaseT, 00BaseT and 000BaseT interface is low risk for certification based on the vendor s etters of Compliance to comply with the IEEE 80.3i, IEEE 80.3u and IEEE 80.3z standards and the testing data collected at all other data rates. EGEND: 0Base-X 0 Mbps Ethernet over Fiber or Copper 00Base-X 00 Mbps Ethernet over Fiber or Copper 000Base-X 000 Mbps Ethernet over Fiber or Copper 0000Base-X 0000 Mbps Ethernet over Fiber or Copper 40000BaseX Mbps Ethernet over Fiber or Copper 00000Base-X Mbps Ethernet over Fiber or Copper Gbps Gigabits per second IEEE JITC Mbps SUT TIC UCR USAISEC Institute of Electrical and Electronics Engineers Joint Interoperability Test Command Megabits per second System Under Test Technology Integration Center Unified Capabilities s U.S. Army Information Systems Engineering Command () Port Interface Rates s (a) Minimally, core and distribution products shall support the following interface rates, other rates and Institute of Electronics and Electrical Engineers (IEEE) standards may be provided as optional interfaces. Rates specified are the theoretical maximum data bit rate specified for Ethernet; link capacity and effective throughput is influenced by many factors. For calculation purposes, link capacities are to be calculated IAW definitions contained in Request for Comments (RFC) 330 and RFC 536. The SUT met the Network Management (NM) requirement with testing and the vendor s oc. The product must minimally support the following interfaces. The SUT was submitted as an Access switch only. 00 Mbps in accordance with (IAW) IEEE 80.3u (for interconnection between the distribution-core and distribution access) 000 Mbps IAW IEEE 80.3z (for interconnection between the core to WAN, distribution-core, and distribution-access) (b) Minimally, access products shall provide one of the following user-side interface rates (other rates and IEEE standards may be provided as optional interfaces). The SUT met this requirement through the vendor s oc. The SUT meets this requirement with 000 Mbps interfaces IAW IEEE 80.3z. 0 Mbps IAW IEEE 80.3i. 0 Mbps IAW IEEE 80.3j. 00 Mbps IAW IEEE 80.3u. 000 Mbps IAW IEEE 80.3z. 000 Mbps IAW IEEE 80.3ab. -8

16 (c) Minimally, access products shall provide one of the following trunk-side interface rates (other rates and IEEE standards may be provided as optional interfaces). The SUT met this requirement through the vendor s oc. The SUT meets this requirement with the 000 Mbps interface IAW IEEE 80.3z. 00 Mbps IAW IEEE 80.3u. 000 Mbps IAW IEEE 80.3z. (d) The core, distribution, and access products may provide a fibre channel interface IAW American National Standards Institute (ANSI) International Committee for Information Technology Standards (INCITS) T. and T.3 (previously known as X3T9.3). Fibre channel interfaces were not submitted for certification. If provided, the interface must meet the following: RFC 4338, Transmission of IPv6, IPv4, and Address Resolution Protocol (ARP) Packets over Fibre Channel. RFC 4044, Fibre Channel Management. (e) The core, distribution, and access products may provide one or more of the following wireless AN interface rates. Wireless interfaces were not submitted for certification: 54 Mbps IAW IEEE 80.a. Mbps IAW IEEE 80.b. 54 Mbps IAW IEEE 80.g Mbps IAW IEEE 80.n. IEEE : Broadband wireless communications standards for MANs. Other approved IEEE wireless interfaces may be implemented as optional interfaces. (f) If any of the above wireless interfaces are provided, then the interfaces must support the requirements of Section 7.3, Wireless AN. The SUT does not support the optional wireless interfaces. (3) Port Parameter s. The core, distribution, and access products shall provide the parameters on a per port basis as specified in the following subparagraphs. These are required for core, distribution, and ayer /ayer 3 access unless specified otherwise. (a) Auto-negotiation IAW IEEE All interfaces shall support auto-negotiation even when the IEEE80.3 standard has it as optional. This applies to 0/00/000-T Ethernet standards (i.e., IEEE Ethernet Standard 80.3, 993; or IEEE, Fast Ethernet Standard 80.3u, 995; and IEEE, Gigabit Ethernet Standard 80.3ab, 999). Per vendor oc, half duplex operation is not supported. DISA adjudicated this as a Condition of Fielding: Half Duplex transmission is not supported. -9

17 (b) Force mode IAW IEEE This requirement was met through vendor s oc and testing. (c) Flow control IAW IEEE 80.3x (Optional: Core). This requirement was met through vendor s oc. (d) Filtering IAW appropriate RFC 8 sections (sections applying to filtering). This requirement was met through vendor s oc. (e) ink Aggregation IAW IEEE 80.AX (applies to output/egress trunk-side ports only) (Optional Access). This requirement was met through vendor s oc and testing. (f) Spanning Tree Protocol IAW IEEE 80.D (Optional: Core). This requirement was met through vendor s oc and testing. (g) Multiple Spanning Tree IAW IEEE 80.s (Optional: Core). This requirement was met through vendor s oc and testing. (h) Rapid Reconfiguration of Spanning Tree IAW IEEE 80.w (Optional: Core). This requirement was met through vendor s oc. (i) Port-Based Access Control IAW IEEE 80.x (Optional: Core, Distribution, and Access). This requirement was met through vendor s oc. (j) ink ayer Discovery Protocol (DP) IAW IEEE 80.AB (Optional Core, Distribution, and Access). This requirement was met through vendor s oc. (k) ink ayer Discovery Media Endpoint Discovery IAW ANSI/ Telecommunications Industry Association (TIA)-057 (Optional Core, Distribution, and Access). This requirement was met through vendor s oc. (l) Power over Ethernet (PoE) IAW either 80.3af-003 or 80.3at-009 (Required only for VVoIP solutions; for data applications or non-assured Services (AS) solutions, PoE is optionally required.) PoE is not supported on the Nexus 5500 or the Nexus 000 fabric extenders. DISA adjudicated this as a Condition of Fielding: Does not provide Power over Ethernet to support VVoIP Hard phones and other PoE dependent subtending equipment. (4) Class of Service Markings s (a) The core, distribution, and access products shall support Differentiated Services Code Points (DSCPs) IAW RFC 474 for both Internet Protocol (IP) IPv4 and IPv6 Packets, as follows:. The core and distribution products shall be capable of accepting any packet tagged with a DSCP value (0-63) on an ingress port and assign that packet to a Quality of Service (QoS) behavior listed in Section 7...6, Quality of Service Features. The Cisco Nexus 5500 with Nexus 000 was submitted as an Access device only. -0

18 . The core and distribution products shall be capable of accepting any packet tagged with a DSCP value (0-63) on an ingress port and assign that packet to a QoS behavior listed in Section 7...6, Quality of Service Features. The Cisco Nexus 5500 with Nexus 000 was submitted as an Access device only. 3. The core and distribution products must be able to support the prioritization of aggregate service classes with queuing according to Section 7...6, Quality of Service Features. The Cisco Nexus 5500 with Nexus 000 was submitted as an Access device only. 4. Access products (including Passive Optical Network) shall be capable of supporting the prioritization of aggregate service classes with queuing according to Section 7...6, Quality of Service Features. This requirement was met through vendor s oc and testing. (b) The core, distribution, and access products may support the 3-bit user priority field of the IEEE 80.Q -byte Tag Control Information (TCI) field (see Figure 7.-, IEEE 80.Q Tagged Frame for Ethernet, and Figure 7.-, TCI Field Description). Default values are provided in Table 7.-, 80.Q Default Values. If provided, the following Class of Service (CoS) requirements apply:. The core, distribution, and access products shall be capable of accepting any frame tagged with a user priority value (0 7) on an ingress port and assign that frame to a QoS behavior listed in Section 7...6, Quality of Service Features. This requirement was met through vendor s oc.. The core and distribution products shall be capable of accepting any frame tagged with a user priority value (0-7) on an ingress port and reassign that frame to any new user priority value (0-7) (Optional: Distribution and Access). The Cisco Nexus 5500 with Nexus 000 was submitted as an Access device only. (5) Virtual AN Capabilities s (a) The core, distribution, and access products shall be capable of the following:. Accepting Virtual ocal Area Network (VAN) tagged frames according to IEEE 80.Q (see Figure 7.-, IEEE 80.Q Tagged Frame for Ethernet, and Figure 7.-, TCI Field Description). This requirement was met through vendor s oc and testing.. Configuring VAN s (Vs). Vs on an ingress port shall be configurable to any of the 4094 values (except 0 and 4095). This requirement was met through vendor s oc and testing. 3. Supporting VANs types IAW IEEE 80.Q. This requirement was met through vendor s oc and testing. -

19 (b) The Unified Capabilities (UC) products must be capable of accepting VAN tagged frames and assigning them to the VAN identified in the 80.Q V field (see Figure 7.-4, IEEE 80.Q-Based VANs). This requirement was met through vendor s oc and testing. (6) Protocols s. The core, distribution, and access products shall meet protocol requirements for Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6). The RFC requirements are listed in UCR 03, Errata, Table 7.-, ASAN Infrastructure RFC s. Additional IPv6 requirements by product profile are listed in UCR 03, Errata, Section 5, IPv6. These RFCs are not meant to conflict with Department of Defense (DoD) Information Assurance (IA) policy (e.g., Security Technical Implementation Guidelines (STIGs)). Whenever a conflict occurs, DoD IA policy takes precedence. If there are conflicts with UCR 03, Errata, Section 5, RFCs applicable to IPv6 in Section 5 take precedence. The following RFCs are identified by vendor OC as Non Comply: 455, 4750, 587. DISA accepts Cisco s POA&M. The balance of required RFCs are supported through vendor s oc and testing. DISA adjudicated this discrepancy as a Condition of Fielding: Access Control ists (ACs) must be used on this product and on interfaces on other products connecting to it instead of IPsec to authenticate OSPFv3 - whether IPv6 and consequently OSPFv3 is used. (7) Quality of Service Features s Features: (a) The core, distribution, and access products shall be capable of the following QoS. Providing a minimum of four queues. This requirement was met through vendor s oc and testing that proved the SUT supports four queues.. Assigning any incoming access/user-side tagged session to any of the queues for prioritization onto the egress (trunk-side/network-side) interface. This requirement was met through vendor s oc and testing. 3. Supporting Differentiated Services (DS), Per-Hop Behaviors (PHBs), and traffic conditioning IAW RFCs 474, 597, and 346. This requirement was met through vendor s oc and testing. 4. All queues shall be capable of having a bandwidth (BW) assigned (i.e., queue : 00 Kbps, queue : 500 kbps) or percentage of traffic (queue : 5 percent, queue : 5 percent). The BW or traffic percentage shall be fully configurable per queue from 0 to full BW or 0 to 00 percent. The sum of configured queues shall not exceed full BW or 00 percent of traffic. This requirement was met through vendor s oc and testing. 5. Core, distribution, and access products shall meet the traffic conditioning (policing) requirements of Section This requirement was met through vendor s oc and testing. -

20 (b) Providing a minimum of six queues is optional for core, distribution and access. The SUT was not tested to this optional requirement. (c) The product shall support the DSCP plan, as shown in UCR 03, Errata, Table 7.-3, DSCP Assignments. DSCP assignments shall be software configurable for the full range of six bit values (0-63 Base0) for backwards compatibility with IP precedence environments that may be configured to use the Type of Service (TOS) field in the IP header but do not support DSCP. The SUT met this requirement with the vendor s oc. (8) Network Monitoring s. The core, distribution, and access products shall support the following network monitoring features: (a) Simple Network Management Protocol Version 3 (SNMPv3) IAW RFCs 34, 34, 343, 344, 345, 346, and 347. The SilverCreek SNMP Test Suite was used to capture SNMP traps. This requirement was met through vendor s oc and testing. (b) Remote Monitoring (RMON) IAW RFC 89. The product shall minimally support the following RFC 89 groups: Ethernet statistics, history control, Ethernet history, and alarms. This requirement was met through vendor s oc. (c) Coexistence between Version, Version, and Version 3 of the Internet-standard Network Management Framework IAW RFC This requirement was met through vendor s oc. (d) The Advanced encryption Standard (AES) Cipher Algorithm in the SNMP Userbased Security Model IAW RFC 386. Security was tested by USAISEC TIC-led IA test teams, and the results were published in a separate report, Reference (e). (9) Security s. The core, distribution, and access products shall meet the security protocol requirements listed in Section 4, Information Assurance (IA), as follows: core and distribution products shall meet all requirements annotated as Router (R) and AN Switch (S). Access switches shall meet the IA requirements annotated for S. In addition to wireless IA requirements previously specified, Wireless ocal Area Network Access Systems (WASs) and Wireless Access Bridges (WABs) shall meet all IA requirements for Ss. Wireless End Instruments (WEIs) shall meet all IA requirements annotated for End Instruments (EIs). When conflicts exist between the Unified Capabilities s (UCR) and Security Technical Implementation Guides (STIGs) requirements, the STIGs requirements will take precedence. The SUT met the requirements in the UCR 03, Errata, Section 4, with the vendor s oc. In addition, security was tested by the USAISEC TIC-led IA test team and results are published in a separate report, Reference (e). b. The UCR 03, Errata, section 7.. includes the AN Switch and Router Redundancy s. The ASAN (High and Medium) shall have no single point of failure that can cause an outage of more than 96 IP telephony subscribers. A single point of failure up to and including 96 subscribers is acceptable; however, to support mission-critical needs, FASH/FASH OVERRE (F/FO) subscribers should be engineered for maximum -3

21 availability. To meet the availability requirements, all switching/routing platforms that offer service to more than 96 telephony subscribers shall provide redundancy in either of two ways: The product itself (Core, Distribution, or Access) provides redundancy internally. A secondary product is added to the ASAN to provide redundancy to the primary product (redundant connectivity required). () Single Product Redundancy s. If a single product is used to meet the redundancy requirements, then the following requirements are applicable to the product: Dual Power Supplies Dual Processors (Control Supervisors) Termination Sparing Redundancy Protocol No Single Failure Point Switch Fabric or Backplane Redundancy It is possible to deploy the Nexus 5500 with the Nexus 000 to achieve a port count greater than 96 user ports. The Nexus 5500 does not contain redundant processors or switch fabric. DISA adjudicated this as Minor with a Condition of Fielding: imited to supporting 96, Priority and above VoIP/UC users, IAW Table 7.-. () Dual Product Redundancy s. If the System Under Test (SUT) provides redundancy through dual products, then the following requirements are applicable: The failover over to the secondary product must not result in any lost calls. The secondary product may be in standby mode or active mode, regardless of the mode of operation the traffic engineering of the links between primary and secondary must meet the requirements provided in Section 7.5.9, Traffic Engineering. NOTE: In the event of a primary product failure, all calls that are active shall not be disrupted (loss of existing connection requiring redialing) and the failover to the secondary product must be restored within 5 seconds. This requirement was met through vendor s oc and testing. c. The UCR 03, Errata, section 7..3 includes the AN Product s Summary. Table 7.-4 summarizes the AN product requirements. These requirements were verified via a combination of etter of Compliance (oc) and testing and are addressed in other sections of this document. d. The UCR 03, Errata, section 7..4 includes the Multiprotocol abel Switching s in ASANs. The implementation of ASANs sometimes may cover a large geographical area. For large ASANs, a data transport technique referred to as Multiprotocol abel Switching (MPS) may be used to improve the performance of the ASAN core layer. The SUT was not submitted or tested for MPS and therefore not certified for MPS. 7. HARDWARE/SOFTWARE/FIRMWARE VERSION ENTIFICATION: Enclosure 3, Table 3-3 lists the SUT components hardware, software version, and firmware version tested. The USAISEC TIC tested the SUT in an operationally realistic environment to determine its -4

22 interoperability capability with associated network devices and network traffic. Enclosure 3, Table 3-4 lists the hardware, software version, and firmware version of the components used in the test infrastructure. 8. TESTING IMITATIONS. None. 9. CONCUSION(S). The Cisco Nexus 5500 with Nexus 000 meets the critical interoperability requirements for an ASAN Access ayer /3 switch in accordance with the UCR and is certified for joint use with other UC Products listed on the Approved Products ist (AP). The SUT meets the interoperability requirements for the interfaces listed in Enclosure 3, Table

23 Interface DATA TABES Table 3-. Interface Status Applicability Co D A Threshold CRs/FRs (See note.) Status Remarks Network Management Interfaces (See note.) IEEE 80.3i (0BaseT UTP) C C C and 3. Met See note 3. IEEE 80.3u (00BaseT UTP) C C C and 3. Met IEEE 80.3ab (000BaseT UTP) C C C and 3. Met Access (User) Interfaces (See note.) IEEE 80.3u (00BaseT UTP) R R R,, and 3. Met See note 5. IEEE 80.3u (00BaseFX) C C R,, and 3. Not Supported See note 4. IEEE 80.3ab (000BaseT UTP) C C R,, and 3. Met See note 5. IEEE 80.3z (000BaseX Fiber) R R R,, and 3. Met IEEE 80.3ae (0GBaseX) (C) O O O,, and 3 Met See notes 6. Uplink (Trunk) Interfaces (See note.) IEEE 80.3u (00BaseT UTP) R R R,, 3, and 4. Met See note 5 IEEE 80.3u (00BaseFX) C C R,, 3, and 4. Not Supported See note 4. IEEE 80.3z (000BaseX Fiber) R R R,, 3, and 4. Met IEEE 80.3ae (0GBaseX Fiber) O O O,, 3, and 4. Met See note 6. IEEE 80.3ba (40GBaseX Fiber) O O O,, 3, and 4. Not Certified See note 7. IEEE 80.3ba (00GBaseX Fiber) O O O,, 3, and 4. Not Supported See note 4. NOTE(S):. The SUT high-level CR and FR numbers depicted in the Threshold CRs/FRs column can be cross-referenced in Table 3. These high-level CR/FR requirements refer to a detailed list of requirements provided in Enclosure 3.. Core and Distribution products must minimally support 00Base-X (80.3u) and 000Base-X (80.3z). Access products must minimally support one of the following standards: 80.3i (0BaseT), 80.3j (0BaseF), 80.3u (00BaseT/F), 80.3z (000BaseF), or 80.3ab (000BaseT). Other rates and standards may be provided as conditional interfaces. 3. If the SUT is an access IP device, the SUT shall provide at least one of the interfaces listed. The USAISEC TIC did not test the 0BaseT interface. JITC analysis determined that the 0BaseT interface is a low risk for certification based on the vendor s oc to the IEEE 80.3i and the testing data collected at other data rates. 4. The SUT does not support this interface or was not tested. The UCR 03 defines minimum interface requirement, however, allows for additional interfaces BaseT/000BaseT interfaces were not submitted for testing, however, JITC analysis determined that these iinterfaces are low risk for certification based on the vendor s oc to the IEEE 80.3u/3ab, the testing data collected at higher data rates, and the testing data collected on these interfaces during previous testing with OS 5.(3)N(). 6. The UCR03 defines minimum interface requirements, however, allows for additional interfaces. 7. DISA adjudicated the 40 Gpbs interfaces are not certified for connection to other nodes. But the 40 Gpbs interfaces may be used for intra-system connections to fabric extenders. EGEND: 80.3ab 000BaseT Gbps Ethernet over twisted pair at Gbps 80.3ae 0 Gbps Ethernet 80.3ba 40/00 Gbps Ethernet 80.3i 0BaseT 0 Mbps Ethernet over twisted pair 80.3u Standard for carrier sense multiple access with collision detection at 00 Mbps 80.3z Gigabit Ethernet Standard 0BaseT 0 Mbps (Baseband Operation, Twisted Pair) Ethernet 00BaseT 00 Mbps (Baseband Operation, Twisted Pair) Ethernet 00BaseFX 00 Mbps Ethernet over Fiber 000BaseX 000 Mbps Ethernet over Fiber or Copper 000BaseT 000 Mbps (Baseband Operation, Twisted Pair) Ethernet 0000BaseX 0000 Mbps Ethernet over Fiber or Copper 0GBaseX 0000 Mbps Ethernet over Fiber or Copper 40GBaseX Mbps Ethernet over Fiber or Copper 00GBaseX Mbps Ethernet over Fiber or Copper A Access C Conditional Co Core CRs Capability s D Distribution FRs Functional s Gbps Gigabits per second Identification IEEE Institute of Electrical and Electronics Engineers IP Internet Protocol JITC Megabits per second Mbps Megabits per second O Optional R Required SUT System Under Test TIC Technology Integration Center UCR Unified Capabilities s USAISEC U.S. Army Information Systems Engineering Command UTP Unshielded Twisted Pair Enclosure 3