Maintenance Update of Aruba Mobility Controller and Access Point Series with ArubaOS version 6.5.X

Transcription

1 TM ASSURANCE CONTINUITY MAINTENANCE REPORT FOR ARUBA MOBILITY CONTROLLER AND ACCESS POINT SERIES Maintenance Update of Aruba Mobility Controller and Access Point Series with ArubaOS version 6.5.X Maintenance Report Number: CCEVS-VR-VID Date of Activity: October 13, 2016 References: Introduction Common Criteria Evaluation and Validation Scheme Publication #6, Assurance Continuity: Guidance for Maintenance and Re-evaluation, version 3.0, 12 September 2016; Aruba Mobility Controller and Access Point Series Impact Analysis Report, Revision 1.0, August 2, The Leidos Common Criteria Test Laboratory, on behalf of Aruba, a Hewlett Packard Enterprise Company (hereinafter called Aruba), submitted an Impact Analysis Report (IAR) to Common Criteria Evaluation Validation Scheme (CCEVS) for approval on 8 August 2016 and updates to the IAR documentation on 12 October The IAR is intended to satisfy requirements outlined in Common Criteria Evaluation and Validation Scheme Publication #6, Assurance Continuity: Guidance for Maintenance and Re-evaluation, version 3.0. In accordance with those requirements, the IAR describes the changes made to the certified TOE, the evidence updated as a result of the changes and the security impact of the changes. IAR describes changes made between the Aruba Mobility Controller and Access Point Series devices running ArubaOS version FIPS and the updated Aruba Mobility Controller and Access Point Series with ArubaOS version 6.5.X. Aruba maintains separate version numbering for its NIST-validated crypto implementations, which is ArubaOS 6.5-FIPS version in the updated current TOE. The IAR summarizes product changes and bug fixes and documents the results of a public search for vulnerabilities that might affect the TOE. The analysis documented in the IAR concluded that all product changes were minor and/or not relevant to the security functional requirements in the Security Target. The IAR documents that regression testing was performed by Aruba and that the testing supported the finding that all Assurance Activities remain satisfied in the updated product. The vulnerability analysis resulted in a finding that no vulnerabilities were identified that were applicable to the TOE or that were not mitigated or corrected in the TOE. The changes described in this report, in conjunction with the previous CCEVS-VR-VID , constitute all changes made to the Aruba Mobility Controller and Access Point Series since the previous Common Criteria evaluation (CCEVS-VR-VID ). CCEVS reviewed the description of the changes and the analysis of the impact upon security, and found it to be minor. Therefore, CCEVS agrees that the original assurance is maintained for the product. Summary of Changes to TOE The changes to the updated TOE are summarized below, including the removal of deprecated appliance models, the addition of two hardware configurations of an existing certified appliance model, and revisions to the firmware OS in the hardware appliances. 1

2 Hardware models removed The following appliance models were removed from the TOE: Aruba Mobility Controllers: 620, 650, 3000 Series, and These controllers are not supported in and do not have updated FIPS certificates for ArubaOS 6.5-FIPS. Hardware Configurations added Two new hardware configurations were added to the already certified Aruba Mobility Controller 7240 Appliance, the Aruba 7240XM-RWF1, and 7240XM-USF1. The functionality of the new configurations is the same as other 7420 Appliances. The differences in the configurations include the number of ports, interfaces, throughput and processing speed, memory and storage. Although these configurations have different specifications in terms of performance and capabilities, they all provide the same security functions described in the ST; therefore, they have been considered to be the same for the purposes of the ST description. Revised Firmware OS Aruba has revised the firmware OS in their hardware appliances from: ArubaOS version 6.4.X to ArubaOS version 6.5.X ArubaOS version FIPS to ArubaOS version 6.5-FIPS ArubaOS FIPS was updated to conform to TD0079: RBG Cryptographic Transitions per NIST SP A Revision 1. The updated version: ArubaOS FIPS removes RNG and moves all calls for it to the (already approved and listed) DRBG. This was considered a minor change for FIPS evaluation purposes (a 1SUB) upping the version to ArubaOS FIPS. A subsequent 1SUB FIPS evaluation was done on ArubaOS FIPS bringing the current version to ArubaOS 6.5-FIPS (ArubaOS 6.5.X). CAVP certificates for 1SUBs remain the same. The use of both RNG and DRBG were included in the previous evaluation and removal of RNG is considered to be a minor change. The removal of RNG does not modify any of the SFRs; and results in no changes to TSF platforms, SFRs, Assumptions or Objectives, Assurance Documents, or TOE Environment. All appliance models included in the TOE have been FIPS validated with ArubaOS version 6.5-FIPS and the certificate numbers are included in the updated Security Target. Documentation Updated Updated Security Target, Aruba Mobility Controller and Access Point Series Security Target, Version 1.2, 10/12/2016. ArubaOS x User Guide, Revision 5, September 2016 ArubaOS x Command-Line Interface Reference Guide, Revision 2, September 2016 ArubaOS 6.4.x Syslog Messages Guide, Ref ArubaOS 6.4.x MIB Reference Guide, Ref ArubaOS through Release Notes ArubaOS 6.5 FIPS Security Policy (available at CMVP website) ArubaOS 6.5.x Quick Start Guide June 2016, Ref Conclusion CCEVS reviewed the description of the changes and bug fixes and discussed regression testing with the CCTL. An analysis of all changes to the product determined that the changes were minor. The CCEVS 2

3 agrees that the original assurance is maintained for the above-cited version of the product. Note that the product includes several enhancements that, if implemented, cause the TOE to be outside the evaluated configuration. The project user is strongly cautioned that the following product enhancements must not be implemented or used in the evaluated configuration: In the updated product, an administrator can initiate a remote telnet or SSH session from the controller to a remote host. Telnet and SSH are not permitted in the TOE. In the evaluated configuration, IPsec must be used. Telnet and SSH to a remote host are not included in the TOE and must not be used in the evaluated configuration. Authentication methods other than those specifically defined within the ST must not be implemented in the evaluated configuration. Only those authentication methods specifically defined in the Security Target may be used in the evaluated configuration. A more detailed definition of ArubaOS Updates, Changes, and Bug Fixes is included on the following pages. 3

4 ArubaOS Updates, Changes, and Bug Fixes The table below provides a summary of product updates with an assessment of their security relevance. Note that the product updates are described in detail in the product release notes. The table below provides a concise summary and an assessment of security relevance only. ArubaOS Updates Security Consideration Starting from ArubaOS , the following controller models are available for deployment in Japan only: 7000 Series controller models: 7005-JP, JP, 7024-JP, 7030-JP; 7200 Series controller models: 7205-JP, 7210-JP, 7220-JP, 7240-JP. The following commands are modified in ArubaOS : interface vlan and show interface vlan Starting from ArubaOS , the Spur Immunity setting is introduced. Configure this setting if high channel utilization is observed in the 5 GHz radio of an AP-130 Series access point in a noise-free environment resulting in client association and throughput issues. Starting from ArubaOS , the BLE Operation Mode setting is introduced. This setting determines how the built-in Bluetooth Low Energy (BLE) chip in the AP functions. Starting from ArubaOS , the show crypto-local isakmp key includes a new parameter to display the Internet Security Association and Key Management Protocol (ISAKMP) local pre-shared keys (PSKs) configured by IP address or Fully Qualified Domain Name (FQDN). The default Downloadable Regulatory Table (DRT) version was modified in ArubaOS , in ArubaOS , and in ArubaOS ; periodic regulatory changes may require modifications to the list of channels supported by an AP. The existing broadcast filter all parameter was modified in ArubaOS to allow wireless to wireless multicast where the receiver joins the sender's IGMP group, if IGMP snooping\proxy is enabled. If IGMP snooping\proxy is disabled, the existing functionality (drop the wireless to wireless multicast packets) of broadcast filter all remains the same. The existing BLE relay process was modified and a new show ble_relay jobs was added in ArubaOS to enable processing of HTTP post parallel operation to assist in tracking the communication between the BLE controller process and Meridian. The exclude-http-security-headers parameter was introduced in ArubaOS in the web-server profile command to exclude security headers from HTTP response. This option is only enabled when the externally hosted Captive Portal is running within an iframe. ArubaOS introduced support for AP-320 Series Access Points Starting from ArubaOS , the AP console password is enabled by default. If the console password is configured, the user must enter this password to get AP console access. If not configured, the controller generates a default random password which can be viewed by executing the Assessment Minor change, since Japan Controller models are not included in the TOE. Minor change, since the commands are not security relevant and do not affect the security functionality of the TOE or modify any of the Security Functional Requirements (SFRs). Minor change, since the added feature settings for high channel utilization do not affect the security functionality of the TOE or modify any of the SFRs. Minor change, since the Blue Tooth low energy configuration and operation mode commands do not affect the security functionality of the TOE or modify any of the SFRs. Minor change, since the addition of the parameter for the show crypto-local isakmp key command does not affect the security functionality of the TOE or modify any of the SFRs. Minor change, since regulatory updates are not considered security relevant and do not affect the security functionality of the TOE or modify any of the SFRs. Minor change, since this feature update is not security relevant and does not affect the security functionality of the TOE or modify any of the SFRs. Minor change, since the new command: show ble_relay jobs and ble-log parameter introduced in the show ap debug are not considered security relevant and does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment Minor change, since the Captive Portal feature is not included in the TOE and not considered security relevant. This feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment Minor change, since the AP-320 Series Access Points are not included in the TOE. Minor change because AP console access is outside the scope of evaluation. The operational environment includes physical protection of access points per A.PHYSICAL and OE.PHYSICAL. 4

5 encrypt disable command followed by the show ap system-profile <profilename> command. ArubaOS introduced two new default Adaptive Radio Management profiles. ArubaOS supports IKEv2 Mobility and Multihoming (MOBIKE) protocol for remote access clients. This support updates IPsec and datapath entries after failover of clients performing IKEv2 VPN from: wireless to cellular with; MOBIKE one wireless network to another wireless network (that is, whenever IP address of remote access VPN client changes). ArubaOS supports redundant Branch Controllers. An 7000 Series branch controller can be configured for a redundant secondary master controller. This prevents a scenario where a master controller acts as a single point of failure if the link to the master goes down, or a collocated Master-Standby VRRP controller pair fail due to a network failure or local natural disaster. ArubaOS adds an override local network destination feature to provide a scalable solution to create a local net destination override. This version also supports a scalable solution to support Site-to-Site tunnels. ArubaOS adds a feature so that outbound traffic can enable NAT with the IP address of the VLAN interface as the source address; while the locally routed traffic is sent without any address translation. ArubaOS adds a Multi-user MIMO (MU-MIMO) Steering capability, which increases downstream throughput performance in ac Wave 2 (gen 1) APs. Addition of the The 7240XM controller, which is a variant of the 7240 controller. It has an extended Memory (XM) of 16 GB Random Access Memory (RAM) and flash memory space enabling better throughput and scaling capabilities. The 7240XM controller has the same number of Input/Output (I/O) ports and other hardware capabilities as that of the 7240 controller. Support for the following USB modems was added to the 7000 Series controllers: Pantech 4G LTE Global USB modem UML290; Verizon 4G LTE USB modem UML295; Netgear AirCard 313U USB modem; Netgear AirCard 320U USB modem; Netgear AirCard 330U USB modem Guidance directs those those responsible for the TOE to manage access points using the Mobility Controller. Each access point attempts to locate a controller during installation automatically without administrator intervention. An access point provides console only for troubleshooting provisioning under direct supervision of Aruba technical support. Consequently, the AP console username and password protection feature is not relevant to the security functionality specified in the WLAN AS PP and the Aruba ST. Minor change because The Adaptive Radio Management enhancement affects the operational characteristics and not the claimed security functionality. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because support for MOBIKE affects the operational characteristics and not the claimed security functionality. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because support for redundant secondary master controllers affects the operational characteristics and not the claimed security functionality. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because support for scalability affects the operational characteristics and not the claimed security functionality. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because support for IP NAT Outside affects the operational characteristics and not the claimed security functionality. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the MU-MIMO Steering feature affects the operational characteristics of the product and not the claimed security functionality. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because this controller is added to the TOE in this release. This supported controller was added to the TSF platforms in the ST. Otherwise, there are no changes to the SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the TOE performance with third party modems is not considered a security relevant issue. The change does not affect the security functionality of the TOE or modify any of the SFRs. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance 5

6 Documents, Starting with ArubaOS , the wipe out flash command is introduced. This command erases all data including configuration, logs, license keys, flash backup files and formats the flash file system in the controller. ArubaOS includes a new configuration parameter allowing the association of a routing policy to an IPsec map for site-to-site VPN ArubaOS includes a new configuration parameter allowing the association of a routing policy to an L3 GRE tunnel. A compression in Site-to-Site VPNs capability was added in ArubaOS Video and Voice capability was added in ArubaOS , including support for Skype for Business and for High Throughput for 20 MHz support for video multicast. ArubaOS added WebUI enhancements including the ability to configure the uplink manager settings and absolute session timeout on master and local controllers through the WebUI. ArubaOS provided WLAN Management System Enhancements including optimizing classification behavior and managing the list of valid exempt clients. ArubaOS introduced support for the Novatel MiFi 4G LTE Global USB Modem U620L. This USB modem is supported in AP-205H, AP-210 Series, AP-220 Series, and RAP-155. In ArubaOS FIPS builds, the Pseudo Random Number Generator (PRNG) is changed so that all calls to the legacy FIPS RNG (covered by FIPS RNG certificate number 1343) are redirected to the Deterministic Random Bit Generator (DRBG) module (covered by FIPS DRBG certificate number 715). This change lets ArubaOS to be compliant with FIPS transition rules for Minor change because this is a performance and operational change. The clearing of flash memory is not security related and this change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because this new configuration parameter to associate a routing policy to an IPsec map for a site-to-site VPN is not security related. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because this new configuration parameter to associate a routing policy to an L3 GRE tunnel is not security related. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because this new feature to support traffic compression between devices is not security related. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the addition of these features affects the operational characteristics and not the claimed security functionality. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because these enhancements do not affect the claimed security functionality. These additional enhancements do not change the TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because these enhancements do not affect the claimed security functionality. These additional enhancements do not change the TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. This is a minor change because the TOE performance with third party modems is not considered security relevant. The change does not affect the security functionality of the TOE or modify any of the SFRs. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, The redirection of all calls from the legacy FIPS RNG to the Deterministic Random Bit Generator (DRBG) module ensures compliance with new standards as RNG is no longer permitted. The use of both RNG and DRBG were included in the previous evaluation and removal of RNG is considered to be a minor change. The removal of RNG does not modify any of the SFRs; and results in no changes to TSF platforms, SFRs, Assumptions or Objectives, Assurance Documents, 6

7 RNG was removed from the description of the security function ST. In ArubaOS , the Very High Throughput (VHT) bandwidth signaling can be enabled or disabled. This parameter is supported only on AP-320 Series access points. This setting appears in the controller CLI only In ArubaOS , a new VH Bandwidth Signaling parameter is included in the CLI that allows enable/disable of VHT band with signaling. Starting from ArubaOS , Remote Access Points (RAPs) read the Authority Information Access (AIA) field of a server certificate. If the RAPs are configured to check revocation, the RAPs use the AIA field to query an Online Certificate Status Protocol (OCSP) responder. This allows a RAP that is provisioned with custom certificate to determine if the server-side certificate is revoked. Starting with ArubaOS , multiple capabilities were introduced for the Captive Portal feature. ArubaOS introduced additional functionality for the 320 Series Access Points. ArubaOS introduced additional authorization request threshold parameters that define the Signal-to-Noise Ratio threshold. Starting from ArubaOS , the logging level of the AP console can be customized. Starting from ArubaOS , idle Voice over Internet Protocol (VoIP) clients can associate with access points when the Call Handoff Reservation (CHR) limit or Peak Capacity Threshold (PCT) is reached. Starting from ArubaOS , a new parameter, pending, is introduced in the show ap arm client-match command. This parameter is introduced to filter and view only the pending client-match entries. ArubaOS included an enhancement to AMON. When upgrading from an existing ArubaOS x release, it is required to set the AMON packet Minor change because the ability to enable/disable VHT bandwidth signaling affects operational characteristics and the performance of the TOE. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because the ability to enable/disable VHT bandwidth signaling affects operational characteristics and the performance of the TOE. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because support for OCSP affects operational characteristics and not the claimed security functionality of the TOE. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the Captive Portal feature is not included in the TOE and is not security relevant. This feature results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. The 320 Series Access Points are not included in the TOE and therefore this is not relevant. Minor change because the authorization request threshold that defines the Signal-to-Noise Ratio (SNR) threshold affects operational characteristics and performance not the claimed security functionality of the TOE. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the customization of AP Logging Levels affects operational characteristics not the claimed security functionality of the TOE. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. This is a minor change because The new feature to Associate Idle VoIP Client and the Idle VOIP Client parameter affect operational characteristics not the claimed security functionality of the TOE. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because the addition of the parameter, pending, introduced in the show ap arm client-match command does not affect the security functionality of the TOE or modify any of the SFRs. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because AMON is a protocol used to stream information from the controller to Airwave. 7

8 size manually to a desired value. However, the packet size is increased to 32K by default for fresh installations of ArubaOS ArubaOS 6.5.X introduces several Adaptive Radio Management (ARM) features. These include 1) a cellular handoff assist feature that can help a dual-mode, 3G/4G-capable Wi-Fi device such as an iphone, ipad, or Android client at the edge of Wi-Fi network coverage switch from Wi-Fi to an alternate 3G/4G radio that provides better network access; 2) A dynamic bandwidth switch feature provides capability for ARM to detect the 20MHz interferer by reading the Clear Channel Assessment (CCA) statistics and other radio statistics. Once the signatures are detected, ARM moves to another 80MHz channel or downgrade to 40MHz. This feature only works when dynamic-bw parameter is enabled and ARM is set to use 80MHz assignment; and 3) ARM Channel Planning Enhancements to resolve issues that occur with distributed channel/power. ArubaOS 6.5.X provides an AirWave Management Clarity Synthetic feature that enables the controller to select and convert any 200 Series access point to client mode based on the instruction from a Network Management System. The converted AP acts like a WiFi client and starts synthetic data transaction within the network to monitor and detect the network health. ArubaOS 6.5.X provides an AP-Platform AP Name in SNMP Trap where when an access point goes out of service, the SNMP traps list the name and IP address of the access point as identifiers. ArubaOS 6.5.X adds support for the AP-314 Access Point. ArubaOS 6.5.X adds support for the AP-315 Access Point. ArubaOS 6.5.X adds support for the AP-334 Access Point. ArubaOS 6.5.X adds support for the AP-335 Access Point and additional functionality to this Access Point model. In ArubaOS the PortFast feature has been enhanced to reduce the time take for wired clients connected to an AP to detect the link before data traffic is sent. In ArubaOS , the consolidated AP-Provisioned Information feature was added. This feature maintains a consolidated record of AP-provisioned information. In ArubaOS , support was added for viewing AP Power monitoring information. In ArubaOS , support is provided for customizing the level of driver log prints sent to the AP console. A new parameter, consolelog-lvl is introduced under the ap system-profile command to set the AP console logging level. Configuration and changing of the message size does not affect the security functionality of the TOE or modify any of the SFRs. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because the added features do not affect the security functionality of the TOE or modify any of the SFRs. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the Clarity Synthetic feature does not affect the security functionality of the TOE or modify any of the SFRs. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because the addition of the name and IP address in SNMP traps for when an access point goes out of service does not affect the security functionality of the TOE or modify any of the SFRs. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the AP-314 Access Point is not included in the TOE. Minor change because the AP-315 Access Point is not included in the TOE. Minor change because the AP-334 Access Point is not included in the TOE. Minor change because the AP-335 Access Point is not included in the TOE. Minor change because the PortFast feature is not security related. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the AP-Provisioned Information feature is not security related. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because AP Power monitoring is not security related. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the log level of driver log prints sent to the AP console is not security related. This performance enhancement results in no changes to TSF platforms, SFRs, Security 8

9 Functions, Assumptions or Objectives, Assurance Documents, In ArubaOS the Very High Throughput (VHT) bandwidth signaling can now be enabled or disabled. This parameter is supported only on 320 Series access points. This setting appears only in the controller CLI In ArubaOS Non-Aruba devices can fragment the large IKE_AUTH packets using the standards described in the RFC 7383 Internet Key Exchange Protocol Version 2 (IKEv2) message fragmentation when the Aruba device acts as a responder and not as an initiator In ArubaOS , when a client is authenticated by non-802.1x method of authentication, the host name of the host device is used as the user name (instead of the MAC address) of the host device In ArubaOS , Remote Access Points (RAPs) now read the Authority Information Access (AIA) field of a server certificate. If the RAPs are configured to check revocation, the RAPs use the AIA field to query an Online Certificate Status Protocol (OCSP) responder. This allows a RAP that is provisioned with custom certificate to determine if the server-side certificate is revoked In ArubaOS configuration parameters are removed to simplify the OCSP configuration for VIA In ArubaOS a WAN Health Check feature is added to support Branch Office Controllers. ArubaOS includes an ingress scheduler that provides minimumbandwidth guarantees. ArubaOS provides additional support to customize Captive Portal. ArubaOS supports centralized licensing, including multi-version licensing, support for licensing larger controller deployments, subscriptionbased web content classification licenses, and support for multiple master/local domain licensing. ArubaOS added support for the 7008 Controller. Minor change because the ability to enable/disable VHT is not security related. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because fragmentation of large IKE_AUTH packets by non-aruba devices is not within the scope of the TOE and does not affect the security functionality of the TOE. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because client authentication using device name as user name rather than MAC address does not affect the security functionality of the TOE. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because OCSP Client Support for RAP does not affect the security functionality of the TOE as the evaluation does not cover OSCP for certificate revocation. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because VIA is a separate Aruba product that is not included in the TOE, therefore removal of configuration parameters is not relevant. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because WAN health checking is not security relevant. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because minimum bandwidth guarantees are not security relevant. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because Captive Portal is not included in the TOE, therefore removal of configuration parameters is not relevant. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because licensing is not security relevant. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because the 7008 controller is not included in the TOE. This performance 9

10 enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. ArubaOS added a new command, mgmt.-user console-block, to disable the console login. ArubaOS added the ability for the administrator to initiate a remote telnet or SSH session from the controller to a remote host. ArubaOS includes a standalone feature that enables an Aruba controller to act as an NTP server so that the devices that do not have access the Internet can synchronize their clocks. Enabling this feature eliminates the need to provision and maintain another virtual machine on the network. ArubaOS includes a controller port-security MAC Address Limitation to allow the administrator to set levels of security and autorecovery interval time. ArubaOS include Firewall features: Traffic Analysis, Blocked Session identification, Geo-location Filtering, Routing Traffic through Web Proxy, and Redirect User Session. ArubaOS includes enhancements to IPv6 functionality including Radius accounting for IPv6 clients. Bandwidth usage by clients/hosts with IPv6 addresses, over RADIUS protocol can now be monitored. The Framed- IPv6-Address attribute is used in accounting start, stop, and interim packets. A host can have multiple IPv6 addresses and all of them are tracked to check the usage, for billing purpose. ArubaOS includes support for VIA-Published subnets. A new feature is introduced that enables the controllers to accept the subnets published by VIA clients. This is in conformance with section 3.15 of RFC 5996 applicable for route-based VPNs. You can enable or disable this feature using the WebUI or the CLI. This feature is disabled by default. In ArubaOS , support for Wi-Fi calling in the controller was added. Wi-Fi calling service allows cellular users to make or receive calls using a Wi-Fi network instead of using the carrier s cellular network. In ArubaOS , the Aruba Central or any other cloud solution can Minor change, since using this command would prevent anyone from logging in via the console, it would take the TOE out of its evaluated configuration. The command cannot be used in the evaluated configuration. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, Minor change because Telnet and SSH are not permitted in the TOE. In the evaluated configuration, IPsec must be used. Telnet and SSH to a remote host are not included in the TOE and must not be used in the evaluated configuration. This change results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because TOE includes an internal clock and synchronization of a time signal (NTP server) is optional, therefore the change does not affect the security functionality of the TOE. The new feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment Minor change because MAC Address Limitation feature does not affect the security functionality of the TOE. The new feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment Minor change because the WLAN AS PP and the Aruba ST do not specify requirements for network traffic monitoring or filtering Firewall functionality. Hence, Firewall features are outside the scope of evaluation and not security relevant. The new features do not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because Radius Accounting for IPv6 Clients is not security relevant. The new feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because the new feature for controllers to accept subnets published by VIA clients is not security relevant. The new feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. Minor change because the Wi-Fi calling feature is not security relevant. This new feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or the TOE Environment. Minor change because the cloud management 10

11 manage branch controllers, access points, user/device profiles, and/or services over ZTP or Aruba Activate. In ArubaOS , the smart config, which is used to manage branch controllers, has been enhanced to allow a vlan to to an IP address using DHCP. This setting only appears in the WebUI. In ArubaOS , the zero-touch provisioning (ZTP) feature is enhanced to support 16 VLANs per branch controller, rather than four in the earlier versions of ArubaOS. The following commands are introduced in ArubaOS 6.5.X. ap consolidated-provision info- This command stores the consolidated AP-provisioned information of all APs connected to a controller in the ap_provision_info.txt file. block-redirect-url - This command redirects the user session to an external splash page when it encounters a webcc deny policy. crypto-local isakmp allowvia-subnet-routes- This command allows the controller to accept the subnets published by VIA-clients. By default, this feature is disabled. ip reputation- This command blocks connectivity to IP addresses classified as malicious to support IP classification based firewall. ip probe health-check- This command configures WAN health-check ping-probes for measuring WAN availability and latency on branch controller uplinks. ntp standalone - This command enables or disables controller to act as NTP server. show ap consolidated-provision info- This command displays the consolidated AP-provisioned information for an access point connected to the controller. show ip-reputation- This command displays the IP Reputation status of various services. show ip health-check- Display the health-check status of the uplink interfaces of a branchoffice. show ucc dns-ip-learning- This command verifies if the carrier s evolved Packet Data Gateway (epdg) IP address is learned. show voice facetime- This command displays a pattern present in the user-agent field of the SIP signaling message header to determine if the media session is a Facetime session. show voice wificalling- This command displays the Wi-Fi Calling ALG configuration on the controller. show web-proxy- This command displays information about the port and server configured for the web-proxy. ssh This command initiate an SSH session from the controller to a remote host. telnet- This command initiate a telnet session from the controller to a remote host. voice facetime- This command configures a pattern present in the useragent field of the SIP signaling message header to determine if the media session is a Facetime session. voice wificalling- This command configures Wi-Fi Calling on the feature is not security relevant. This new feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or the TOE Environment. Minor change because smart config is not security relevant. This new feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or the TOE Environment. Minor change because the enhancement of ZTP is not security relevant. This new feature does not result in any changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or the TOE Environment. Minor changes because all new commands introduced were determined to be not security related, with no effect on the security or the product or the SFRs. 11

12 controller. web-proxy server- This command configures the web-proxy server related information. The following commands are modified in ArubaOS 6.5.X. aaa authentication via connection-profile- The ocsp-responder enable subcommand is introduced. aaa profile- The username-from-dhcp-opt12 parameter is introduced. Ap regulatory-domain-profile- The valid-11a-160mhz-channel-group parameter is introduced. ap system-profile- The following new parameters are introduced: ap-console-password ap-console-protection disable-tftp-image-upgrade secondary-master ap wired-port-profile- The portfast and portfast-trunk parameters are introduced. Clear- The port-security-error gigabitethernet <slot>/<module>/<port> parameter is introduced. This clears the port-security error from a gigabit Ethernet IEEE interface. Copy- The flash: parameter is introduced to copy files from an FTP server. web-server profile- The excludes security headers is introduced to exclude security headers from HTTP response. firewall -The ip-classification parameter is introduced. interface fastethernet gigabitethernet- The switchport port-security maximum command is modified to include level and interval subparameters. For level, the default value is logging. ip access-list ip-geolocation- The ip-geolocation parameter is introduced. ip probe default- The jitter parameter is introduced. mgmt-user- The console-block parameter is introduced. mgmt-user- The name parameter is introduced. rf arm-profile- The following parameters are introduced. 160MHz-support interfering-ap-weight dynamic-bw dynamic-bw-beacon-failed-thresh dynamic-bw-cca-ibss-thresh dynamic-bw-cca-intf-thresh dynamic-bw-clear-time dynamic-bw-wait-time rf dot11a-radio-profile- The upper limit for the beacon-period parameter is set to 2000 milliseconds. rf dot11g-radio-profile- The upper limit for the beacon-period parameter is set to 2000 milliseconds. show ap arm history- The Result column is introduced to the output of this command to indicate the status of the requested change in channel All modified commands were reviewed and found to not affect the security functionality of the TOE or modify any of the SFRs. This performance enhancement results in no changes to TSF platforms, SFRs, Security Functions, Assumptions or Objectives, Assurance Documents, or TOE Environment. 12

13 or EIRP by ARM. show ap debug port status- The Portfast parameter is introduced. show ap port status- The Portfast parameter is introduced. show ap regulatory-domainprofile-the Valid a 160MHz channel group parameter is introduced. show ap regulatory-domainprofile-the Valid a 160MHz channel group parameter is introduced. show ap system-profile- The following parameters are introduced as part of the output of this command: Secondary Master IP/FQDN Disable RAP Tftp Image Upgrade AP Console Protection AP Console Password show crypto-local isakmp- The allow-via-subnet-routes parameter is introduced. show datapath- The following IP Classification related parameters are introduced: ip-geolocation [counters] ip-reputation [counters rtc] session ip-classification show ip access-list The global-geolocation-acl is introduced. show firewall- The IP classification parameter is introduced. show rf arm-profile- The following parameters are introduced as part of the output of this command: 160MHz-support Interfering AP Weight Dynamic Bandwidth Switch Dynamic Bandwidth Switch Wait Time (sec) Dynamic Bandwidth Switch Triggering Indicator CCA ibss Threshold (%) Dynamic Bandwidth Switch Triggering Indicator Beacon Failed Threshold Dynamic Bandwidth Switch Triggering Indicator CCA intf Threshold (%) Dynamic Bandwidth Switch Clear Time (min) show snmp trap-list- The following parameters are introduced as part of the output of this command: Command wlsxapdown wlsxapup show ucc call-info cdrs- The WiFi-Calling application parameter is introduced. show ucc client-info- The WiFi-Calling application parameter is introduced. show ucc statistics- The WiFi-Calling application parameter is introduced. show web-server- The Exclude Security Headers from HTTP Response 13

14 parameter is introduced. show wlan voip-cac-profile- The Allow Idle VOIP Client parameter is introduced. web-server profile- The exclude-http-security parameter is introduced. wlan virtual-ap- The cellular-handoff-assist parameter is introduced. This setting can now be applied to individual virtual APs via the wlan virtual-ap profile, and can help a dual-mode, 3G/4G-capable Wi-Fi device such as an iphone, ipad, or Android client at the edge of Wi-Fi network coverage switch from Wi-Fi to an alternate 3G/4G radio that provides better network access. wlan voip-cac-profile- The allow-idle-voip-client parameter is introduced. The following commands are deprecated in ArubaOS 6.5.X: ap system-profile- The shell-passwd parameter is deprecated. show ap system-profile- The Shell Password parameter is deprecated from the output of this command. All deprecated commands were found to be nonsecurity related and to not affect the security of the product or the SFRs included in the Security Target. The following provides a summary of all of the bug fixes from ArubaOS to 6.5.x. Resolved Issues in ArubaOS The bug fixes identified in the table below are for product components that are not within the scope of the TOE, or otherwise do not provide any security functionality and therefore are considered minor changes. Component AirGroup 97490, Air Management IDS , , , , Captive Portal Station Management AP Datapath Fixed Issues Symptom: When a client started roaming from one AP to another, the phones got stuck at Key1. This issue is resolved by making improvements to the wireless drivers. Scenario: This issue was observed in Netlink phones after the controller was upgraded from to Symptom: Multiple AP-135 access points crashed simultaneously with the reboot reason Reboot Reason: Reboot caused by kernel panic: assert. This issue is resolved by removing unnecessary messages from the datapath. Scenario: This issue occurred in AP-135 access points connected to 7240 controllers running ArubaOS Symptom: Access Control Lists (ACLs) using firewall rules with domain names did not work with AP-205 access points. This issue is resolved by modifying the data sequence. Scenario: This issue was caused by a failed DNS resolution. This issue was observed in AP-205 access points connected to controllers running ArubaOS in a split-tunnel mode. Base OS Security Fixed Issues Symptom: The extifmgr process crashed in the controller. The fix ensures that there is no memory corruption and the extifmgr process remains stable. 14

15 Scenario: The extifmgr process crashed due to a memory corruption for a response to an HTTP error. This process is responsible to send HTTP User Agent strings and mdns broadcast information to ClearPass Policy Manager. This issue was observed in the local controller of a master-local topology. Controller-Datapath Fixed Issues Symptom: There was an unexpected drastic increase followed by a decrease in the datapath CPU utilization. This issue is resolved by adding a mechanism to avoid loops during the lookup for sessions in pending delete state. Scenario: This issue was observed in 7220 controllers running ArubaOS This issue was observed during either of the following conditions: If DPI was enabled and if there was a large number of sessions In situations where hash collisions occurred in the session table and a non-ip frame (like ARP) was received but the session corresponding to that frame was linked after a session in pending delete state. Symptom: A controller crashed and rebooted. The log files for the event listed the reason for the reboot as datapath timeout. This issue is resolved by making internal code changes. Scenario: This issue was observed when the show datapath ipv6-mcast destination command was issued. This issue was observed in 7220 controllers running ArubaOS in a master-local topology. Remote AP Fixed Issues Symptom: Wireless clients that associated to a RAPv3 network failed to access the internet in splittunnel forwarding mode. The fix ensures that the wireless clients can access the internet successfully. Scenario: This issue was observed when performing a full global configuration synchronization of the master controller with the local controller, the bridge forwarding mode ACLs could have got rearranged in the AP. A full global configuration synchronization occurs when there is a loss of masterlocal connectivity or when a local controller joins a new master controller. This issue was observed in controllers running ArubaOS or later versions. Resolved Issues in ArubaOS The bug fixes identified in the table below are for product components that are not within the scope of the TOE, or otherwise do not provide any security functionality and therefore are considered minor changes. Component Air Management IDS Captive Portal , Licensing , AP-Datapath Fixed Issues Symptom: The FTP Application Layer Gateway (ALG) did not work when AP-205 access points operated in bridge mode. This issue is resolved by eliminating an endianness situation. Scenario: This issue was observed in AP-205 access points connected to 3200 controllers running ArubaOS