DEFENSE INFORMATION SYSTEMS AGENCY P. O. BOX 549 FORT MEADE, MARYLAND Joint Interoperability Test Command (JTE) 11 Sep 15

Transcription

1 DEFENSE INFORMATION SYSTEMS AGENCY P. O. BOX 549 FORT MEADE, MARYLAND IN REPLY REFER TO: Joint Interoperability Test Command (JTE) 11 Sep 15 MEMORANDUM FOR DISTRIBUTION SUBJECT: Extension of the Joint Interoperability Certification of the Brocade ICX 7000 Series, FastIron Software Release a References: (a) Department of Defense Instruction , "DoD Unified Capabilities (UC)," 9 December 2010 (b) Office of the Department of Defense Chief Information Officer, Department of Defense Unified Capabilities Requirements 2013, Errata 1, 1 July 2013 (c) through (d), see Enclosure 1 1. Certification Authority. References (a) and (b) establish the Joint Interoperability Test Command (JITC) as the Joint Interoperability Certification Authority for the Unified Capabilities (UC) products. 2. Conditions of Certification. The Brocade, ICX 7000 Series, FastIron Software Release a hereinafter referred to as the System Under Test (SUT), meets the critical requirements of the Unified Capabilities Requirements (UCR), Reference (b). The JITC certifies the SUT for joint use as Assured Services Local Area Network (ASLAN) Core, Distribution, and Layer 2/3 Access switch with conditions (see Table 1). The ICX 7000 Series products are available in stacked or standalone models each offering different interface capabilities. All ICX 7750 and ICX 7450 models in a stack configuration are certified only as Access products. In a standalone configuration, the ICX F, ICX Q, ICX Q, ICX , and ICX F are certified as Core, Distribution, and Access products. The ICX C, ICX , and ICX P models did not meet Core and Distribution requirements and are certified only as an Access product. Table 3-3 of Enclosure 3 provides detailed individual model information. This certification expires upon changes that affect interoperability, but no later than the expiration date specified in the UC Approved Products List (APL) memorandum. Desktop Reviews (DTR) 1 and 2 were requested to update the SUT Software release to b and to add the ICX 7250 switch to the certification. See paragraph 4 for test details.

2 Table 1. Conditions None Condition The ICX 7750 switches in this ICX 7000 Series do not support PoE 802.3af-2003 or 802.at-2009 UCR 2013 Paragraph Port Parameter EDG for VVoIP hard phones and other PoE dependent subtending equipment. The ICX 7000 Series in stacked configuration did not meet the blocking factor (2:1) for Core and Distribution products but did meet Access (8:1) requirements. The ICX 7000 Series switches in a standalone configuration did not meet single product redundancy requirements and must be fielded in a dual product redundancy configuration Per DTR2 V&V testing, the ICX7250 Layer 2 switch does not support Auto-negotiation at half-duplex operation IAW EDG Per LoC, the SUT partially comply with UCR 2013 Paragraph IPv6 Network Management IP , IP , and IP LEGEND: APL Approved Products List CoF Conditions of Fielding DISA Defense Information Systems Agency IPv6 Internet Protocol version 6 LoC Letter of Compliance POA&M Plan of Action and Milestones Operational Impact UCR Waivers Conditions of Fielding (CoF) Minor with CoF Minor with CoF Minor with CoF Minor with CoF Open Test Discrepancies Minor with POA&M PoE SUT UC UCR V&V VVoIP Remarks DISA has adjudicated this discrepancy as having a minor operational impact with the condition of fielding that the SUT is certified for data and VVoIP endpoints that do not require PoE. In a stacked configuration, the ICX 7000 Series switches can be employed as an Access product. In a standalone configuration, the ICX 7000 Series switches can be employed as Core and Distribution product with the condition of a dual product redundancy configuration. DISA has adjudicated this discrepancy as having a minor operational impact with the condition of fielding that the both ends are set to auto-negotiate, or both ends speed and duplex is explicitly set. DISA has accepted and approved the vendor s POA&M and adjudicated this discrepancy as having a minor operational impact. Power over Ethernet System Under Test Unified Capabilities Unified Capabilities Requirements Verification and Validation Voice and Video over Internet Protocol 3. Interoperability Status. Table 2 provides the SUT interface interoperability status. Table 3 provides the Capability Requirements (CR) and Functional Requirements (FR) status. Table 4 provides a Unified Capabilities (UC) Approved Products List (APL) product summary. 2

3 Interface Table 2. ASLAN Interface Status Applicability Co D A Threshold CRs/FRs ID (See note 1.) Status (Met, Partially Met, Not Met, Not Tested) Remarks Network Management Interfaces (See note 2.) IEEE 802.3i (10BaseT UTP) C C C 1 and 3. Met IEEE 802.3u (100BaseT UTP) C C C 1 and 3. Met IEEE 802.3ab (1000BaseT UTP) C C C 1 and 3. Met Access (User) Interfaces (See note 2.) IEEE 802.3i (10BaseT UTP) C C R 1, 2, and 3. Not Tested/Met See notes 3 and 4. IEEE 802.3u (100BaseT UTP) R R R 1, 2, and 3. Not Tested/Met See notes 3 and 4. IEEE 802.3u (100BaseFX) C C R 1, 2, and 3. Not Tested/Met See notes 3, 4 and 5. IEEE 802.3ab (1000BaseT UTP) C C R 1, 2, and 3. Met IEEE 802.3z (1000BaseX Fiber) R R R 1, 2, and 3. Met IEEE 802.3ae (10GBaseX) C C C 1, 2, and 3. Met Uplink (Trunk) Interfaces (See note 2.) IEEE 802.3u (100BaseT UTP) R R R 1, 2, 3, and 4. Not Tested/Met See notes 3 and 4. IEEE 802.3u (100BaseFX) C C R 1, 2, 3, and 4. Not Tested/Met See notes 3, 4 and 5. IEEE 802.3ab (1000BaseT UTP) C C R 1, 2, 3, and 4. Met IEEE 802.3z (1000BaseX Fiber) R R R 1, 2, 3, and 4. Met IEEE 802.3ae (10GBaseX) C C C 1, 2, 3, and 4. Met IEEE 802.3ba (40GBaseX) C C C 1, 2, 3, and 4. Met IEEE 802.3ba (100GBaseX) C C C 1, 2, 3, and 4. Not Tested See note 6. NOTE(S): 1. The SUT high-level CR and FR ID numbers depicted in the Threshold CRs/FRs column are cross-referenced in Table 3. These high-level CR/FR requirements refer to a detailed list of requirements provided in Enclosure Core and Distribution products must minimally support 100Base-X (802.3u) and 1000Base-X (802.3z). Access products must minimally support one of the following standards: 802.3i (10BaseT), 802.3j (10BaseF), 802.3u (100BaseT/F), 802.3z (1000BaseF), or 802.3ab (1000BaseT). Other rates and standards may be provided as conditional interfaces. 3. The 10/100 Mbps interface is not supported by the ICX 7750 model and was not tested. The ICX 7450 model met the interface requirements. 4. USAISEC TIC tested the 1/10 Gbps interfaces but not the 10/100BaseT interfaces. Analysis determined the 10/100BaseT interfaces are low risk for certification based on the vendor s Letters of Compliance to comply with the IEEE 802.3i/u standards and the testing data collected at all other data rates. 5. Due to test equipment limitations, this interface was not tested but is certified based on similarity and its use in an operational environment with no known operational impact. The SUT is compliant at higher data rates, therefore this is considered a low risk for certification. 6. The SUT does not support this interface. LEGEND: 802.3ab 1000BaseT Gbps Ethernet over twisted pair at 1 Gbps 802.3ae 10 Gbps Ethernet 802.3ba 40 and 100 Gigabit Ethernet Architecture 802.3i 10BaseT 10 Mbps Ethernet over twisted pair 802.3u Standard for carrier sense multiple access with collision detection at 100 Mbps 802.3z Gigabit Ethernet Standard 10BaseT 10 Mbps (Baseband Operation, Twisted Pair) Ethernet 100BaseT 100 Mbps (Baseband Operation, Twisted Pair) Ethernet 100BaseFX 100 Mbps Ethernet over Fiber 1000BaseX 1000 Mbps Ethernet over Fiber or Copper 1000BaseT 1000 Mbps (Baseband Operation, Twisted Pair) Ethernet 10000BaseX Mbps Ethernet over Fiber or Copper 10GBaseX Mbps Ethernet over Fiber or Copper 40GBaseX Mbps Ethernet over Fiber or Copper 100GBaseX Mbps Ethernet over Fiber or Copper A ASLAN C Co CRs D FRs Gbps ID IEEE Mbps R SUT UTP Access Assured Services Local Area Network Conditional Core Capability Requirements Distribution Functional Requirements Gigabits per second Identification Institute of Electrical and Electronics Engineers Megabits per second Required System Under Test Unshielded Twisted Pair 3

4 Table 3. ASLAN Capability Requirements and Functional Requirements Status CR/FR ID UCR Requirement (High-Level) (See note 1.) UCR 2013 Reference Status (Met, Partially Met, Not Met, Not Tested) 1 General LAN Switch and Router Product Requirements (R) Partially Met (See notes 2 and 3.) 2 LAN Switch and Router Redundancy Requirements (R) Met 3 LAN Product Requirements Summary (R) Met (See note 2.) 4 Multiprotocol Label Switching in ASLANs (O) Not Tested (See note 4.) NOTE(S): 1. The annotation of required refers to a high-level requirement category. Enclosure 3 addresses the applicability of each sub-requirement. 2. The SUT met the requirements with the conditions noted in Table 1. DISA adjudicated these conditions as minor. 3. Security is tested by a USAISEC TIC-led Information Assurance test team and the results published in a separate report, Reference (d). 4. Multiprotocol Label Switching is an optional requirement, was not tested, and therefore is not certified for use. LEGEND: ASLAN Assured Services Local Area Network CR Capability Requirement DISA Defense Information Systems Agency FR Functional Requirement ID Identification LAN Local Area Network O Optional R Required SUT System Under Test TIC Technology Integration Center UCR Unified Capabilities Requirements USAISEC United States Army Information Systems Engineering Command Table 4. SUT Product Summary Product Identification Product Name Brocade ICX 7000 Series Software Release b UC Product Type(s) Assured Services Local Area Network (ASLAN) Core/Distribution/Access Switch (L2/L3) Product Description The Brocade ICX 7000 Series delivers voice-class availability, 1/10/40 Gigabit Ethernet for switching VoIP, video, and data traffic. Product Components (See note 1.) Component Name (See note 2.) Version Remarks ASLAN Core/Distribution/Access Switch Brocade ICX F, ICX Q, ICX C, ICX , ICX P, ICX , ICX P, ICX F b Redundant power modules 4

5 Table 4. SUT Product Summary (continued) NOTE(S): 1. The detailed component and subcomponent list is provided in Enclosure Components bolded and underlined were tested by USAISEC TIC. The other components in the family series were not tested but are also certified for joint use. JITC certifies those additional components because they utilize the same software and similar hardware and JITC analysis determined them to be functionally identical for interoperability certification purposes. 3. The TIC conducted DTR #1 V&V testing of the ICX7750 product, from August 2015, update the certified code release to b. This new code release supports 10 GbE breakout capability of the 40 GbE, QFSP+ interfaces in a stand-alone configuration only on the ICX7000 series switches. The TIC s V&V testing confirmed this capability, and this breakout feature is certified for Standalone configurations only. The breakout feature is not supported or certified for a stack solution. 4. The TIC conducted V&V testing from August 2015, per DTR #2 to add the ICX7250 product noted below, The products can be added to the certification as Access only, with Conditions, as noted in Table 1, Conditions (Components bolded and underlined were tested by USAISEC TIC): Component Sub-Component Function Blocking Factor C/D (see note 4) A (see note 4) Stacked Configuration ICX G 24-port, 4 1 GbE Not Certified Medium ICX7250 ICX port, 8 1/10 GbE Not Certified Medium ICX P 24-port PoE, 8 1/10 GbE Not Certified Medium ICX port, 8 1/10 GbE Not Certified Medium ICX P 48-port PoE, 8 1/10 GbE Not Certified Medium Standalone Configuration ICX G 24-port, 4 1 GbE Not Certified Minimum, ICX port, 8 1/10 GbE Not Certified Maximum ICX7250 ICX P 24-port PoE, 8 1/10 GbE Not Certified Maximum ICX port, 8 1/10 GbE Not Certified Maximum ICX P 48-port PoE, 8 1/10 GbE Not Certified Maximum LEGEND: A Access ASLAN Assured Services Local Area Network SUT System Under Test CPU Central Processing Unit TIC Technology Integration Center C Core UC Unified Capabilities D Distribution USAISEC U.S. Army Information Systems Engineering Command DTR Desktop Review V&V Verification and Validation GbE Gigabit Ethernet VoIP Voice over Internet Protocol JITC Joint Interoperability Test Command 4. Test Details. The extension of this certification is based on Desktop Reviews (DTR) 1 and 2. The original certification is based on interoperability testing, DISA adjudication of open test discrepancy reports (TDRs), review of the vendor s Letters of Compliance (LoC), and DISA Certifying Authority (CA) recommendation for inclusion on the UC APL. Testing was conducted at the U.S. Army Information Systems Engineering Command (USAISEC) - Mission Engineering Directorate (MED), Technology Integration Center (TIC), hereafter referred to as USAISEC TIC, at Fort Huachuca, Arizona, from 5 January 2015 through 18 February 2015 using test procedures derived from Reference (c). DISA adjudication of outstanding TDRs was completed on 17 April Review of the vendor s LoC was completed on 6 March Information Assurance (IA) testing was conducted by USAISEC TIC-led IA test teams and the results published in a separate report, Reference (d). Enclosure 2 documents the test results and 5

6 describes the tested network and system configurations. Enclosure 3 provides a detailed list of the interface, capability, and functional requirements. DTR1 was requested to update the original certified code release from a to b. This new code release supports 10 GbE breakout capability of the 40 GbE, QFSP+ interfaces in a Standalone configuration only on the ICX7000 series switches. The TIC performed limited Verification and Validation (V&V) testing on August 2015, and confirmed this breakout capability at 10 GbE was interoperable, and no other certified features of functions were affected by this software update. This breakout feature is certified for Standalone configurations only and is not supported or certified for a stack solution. DTR1 had no impact on the approved IA posture, so no further IA testing was required. Therefore, JITC approves this DTR. DTR2 was requested to add the series of ICX7250 switches to this certification. The TIC conducted limited V&V testing from August 2015, to add the ICX7250 noted in Table 4, Note 4. These products are certified as Access only, with the conditions as noted in Table 1, Conditions. DTR2 had no impact on the approved IA posture, so no further IA testing was required. Therefore, JITC approves this DTR. 5. Additional Information. JITC distributes interoperability information via the JITC Electronic Report Distribution (ERD) system, which uses Sensitive but Unclassified IP Data (formerly known as NIPRNet) . Interoperability status information is available via the JITC System Tracking Program (STP). STP is accessible by.mil/.gov users at Test reports, lessons learned, and related testing documents and references are on the JITC Joint Interoperability Tool (JIT) at Due to the sensitivity of the information, the Information Assurance Accreditation Package (IAAP) that contains the approved configuration and deployment guide must be requested directly from the Unified Capabilities Certification Office (UCCO), disa.meade.ns.list.unified-capabilitiescertification-office@mail.mil. All associated information is available on the DISA UCCO website located at 6. Point of Contact (POC). The testing point of contact is Mr. James Hatch, commercial telephone (520) , DSN telephone ; address james.d.hatch12.civ@mail.mil.. The JITC point of contact is Mr. Matthew Quinn, commercial telephone (520) , DSN telephone , FAX DSN ; address matthew.r.quinn1.civ@mail.mil ; mailing address Joint Interoperability Test Command, ATTN: JTE (Mr. Matthew Quinn) P.O. Box 12798, Fort Huachuca, AZ The UCCO tracking number for the SUT is FOR THE COMMANDER: Enclosure a/s for RIC HARRISON Chief Networks/Communications and UC Portfolio 6

7 Distribution (electronic mail): DoD CIO Joint Staff J-6, JCS USD(AT&L) ISG Secretariat, DISA, JTA U.S. Strategic Command, J665 US Navy, OPNAV N2/N6FP12 US Army, DA-OSA, CIO/G-6 ASA(ALT), SAIS-IOQ US Air Force, A3CNN/A6CNN US Marine Corps, MARCORSYSCOM, SIAT, A&CE Division US Coast Guard, CG-64 DISA/TEMC DIA, Office of the Acquisition Executive NSG Interoperability Assessment Team DOT&E, Netcentric Systems and Naval Warfare Medical Health Systems, JMIS IV&V HQUSAISEC, ELIE-ISE-ME UCCO 7

8 ADDITIONAL REFERENCES (c) Joint Interoperability Test Command, Assured Services Local Area Network (ASLAN) Test Procedures Version 1.1 for Unified Capabilities Requirements (UCR) 2013 Errata 1, November 2014 (d) Joint Interoperability Test Command, Information Assurance (IA) Assessment of Brocade ICX7000 Series (Tracking Number ), 21 January 2015 Enclosure