DEFENSE INFORMATION SYSTEMS AGENCY P. O. BOX 4502 ARLINGTON, VIRGINIA

Transcription

1 DEFENSE INFOMATION SYSTEMS AGENCY P. O. BOX 4502 ALINGTON, VIGINIA IN EPLY EFE T O: Joint Interoperability Test Command (JTE) 16 Sep 11 MEMOANDUM FO DISTIBUTION SUBJEC T: Special Interoperability Test Certification of the Cisco Aggregation Services outer (AS) 1000 Series (selected models) with Internetwork Operating System (IOS) XE 2.4.2t eferences: (a) DoD Directive , Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS), 5 May 2004 (b) CJCSI E, Interoperability and Supportability of Information Technology and National Security Systems, 15 December 2008 (c) through (f), see Enclosure 1 1. eferences (a) and (b) establish the Joint Interoperability Test Command (JITC), as the responsible organization for interoperability test certification. 2. The C isco AS 1006 Customer Edge outer with IOS XE 2.4.2t hereinafter referred to as the System Under Test (SUT). The SUT meets all the critical interoperability requirements as a High Availability Customer Edge outer (CE) and is certified for joint use within the Defense Information System Network (DISN). When a CE meets the High Availability CE requirements it is also certified as a Medium Availability with System Quality Factors (SQF), Medium Availability without SQF, and Low Availability CE. The SUT met the critical interoperability requirements set forth in reference (c), using the test procedures derived from reference (d). The SUT met the critical interoperability requirements for the following interfaces: Institute of Electrical and Electronics Engineers (IEEE) 802.3i (10BaseT), IEEE 802.3u (100BaseT), IEEE 802.3ab (1000BaseT), Digital Signal Level (DS) 1, DS3, E-carrier (E) 1, E-3 and Serial EIA The Cisco AS 1004, AS 1002, and AS 1002-F employ the same software and similar hardware as the SUT. The JITC analysis determined these systems to be functionally identical to the SUT for interoperability certification purposes and they are also certified for joint use. Per the vendor s LoC, the SUT met all IPv6 requirements for a CE with following exceptions: The SUT partially met FC 4292; IP Forwarding Management Information Base (missing OID inetcidroutediscards); and does not comply with FCs 4301, 4302, 4303, 4552, and On 7 June 2011, DISA adjudicated these deficiencies as minor, and accepted the vendor POA&Ms for Fall No other configurations, features, or functions, except those cited within this memorandum, are certified by JITC. This certification expires upon changes that affect interoperability, but no later than three years from the date the DISA Certifying Authority (CA) provided a positive recommendation. 3. This finding is based on interoperability testing conducted by the Technology Integration Center (TIC), review of the vendor's Letters of Compliance (LoC), and DISA Information Assurance (IA) Certification Authority (CA) approval of the IA configuration. Interoperability

2 JITC Memo, JTE, Special Interoperability Test Certification of the Cisco Aggregation Services outer (AS) 1000 Series with Internetwork Operating System (IOS) XE 2.4.2t testing was conducted by the United States Army Information Systems Engineering Command, Technology Integration Center (USAISEC TIC), Fort Huachuca, Arizona, from 10 Jan 2011 through 28 Jan eview of the vendor s LoC was completed on 17 March The DISA CA has reviewed the IA Assessment eport for the SUT, eference (e), and based on the findings in the report has provided a positive recommendation on 2 June The acquiring agency or site will be responsible for the DoD Information Assurance Certification and Accreditation Process (DIACAP) accreditation. Enclosure 2 documents the test results and describes the tested network and system configurations including specified patch releases. Enclosure 3 provides a detailed list of the interface, capability, and functional requirements. 4. The interface, Capabilities equirements (C) and Functional equirements (F), and component status of the SUT are listed in Tables 1 and 2. The threshold Capability/Functional requirements for CEs are established by Section of eference (c) and were used to evaluate the interoperability of the SUT. Enclosure 3 provides a detailed list of the interface, capability and functional requirements. Interface 10Base-T 100Base-T 1000Base-X 10GbE Critical Yes Yes No No Table 1. SUT Interface Interoperability Status UC eference Threshold C/F Status equirements (see note 1) ASLAN Inte rfaces 1-3 Certified 1-3 Certified 1-3 Certified 1-3 Certified e marks Not provided by the vendor for testing (see note 2 & 4). Exceeds allowable variance by 0.9%, adjudicated as minor by DISA on 7 June 2011(see not e 3). Exceeds allowable variance by 1.44%, adjudicated as minor by DISA on 7 June 2011(see not e 3). Exceeds allowable variance by 1.81 %, adjudicated as minor by DISA as minor on 7 June 2011(see note 3). 2

3 JITC Memo, JTE, Special Interoperability Test Certification of the Cisco Aggregation Services outer (AS) 1000 Series with Internetwork Operating System (IOS) XE 2.4.2t Interface 10Base-T 100Base-T 1000Base-X 10GbE Table 1. SUT Interface Interoperability Status (continued) Critical Yes Yes No No UC eference Threshold C/F equirements (see note 1) WAN Inte rfaces Status 1-3 Certified 1-3 Certified 1-3 Certified 1-3 Certified DS1 No 1-2 Certified DS3 No 1-2 Certified E1 No 1-2 Certified E3 No 1-2 Certified Serial EIA-530 No 1-2 Certified Network Management Interfaces 10Base-T Yes Certified 100Base-T Yes Certified e marks Not provided by the vendor for testing. (see note 2 & 4). Exceeds allowable variance by 0.9%, adjudicated as minor by DISA on 7 June 2011(see note 3). Exceeds allowable variance by 1.44%, adjudicated as minor by DISA on 7 June 2011(see note 3). Exceeds allowable variance by 1.81 %, adjudicated as minor by DISA as minor on 7 June 2011(see note 3). Exceeds current lat ency requirements; DISA determined a change in requirements was required 7 June 2011 to change latency to 15ms per transaction from DISA. Exceeds current lat ency requirements; DISA determined a change in requirements was required 7 June 2011 to change latency to 15ms per transaction from DISA. Not provided by vendor for testing. (see Note 2 & 4) Fs for the IEEE 802.3u (100BaseT) interface. This was met by vendor s letters of compliance and evaluation. NO TES : 1. The annotation of required refers to a high-level requirement category. The applicability of each sub-requirement is provided in Enclosure The UC states the minimum interface requirement for a CE ASLAN and WAN interface is Ethernet 10Base-T or 100Base-T. 3. The UC Change 2 Paragraph states that each shaped CE queue can have margin of error of +/- 10 percent. Int erfaces that exceeded this amount were adjudicated by DISA as minor on 7 June All interfaces were tested with the exception of 10BaseT. Analysis determined 10BaseT is low risk for certification based on the vendor s letter of compliance to comply with IEEE 802.3i and test ing dat a collect ed at all other rat es. LEG END: 802.3i 10 Megabits Per Second Base Band over Twisted Pair 802.3u Standard for carrier sense multiple access with collision detection at 100 Megabits per Second ASLAN Assured Services Local Area Network CE Customer Edge outer C Capability equirement DISA Defense Information Systems Agency DS1 Digital Signal Level 1 (1.544 Mbps) DS3 Digital Signal Level 3 E1 European Basic Multiplex ate (2.048 Mbps) E3 EIA F GbE ID IEEE kbps Mbps SUT UC WAN European Basic Multiplex ate (34 Mbps) Electronic Industries Alliance Functional equirement Gigabit Ethernet Identification Institute of Electrical and Electronics Engineers kilobits per second Megabits per second System Under Test Unified Capabilities equirements Wide Area Net work 3

4 JITC Memo, JTE, Special Interoperability Test Certification of the Cisco Aggregation Services outer (AS) 1000 Series with Internetwork Operating System (IOS) XE 2.4.2t C/F ID Table 2. SUT Capability equire ments and Functional equirements Status Capability/ Function Applicability 1 UC eference Status e marks Product Interface equirements Internal Interface equirements equired Met Fs. External Physical Interfaces between Network Components equired Met Fs. 1 IP Queue Control Capabilities equired para 1 Met Fs. Differentiated Services Code Point equired Met Fs. VVoIP Per-Hop Behavior equirements equired Met Fs. Traffic Conditioning Partially equired equirements Met 2 Customer Edge outer equirements 2 Traffic Conditioning equired Met Fs. Differentiated Services Support equired Met Fs. Per Hop Behavior Support equired Met Fs. Int erface to the LSC/MFSS The SUT does not support this feature Conditional Not Tested for Traffic Conditioning and it is not required. Int erface to the LSC/MFSS The SUT does not support this feature Conditional Not Tested for Bandwidth Allocation and it is not required. Fs. Availability equired Met The SUT met High Availability CE requirements. 3 All Ethernet int erfaces met the requirement. TDM interfaces cannot be Packet Transit Time equired Met tested as described in paragraph of the UC and are recorded as informational until further guidance from DISA 2 CE Interfaces and Throughput Support equired Met Fs. Assured VVoIP Lat ency equired Met Fs. 4 Assured VVoIP CE Lat ency equired Met Fs. 4 Assured VVoIP CE-to-CE Lat ency equired Met Fs. 4 Assured VVoIP CE-to-CE Jitter equired Met Fs. 4 Assured VVoIP CE Jitter equired Met Fs. 4 Assured VVoIP CE-to-CE Packet Loss equired Met Fs. 4 Assured VVoIP CE Packet Loss equired Met Fs. 4 End-to-End Availability equired Met Fs. 4 Availability Design Factors equired Met Fs. 4 Product Quality Factors equired Met Fs. Layer 1 Physical Layer equired Met Fs. Layer 2 Dat a Link Layer equired Met Fs. Provisioning equired Met Fs. 4 4

5 JITC Memo, JTE, Special Interoperability Test Certification of the Cisco Aggregation Services outer (AS) 1000 Series with Internetwork Operating System (IOS) XE 2.4.2t Table 2. SUT Capability equire ments and Functional equirements Status (continued) C/F ID Capability/ Function Applicability 1 UC eference Status e marks Customer Edge outer equirements Int erchangeabilit y equired Met The SUT met this requirement with Static outing, BGP -4, IS-IS, OSP Fv2, and OSP Fv3. Voice Grade of Service equired Met Fs. 4 Survivability equired Not Tested This is an E2E engineering requirement and is not testable in a lab environment. 5 Internet Protocol Version 6 equirements Fs Partially IPv6 equired with the following minor exception as 3 Met listed in note 6. Product equirements equired Met Fs. Network Management equirements VVoIP NMS Interface equirements NM equirements for CEs 4 equired Met equired Met Network Management equired Met SUT met all critical Cs and Fs for the 802.3u (100BaseT) interface. SUT met all critical Cs and Fs for the 802.3u (100BaseT) interface. SUT met all critical Cs and Fs for the 802.3u (100BaseT) interface. NO TES : 1. Annotation of required refers to high-level requirement category. Applicability of each sub-requirement is provided in Enclosure The maximum allowed packet transit times allowed for T1 and E1 Voice packets are ms and ms respectively. The SUT actual measured Packet Transit Times end to end through the network are: T1 = ms and E1 = ms. The rest of the TDM interfaces (T3, E3, and Serial) met the requirement of 2 ms + serialization delay. On 7 June 2011, DISA adjudicated this deficiency as minor and committed that this requirement needed to be changed in future versions of the UC to be less stringent. 3. To meet the High and Medium Availability requirements with SQF, the SUT must be deployed with dual Embedded Service Processors, dual oute Processors, and dual SPA Interface Processor cards. 4. This requirement was verified in an operational emulated environment. To meet E2E requirements, the SUT must be deployed in accordance with its deployment guide and the engineering guidelines provided in UC Section This is an End-to-End engineering requirement and, due to variations in network architectures, it could not be accurately tested in a lab environment. To meet E2E requirements, the SUT must be deployed in accordance with its deployment guide and the engineering guidelines provided in UC Section The SUT met all IPv6 requirements for a CE through testing and vendor LoC with following exceptions: The SUT partially met FC 4292; IP Forwarding MIB (missing OID inetcidroutediscards); and does not comply with FCs 4301, 4302, 4303, 4552, and On 7 June 2011, DISA adjudicated these deficiencies as minor, and accepted the vendor POA&Ms for Fall LEG END: BGP Border Gateway Protocol CE Customer Edge CE Customer Edge outer C Capability equirement DISA Defense Information Systems Agency E2E End-to-End EBC Edge Boundary Controller F Functional equirement ID Identification IP Int ernet Protocol IPv4 Internet Protocol version 4 IPv6 Internet Protocol version 6 IS-IS Int ermediat e Syst em-intermediate System LoC Lett ers of Compliance LSC Local Session Controller MFSS Multifunction Softswitch ms millisecond MIB Management Information Base NM Network Management NMS Network Management System POA&M Plan of Actions and Milestones OID Object Identifier OSP F Open Shortest Path First FC equest For Comment SQF System Quality Factors SUT System Under Test UC Unified Capabilities equirements VP Virtual outer edundancy Protocol VVoIP Voice and Video over Internet Protocol 5

6 JITC Memo, JTE, Special Interoperability Test Certification of the Cisco Aggregation Services outer (AS) 1000 Series with Internetwork Operating System (IOS) XE 2.4.2t 5. No detailed test report was developed in accordance with the Program Manager s request. JITC distributes interoperability information via the JITC Electronic eport Distribution (ED) system, which uses Unclassified-But-Sensitive Internet Protocol outer Network (NIPNet) e- mail. More comprehensive interoperability status information is available via the JITC System Tracking Program (STP). The STP is accessible by.mil/gov users on the NIPNet at Test reports, lessons learned, and related testing documents and references are on the JITC Joint Interoperability Tool (JIT) at (NIPNet). Information related to DSN testing is on the Telecom Switched Services Interoperability (TSSI) website at Test reports, lessons learned, and related testing documents and references are on the JITC Joint Interoperability Tool (JIT) at (NIPNet), or (SIPNet). Information related to DSN testing is on the Telecom Switched Services Interoperability (TSSI) website at Due to the sensitivity of the information, the Information Assurance Accreditation Package (IAAP) that contains the approved configuration and deployment guide must be requested directly through government civilian or uniformed military personnel from the Unified Capabilities Certification Office (UCCO), ucco@disa.mil. 6. The JITC point of contact is Mr. Edward Mellon, DSN , commercial (520) , FAX DSN , or to edward.mellon@disa.mil. The JITC s mailing address is P.O. Box 12798, Fort Huachuca, AZ The Tracking Number for the SUT is FO THE COMMANDE: 3 Enclosures a/s for BADLEY A. CLAK Chief Battlespace Communications Portfolio 6

7 JITC Memo, JTE, Special Interoperability Test Certification of the Cisco Aggregation Services outer (AS) 1000 Series with Internetwork Operating System (IOS) XE 2.4.2t Distribution (electronic mail): Joint Staff J-6 Joint Interoperability Test Command, Liaison, TE3/JT1 Office of Chief of Naval Operations, CNO N6F2 Headquarters U.S. Air Force, Office of Warfighting Integration & CIO, AF/XCIN (A6N) Department of the Army, Office of the Secretary of the Army, DA-OSA CIO/G-6 ASA (ALT), SAIS-IOQ U.S. Marine Corps MACOSYSCOM, SIAT, MJI Division I DOT&E, Net-Centric Systems and Naval Warfare U.S. Coast Guard, CG-64 Defense Intelligence Agency National Security Agency, DT Defense Information Systems Agency, TEMC Office of Assistant Secretary of Defense (NII)/DOD CIO U.S. Joint Forces Command, Net-Centric Integration, Communication, and Capabilities Division, J68 Defense Information Systems Agency, GS23 7

8 ADDITIONAL EFEENCES (c) Office of the Assistant Secretary of Defense, Department of Defense Unified Capabilities equirements 2008, Change 2 December 2010 (d) Joint Interoperability Test Command, Unified Capabilities Test Plan (UCTP) (e) Joint Interoperability Test Command, Information Assurance (IA) Assessment of Cisco AS 1000 with IOS XE 2.4.2t (Tracking Number ) Enclosure 1

9 CETIFICATION TESTING SUMMAY 1. SYSTEM TITLE. The Cisco Aggregation Services outer (AS) 1006 with IOS XE 2.4.2t, hereinafter referred to as the System Under Test (SUT). 2. SPONSO. U.S. Army - 5 th Signal Command 3. POGAM MANAGE. Mr. Willie Walker, 5 th Signal Command, CM 467, Box 3246, APO, AE 09096, willie.walker7@us.army.mil. 4. TESTE. Testing conducted at Department of Army Distributed Testing Lab, United States Army Information Systems Engineering Command, Technology Integration Center (USAISEC TIC), ATTN: James Hatch, ELIE-ISE-TI, Building Arizona Street, Fort Huachuca, AZ ; (520) , James.Hatch@us.army.mil. 5. SYSTEM DESCIPTION. The Unified Capabilities equirements (UC) defines a Customer Edge outer (CE) as a router located at the boundary between the Edge segment and the Access segment in the TS IA Architecture. The CE provides traffic conditioning, bandwidth management on a granular service class (i.e. voice, video) basis, and quality of service based on the TS requirements. A base/post/camp/station may have a single CE or multiple CEs based on the local architecture. The SUT is an intelligent unified communications network border element. Perimeter routers are components used for scaling unified communications networks from being Internet Protocol (IP) islands within a single customer network to becoming an end-toend IP community. The SUT is a solution that provides a network-to-network demarcation interface for signaling interworking, media interworking, address and port translations, billing, security, Quality-of-Service (QoS), and bandwidth management. The SUT AS platform embeds virtual private network (VPN), multicast and other Internetworking Operating System (IOS) software services as well as security functions directly inside the router. a. SUT (High and Medium Availability with System Quality Factors (SQF)). The SUT must be deployed with dual Embedded Service Processors, dual oute Processors, and dual SPA Interface Processor cards. It meets all of the lesser requirements (i.e. Medium Availability with and without SQF, and Low Availability. b. SUT (Medium Availability). The Cisco AS 1006 is certified as a Medium Availability CE when it is deployed with the following hardware; a single P, a single ESP, and dual SIPs. The AS 1004 and AS 1002 employ the same software and similar hardware as the SUT, and are certified as Medium Availability CEs when deployed with the following hardware: The AS 1004 CE with a single Embedded Service Processor (ESP), a single oute Processor (P), and dual Shared Port Enclosure 2

10 Adapter Interface Processor (S IPs); the AS 1002 as a Medium Availability CE with a single ESP and dual S IPs with an integrated P and 4 onboard gigabit ports; or as the AS 1002-F with an integrated P, ESP, SIP, and 4 onboard gigabit ports. c. SUT (Low Availability). The low availability solution does not require redundancy. The SUT is certified in a single chassis configuration for low availability. 6. OPEATIONAL ACHITECTUE. Figure 2-1 depicts the DISN Unified Capabilities notional operational architecture that the SUT may be used in. LEGEND: ASLAN Assured Services Local Area Network AS-SIP Assured Services Session Initiation Protocol B/P/C/S Base / Post / Camp / Station BI Basic ate Interface CE Customer Edge (CE outer) DISN Defense Information Systems Network EBC EI IP ISDN LSC TDM WAN Edge Border Controller End Instrument Internet Protocol Integrated Services Digital Netw ork Local Session Controller Time Division Multiplex Wide Area Netw ork Figure 2-1. DISN Unified Capabilities Notional Operational Architecture 7. INTEOPEABILITY EQUIEMENTS. The interface, Capability equirements (C) and Functional equirements (F), Information Assurance (IA), and other 2-2

11 requirements for customer edge routers are established by Section of eference (c). 7.1 Interfaces. The SUT uses the interfaces shown in Table 2-1 to connect to the Global Information Grid (GIG) network. This table shows the physical interfaces supported by the SUT and the associated standards. Table 2-1. Customer Edge outer Interface equirements Interface Critical UC eference Criteria 1 ASLAN Interfaces 10Base-T Yes Support minimum threshold Cs/Fs (1-3) and meet interface criteria for IEEE 802.3i 100Base-T Yes Support minimum threshold Cs/Fs (1-3) and meet interface criteria for IEEE802.3u 1000Base-X No Support minimum threshold Cs/Fs (1-3) and meet interface criteria for IEEE 802.3z and 802.3ab 10 GbE No Support minimum threshold Cs/Fs (1-3) and meet interface criteria for IEEE 802.3ae WAN Interfaces 10Base-T Yes Support minimum threshold Cs/Fs (1-3) and meet interface criteria for IEEE 802.3i 100Base-T Yes Support minimum threshold Cs/Fs (1-3) and meet interface criteria for IEEE802.3u 1000Base-X No Support minimum threshold Cs/Fs (1-3) and meet interface criteria for IEEE 802.3z 10GbE No Support minimum threshold Cs/Fs (1-3) and meet interface criteria for IEEE 802.3ae DS1 No Support minimum threshold Cs/Fs (1-3) and meet interface criteria for ANSI T1.102 DS3 No Support minimum threshold Cs/Fs (1-3) and meet interface criteria for ITU-T G.703 E1 No Support minimum threshold Cs/Fs (1-3) and meet interface criteria for ITU-T G.703 E3 No Support minimum threshold Cs/Fs (1-3) and meet interface criteria for ITU-T G.703 Serial Support minimum threshold Cs/Fs (1-3) and No EIA-530 meet interface criteria for EIA 530 Network Management Interfaces 10Base-T Yes Support minimum threshold Cs/Fs (4) and meet interface criteria for IEEE 802.3i 100Base-T Yes Support minimum threshold Cs/Fs (4) and meet interface criteria for IEEE802.3u NOT ES: 1. C/F requirements are contained in Table 2-2. C/F numbers represent a roll-up of UC requirements. Enclosure 3 provides a list of more detailed requirements for CE products. 2. Must provide a minimum of one of the listed interfaces. 2-3

12 Table 2-1. Customer Edge outer Interface equirements (continue) LEGEND: 802.3ab 1000BASE-T Gbit/s Ethernet over tw isted pair at 1 Gbit/s 802.3i 10 Megabits/s Base Band over Tw isted Pair 802.3u Standard for carrier sense multiple access w ith collision detection at 100 Megabits per Second 802.3z 1000BASE-X Gbit/s Ethernet over Fiber-Optic at 1 Gbit/s ANSI American National Standard Institute ASLAN Assured Services Local Area Network CE Customer Edge outer C Capability equirement F Functional equirement DS1 Digital Signal 1 DS3 Digital Signal 3 E1 European Carrier 1 E3 European Carrier 3 EIA Electrical Industry Association GbE Gigabit Ethernet Gbits/s Gigabits per second IEEE Institute of Electrical and Electronics Engineers UC Unified capabilities equirements WAN Wide Area Netw ork 7.2 Capability equirements (C) and Functional equirements (F). CEs have required and conditional features and capabilities that are established by Section of the UC. The SUT does not need to provide non-critical (conditional) requirements. If they are provided, they must function according to the specified requirements. The SUT s features and capabilities and its aggregated requirements IAW the customer edge router requirements are listed in Table 2-2. Detailed C/F requirements are provided in Table 3-1 of Enclosure 3. Table 2-2. Customer Edge outer Capability equirements and Functional equirements C/F ID Capability/ Function Applicability 1 Product Interface equirements Internal Interface equirements External Physical Interfaces between Netw ork Components 1 IP Queue Control Capabilities equired Differentiated Services Code Point VVoIP Per-Hop Behavior equirements Traffic Conditioning equirements Customer Edge outer equirements 2 2 UC eference equired equired para 1 equired equired equired Traffic Conditioning equired Differentiated Services Support equired Per Hop Behavior Support equired Interface to the LSC/MFSS for Traffic Conditioning Conditional Interface to the LSC/MFSS for Bandwidth Allocation Conditional Availability equired Packet Transit Time equired CE Interfaces and Throughput Support equired Assured VVoIP Latency equired emarks 2-4

13 Table 2-2. Customer Edge outer Capability equirements and Functional equirements (continued) C/F ID 2 Capability/ Function Applicability 1 UC eference Assured VVoIP CE Latency equired Assured VVoIP CE-to- CE Latency equired Assured VVoIP CE-to- CE Jitter equired Assured VVoIP CE Jitter equired Assured VVoIP CE-to- CE Packet Loss equired Assured VVoIP CE Packet Loss equired End-to-End Availability equired Availability Design Factors equired Product Quality Factors equired Layer 1 Physical Layer equired Layer 2 Data Link Layer equired Provisioning equired Interchangeability equired Voice Grade of Service equired Survivability equired Internet Protocol Version 6 equirements 3 IPv6 equired Product equirements equired Network Management equirements VVoIP NMS Interface equirements equired NM equirements for CEs equired Netw ork Management equired emarks This is an E2E engineering requirement and is not testable in a lab environment

14 Table 2-2. Customer Edge outer Capability equirements and Functional equirements (continued) NOT ES: 1. The annotation of required refers to a high-level requirement category. The applicability of each sub-requirement is provided in Enclosure 3. The SUT does not need to provide conditional requirements. However, if a capability is provided, it must function according to the specified requirements. 2. If a CE meets the High Availability CE requirements, it meets all of the lesser requirements for Medium Availability w ith and w ithout SQF and Low Availability. 3. This requirement w as verified in an operational emulated environment. To meet E2E requirements, the SUT must be deployed in accordance w ith its deployment guide and the engineering guidelines provided in UC Section This is an E2E engineering requirement and, due to variations in network architectures, it could not be accurately tested in a lab environment. To meet E2E requirements, the SUT must be deployed in accordance with its deployment guide and the engineering guidelines provided in UC Section LEGEND: BGP Border Gateway Protocol CE Customer Edge CE Customer Edge outer C Capability equirement E2 E End-to-End EBC Edge Boundary Controller F Functional equirement ID Identification IEEE Institute of Electrical and Electronics Engineers IP Internet Protocol IPv6 Internet Protocol version 6 IS-IS Intermediate System-Inter mediate System LoC LSC MFSS NM NMS OSPF SQF SUT UC VVoIP Letters of Compliance Local Session Controller Multifunction Softswitch Netw ork Management Netw ork Management System Open Shortest Path First System Quality Factors System Under Test Unified Capabilities equirements Voice and Video over Internet Protocol 7.3 Information Assurance. Table 2-3 details the Information Assurance (IA) requirements applicable to the CE products. Table 2-3. CE IA equirements equirement Applicability (See note ) UC eference General equirements equired Criteria Authentication equired Integrity equired Confidentiality equired Non-epudiation equired Detailed requirements and associated criteria for CE are listed in the IATP, eference (e). Availability equired NOT E: The annotation of required refers to a high-level requirement category of IA requirements from the UC 2008, Change 2, Section 5.4. The detailed IA requirements are included in eference (e). LEGEND: CE Customer Edge outer IA Information Assurance IATP UC IA Test Plan Unified capabilities equirements 7.4 Other. None 2-6

15 8. TEST NETWOK DESCIPTION. The SUT was tested at the Technology Integration Center (TIC), Fort Huachuca, Arizona, in a manner and configuration similar to that of a notional operational environment. Testing the system s required functions and features was conducted using the test configuration depicted in Figure 2-2. Figure 2-2 depicts the SUT High Availability test configuration. LEGEND: ACS AD ASLAN CAT CE EBC GIG IO IOS LSC Access Control Server Active Directory Assured Service Local Area Network Category Customer Edge outer Edge Boundary Controller Global Information Grid Interoperability Internetw ork Operating System Local Session Controller Pro Professional AE equired Ancillary Equipment SSHv2 Secure Shell Protocol version 2 SP Service Pack T1 Transmission Carrier 1 T3 Transmission Carrier 3 TACACS+ Terminal Access Controller Access-Control System VLAN Virtual Local Area Network XP Experience Figure 2-2. SUT High Availability Test Configuration 9. SYSTEM CONFIGUATIONS. Table 2-4 provides the system configurations and hardware and software components tested with the SUT. The SUT was tested in an 2-7

16 operationally realistic environment to determine its interoperability capability with associated network devices and network traffic. Table 2-4. Tested System Configurations System Name Cisco 7606-S equired Ancillary Equipment Component (See note 1.) Cisco AS1006, AS1004, AS1002, AS1002-F (See Note 2) elease IOS XE 2.4.2t Software 12.2(33)SE2 Equipment Active Directory SysLog Terminal Access Controller Access Control System Plus Site-Provided management PC Sub-Component (See note 1.) Description AS1000-ESP20 Embedded Services Processor 20G AS1000-ESP10 Embedded Services Processor, 10G AS1000-ESP5 Embedded Services Processor, 5Gbps AS1000-P1 oute Processor AS1000-SIP10 SPA Interface Processor 10G SPA-1X10GE-L-V2 1-port 10 Gigabit Ethernet Shared Port Adapter SPA-8X1GE-V2 8-port Gigabit Ethernet Shared Port Adapter SPA-10X1GE-V2 10-port Gigabit Ethernet Shared Port Adapter SPA-2X1GE-V2 2-Port Gigabit Ethernet Shared Port Adapter SPA-5X1GE-V2 5-Port Gigabit Ethernet Shared Port Adapter SPA-8X1FE-TX-V2 8-Port Fast Ethernet (TX) Shared Port Adapter SPA-4X1FE-TX-V2 4-Port Fast Ethernet (TX) Shared Port Adapter SPA-8XCHT1/E1 8-port Channelized T1/E1 to DS0 Shared Port Adapter SPA-4XT3/E3 4-port Clear Channel T3/E3 Shared Port Adapter SPA-2XT3/E3 2-port Clear Channel T3/E3 Shared Port Adapter SPA-4XCT3/ DS0 4-Port Channelized T3 (DS0) Shared Port Adapter SPA-2XCT3/ DS0 2-Port Channelized T3 (DS0) Shared Port Adapter SPA-4XT-SEIAL 4-port Serial Shared Port Adapter NOT ES: 1. Components in bold w ere tested by TIC. The other components in the family series were not tested; however, they utilize the same software and similar hardw are and JITC analysis determined them to be functionally identical for interoperability certification purposes and they are also certified for joint use. 2. The high availability and medium availability w ith SQF solutions include the SUT as a fully redundant chassis (redundant P, fabric, and power supplies) w ith no single point of failure. The medium availability w ithout SQF and low availability solutions do not require redundancy. 10. TESTING LIMITATIONS. Due to variations in network architectures, the End-to- End (E2E) engineering requirements were verified in an operational emulated environment. To meet E2E requirements, the SUT must be deployed in accordance with its deployment guide and the engineering guidelines in UC Section INTEOPEABILITY EVALUATION ESULTS. The SUT meets the critical interoperability requirements for a CE in accordance with UC 2008, Change 2, Section , and is certified for joint use with other network infrastructure products listed on the UC APL. Additional discussion regarding specific testing results is located in subsequent paragraphs Interfaces. The interface status of the SUT is provided in Table

17 Interface Table 2-5. SUT Interface Interoperability Status Critical UC eference Threshold C/F equirements (see note 1.) ASLAN Interfaces Status emarks 10Base-T Yes Not provided by the vendor for 1-3 Certified testing. (see note 2 & 5) 100Base-T Yes Exceeds allowable variance by 1-3 Certified 0.9%, adjudicated as minor by DISA on 7 June 2011(see note 3). 1000Base-X No Exceeds allowable variance by 1-3 Certified 1.44%, adjudicated as minor by DISA on 7 June 2011(see note 3). Exceeds allowable variance by GbE No Certified %, adjudicated as minor by DISA as minor on 7 June 2011(see note 3). WAN Interfaces 10Base-T Yes Not provided by the vendor for 1-3 Certified testing. (see note 2 & 5) 100Base-T Yes Exceeds allowable variance by 1-3 Certified 0.9%, adjudicated as minor by DISA on 7 June 2011(see note 3). 1000Base-X No Exceeds allowable variance by Certified 1.44%, adjudicated as minor by DISA on 7 June 2011(see note 3). Exceeds allowable variance by GbE No Certified %, adjudicated as minor by DISA as minor on 7 June 2011(see note 3). DS1 No 1-3 Certified See note 4. DS3 No 1-3 Certified Fs for this interface. E1 No 1-3 Certified See note 4. E3 No 1-3 Certified Serial EIA-530 WAN Interfaces (continued) No 1-3 Certified Network Management Interfaces 10Base-T Yes Certified 100Base-T Yes Certified Fs for this interface. Fs for the EIA-530 serial interf aces. Not provided by the vendor for testing. (see note 2 & 5) Fs for this interface. 2-9

18 Table 2-5. SUT Interface Interoperability Status (continued) Interface Critical UC eference Threshold C/F equirements (see note 1.) Status emarks NOT ES: 1. The C/F requirements are contained in Table 2-2. The C/F ID numbers represent a roll-up of UC requirements. Enclosure 3 provides a list of more detailed requirements for a CE. 2. The UC states the minimum interface requirement for a CE ASLAN and WAN interface is Ethernet 10Base-T or 100Base-T. 3. The UC Paragraph states that each shaped CE queue can have margin of error of +/- 10 percent. Interfaces that exceeded this amount were adjudicated by DISA as minor on 7 June The maximum allow ed packet transit times allow ed for DS1 and E1 Voice packets are ms and ms respectively. The SUT actual measured Packet Transit Times end to end through the network are: DS1 = ms and E1 = ms. The rest of the TDM interfaces (DS3, E3, and Serial) met the requirement of 2 ms + serialization delay. DISA determined that a requirement change is needed for the latency of the DS1 and E1 interfaces, 7 June All interfaces were tested with the exception of 10BaseT. Analysis determined 10BaseT is low risk for certification based on the vendor s letter of compliance to comply with IEEE 802.3i and testing data collected at all other rates. LEGEND: 802.3i 10 Megabits Per Second Base Band over Twisted Pair 802.3u Standard for carrier sense multiple access with collision detection at 100 Megabits per Second ASLAN Assured Services Local Area Network CE Customer Edge outer C Capability equirement DISA DS1 Defense Information Systems Agency Digital Signal Level 1 (1.544 Mbps) (2.048 Mbps European) DS3 Digital Signal Level 3 E1 EIA F GbE ID IEEE kbps Mbps ms SUT UC WAN European Basic Multiplex ate (2.048 Mbps) Electronic Industries Alliance Functional equirement Gigabit Ethernet Identification Institute of Electrical and Electronics Engineers kilobits per second Megabits per second millisecond System Under Test Unified Capabilities equirements Wide Area Network 11.2 Capability equirements (C) and Functional equirements (F). The SUT C and F status is depicted in Table 2-6. Detailed C/F requirements are provided in Enclosure 3, Table 3-1. Table 2-6. SUT Capability equirements and Functional equirements Status C/F ID Capability/ Function Product Interface equirements Internal Interface equirements External Physical Interfaces 1 between Netw ork Components IP Queue Control Capabilities Applicability (See note 1.) UC eference Status equired Met equired Met equired para 1 Met emarks Fs. Fs. Fs. 2-10

19 Table 2-6. SUT Capability equirements and Functional equirements Status (continued) C/F Capability/ Function Applicability 1 UC ID eference Status Product Interface equirements (continued) Differentiated Services Code Point equired Met 1 VVoIP Per-Hop Behavior equirements equired Met Traffic Conditioning Partially equired equirements Met 2 Customer Edge outer equirements 2 Traffic Conditioning equired Met Differentiated Services Support equired Met Per Hop Behavior Support equired Met Interface to the LSC/MFSS for Traffic Conditioning Interface to the LSC/MFSS for Bandwidth Allocation Conditional Conditional Not Tested Not Tested Availability equired Met Packet Transit Time equired Met CE Interfaces and Throughput Support equired Met Assured VVoIP Latency equired Met Assured VVoIP CE Latency equired Met Assured VVoIP CE-to-CE Latency equired Met Assured VVoIP CE-to-CE Jitter equired Met Assured VVoIP CE Jitter equired Met Assured VVoIP CE-to-CE Packet Loss equired Met Assured VVoIP CE Packet Loss equired Met End-to-End Availability equired Met Availability Design Factors equired Met Product Quality Factors equired Met Layer 1 Physical Layer equired Met Layer 2 Data Link Layer equired Met Provisioning equired Met Interchangeability equired Met emarks Fs. Fs. Fs. Fs. Fs. The SUT does not support this feature and it is not required. The SUT does not support this feature and it is not required. Fs. The SUT met High Availability CE requirements. 3 All Ethernet interfaces met the requirement. TDM interfaces cannot be tested as described in paragraph of the UC and are recorded as informational until further guidance from DISA 2 Fs. Fs. 4 Fs. 4 Fs. 4 Fs. 4 Fs. 4 Fs. 4 Fs. 4 Fs. 4 Fs. 4 Fs. Fs. Fs. Fs. 4 The SUT met this requirement with Static outing, BGP-4, IS-IS, OSPFv2, and OSPFv

20 Table 2-6. SUT Capability equirements and Functional equirements Status (continued) C/F Capability/ Function Applicability 1 UC ID eference Customer Edge outer equirements (continued) 2 Status Voice Grade of Service equired Met Survivability equired Internet Protocol Version 6 equirements 3 IPv6 equired Not Tested Partially Met Product equirements equired Met Network Management equirements 4 VVoIP NMS Interface equirements NM equirements for CEs equired Met equired Met Netw ork Management equired Met emarks Fs. 4 This is an E2E engineering requirement and is not testable in a lab environment. 5 Fs w ith the follow ing minor exception as listed in note 6. Fs. SUT met all critical Cs and Fs for the 802.3u (100BaseT) interface. SUT met all critical Cs and Fs for the 802.3u (100BaseT) interface. SUT met all critical Cs and Fs for the 802.3u (100BaseT) interface. NOT ES: 1. Annotation of required refers to high-level requirement category. Applicability of each sub-requirement is provided in Enclosure The maximum allow ed packet transit times allow ed for DS1 and E1 Voice packets are ms and ms respectively. The SUT actual measured Packet Transit Times end to end through the network are: DS1 = ms and E1 = ms. The rest of the TDM interfaces (DS3, E3, and Serial) met the requirement of 2 ms + serialization delay. On 7 June 2011, DISA adjudicated this deficiency as minor and committed that this requirement needed to be changed in future versions of the UC to be less stringent. 3. To meet the High and Medium Availability requirements w ith SQF, the SUT must be deployed with dual Embedded Service Processors, dual oute Processors, and dual SPA Interface Processor cards. 4. This requirement w as verified in an operational emulated environment. To meet E2E requirements, the SUT must be deployed in accordance with its deployment guide and the engineering guidelines provided in UC Section This is an E2E engineering requirement and, due to variations in network architectures, it could not be accurately tested in a lab environment. To meet E2E requirements, the SUT must be deployed in accordance with its deployment guide and the engineering guidelines provided in UC Section The SUT met all IPv6 requirements for a CE through testing and vendor LoC w ith following exceptions: The SUT partially met FC 4292; IP Forw arding MIB (missing OID inetcidroutediscards); and does not comply w ith FCs 4301, 4302, 4303, 4552, and On 7 June 2011, DISA adjudicated these deficiencies as minor, and accepted the vendor POA&Ms for Fall

21 Table 2-6. SUT Capability equirements and Functional equirements Status (continued) LEGEND: BGP Border Gateway Protocol CE Customer Edge CE Customer Edge outer C Capability equirement DISA Defense Information Systems Agency E2 E End-to-End EBC Edge Boundary Controller F Functional equirement ID Identification IP Internet Protocol IPv4 Internet Protocol version 4 IPv6 Internet Protocol version 6 IS-IS Intermediate System-Inter mediate System LoC Letters of Compliance LSC Local Session Controller MFSS Multifunction Softswitch MIB Management Information Base NM Netw ork Management NMS Netw ork Management System POA&M Plan of Actions and Milestones OID Object Identifier OSPF Open Shortest Path First FC equest For Comment SQF System Quality Factors SUT System Under Test UC Unified Capabilities equirements VP Virtual outer edundancy Protocol VVoIP Voice and Video over Internet Protocol a. Product Interface equirements (1) Internal Interface equirements. The UC 2008, Change 2, Section , states that the CE shall support auto-negotiation even when the IEEE standard has it as optional. This applies to 10/100/1000-T Ethernet standards; i.e., IEEE, Ethernet Standard 802.3, 1993; IEEE, Fast Ethernet Standard 802.3u, 1995; or IEEE, Gigabit Ethernet Standard 802.3ab, The SUT met this requirement for 100/1000 Mbps. (2) External Physical Interfaces between Network Components. The UC 2008, Change 2, Section , states the physical interface between an LSC (and its appliances), the EBC, the ASLAN switches/routers, and the CE shall be a 10/100/1000-T Megabits per second (Mbps) Ethernet interface. Whenever the physical interfaces use Ethernet standards, they shall support auto-negotiation even when the IEEE standard has it as optional. This applies to 10/100/1000-T Ethernet standards; i.e., IEEE, Ethernet Standard 802.3, 1993; IEEE, Fast Ethernet Standard 802.3u, 1995; or IEEE, Gigabit Ethernet Standard 802.3ab, The SUT met this requirement for 100/1000 Mbps. (3) Voice and Video over Internet Protocol (VVoIP) Network Management System (NMS) Interface equirements. The UC 2008, Change 2, Section , states that the physical VVoIP NMS interface between the DISA VVoIP EMS and the network components (i.e., LSC, MFSS, EBC, CE) is a 10/100-Mbps Ethernet interface. The interface will work in either of the two following modes using autonegotiation: IEEE, Ethernet Standard 802.3, 1993; or IEEE, Fast Ethernet Standard 802.3u, The SUT met the requirements for the 10/100/1000/10g BaseX interfaces. b. Customer Edge outer equirements. (1) Traffic Conditioning. The CE shall be capable of performing traffic 2-13

22 conditioning (policing and shaping) on inbound and outbound traffic in accordance with (IAW) Section of UC 2008, Change 1. This may involve the dropping of excess packets or the delaying of traffic to ensure conformance with Service Level Agreements (SLAs). The SUT met this requirement for both IPv4 and IPv6 for four queues. (2) Differentiated Services Support. The CE shall be capable of supporting Differentiated Services (DiffServ) in accordance with request for comments (FCs) 2475 and 2474 IAW Section of UC 2008, Change 1. The SUT met this requirement for both IPv4 and IPv6, with both testing and vendor s letters of compliance (LoC). (3) Per Hop Behavior Support. The CE shall be capable of supporting the Per Hop Behaviors (PHBs) IAW Section of UC 2008, Change 1. The CE shall be capable of supporting Expedited Forwarding (EF) PHBs IAW FC 3246 and Assured Forwarding (AF) PHB IAW FC The SUT met this requirement. (4) Interface to the LSC/MFSS for Traffic Conditioning. The CE shall be capable of interfacing to the Local Session Controller (LSC) or Multifunction Softswitch (MFSS) in real time to adjust traffic conditioning parameters based on the updated LSC/MFSS budgets IAW Section of UC 2008, Change 1. This is a conditional requirement and was not tested. (5) Interface to the LSC/MFSS for Bandwidth Allocation. The CE shall be capable of interfacing to the LSC/MFSS in real time to adjust the PHB bandwidth allocations based on the updated LSC/MFSS budgets IAW Section of UC 2008, Change 1. This is a conditional requirement and was not tested. (6) Network Management. The CE shall support fault, configuration, accounting, performance and security (FCAPS) Network Management functions as defined in the Section , Management of Network Appliances, IAW Section of UC 2008, Change 1. The SUT met this requirement through the vendor s LoC. (7) Availability. The UC 2008, Change 2, Section , depicts the four types of CEs and their associated availability requirements. Locations serving FLASH OVEIDE/FLASH users and IMMEDIATE/PIOITY users and OUTINE users with PIOITY and above precedence should install High Availability CEs. The Medium Availability and Low Availability CES provide cost-effective solutions for locations that serve OUTINE users. The SUT met the requirements for High Availability CE with the vendor s LoC. A system that meets High Availability requirements meets the lesser availability categories of CE. The SUT is certified with any equivalent Layer 3 ASLAN component listed on the UC APL. (a) The High Availability CE shall have an availability of percent, including scheduled hardware and software maintenance (non-availability of no 2-14

23 more than five minutes per year). The High Availability CE shall meet the requirements specified in UC 2008, Change 2, Section , Product Quality Factors. (b) The Medium Availability CE without System Quality Factors (SQF) shall have an availability of percent, including scheduled hardware and software maintenance (non-availability of no more than 52.5 minutes per year). (c) The Medium Availability CE with SQF shall have an availability of percent, including scheduled hardware and software maintenance (nonavailability of no more than 52.5 minutes per year). The Medium Availability CE with SQF shall meet the requirements specified in UC 2008, Change 2, Section , Product Quality Factors. (d) The Low Availability CE shall have an availability of 99.9 percent, including scheduled hardware and software maintenance (non-availability of no more than 8.76 hours per year). (8) Packet Transit Time. The CE shall be capable of receiving, processing, and transmitting a voice packet within 2 milliseconds or less in addition to the serialization delay for voice packets, as measured from the input interface to output interface under congested conditions, (as described in UC 2008, Change 1, Section , ASLAN Voice Services Latency) to include all internal functions. The SUT measured latency was milliseconds (ms) for the DS1 interface and 7.16 for the E1 interface. On 7June 2011, DISA adjudicated this as having a minor operational impact. The Packet Transit Time requirement is currently being reviewed by DISA with the intent to change the requirement in the next UC update. (9) CE Interfaces and Throughput Support. IAW Section of UC 2008, Change 1, the CE supports an Assured Services Local Area network (ASLAN)- side connection to the Edge Boundary Controller (EBC) and a Wide Area Network (WAN)-side connection to the DISN WAN. The ASLAN-side interface shall be an Ethernet interface (10 BT or 100 BT), full duplex, and at least one of the WAN-side interfaces shall be an Ethernet interface (10 BT or 100BT), full duplex. Per DISA, a threshold of +/- 10 percent of maximum line rate is acceptable, with the intent to clarify this in the next revision of the UC. The IEEE 802.3u (100BaseT) interface met this requirement with 0% loss. (a) The CE may conditionally support a WAN-side access connection interface which can also be TDM-based (i.e., DS1, DS3, E1 or E3). These are all fullduplex interfaces and support two-way simultaneous information exchange at the line rate for the interface (i.e., 1.5 Mbps for DS1, 45 Mbps for DS3, 2.0 Mbps for E1, and 34 Mbps for E3). The SUT is certified for the following WAN interfaces: Ethernet 100BaseT, 1000BaseT, 10gBaseT, DS1, DS3, E1, E3, and Serial (EIA 530). (b) The CE shall support the maximum possible throughput on the WAN- 2-15