Cisco 7206VXR NPE-400 - Manual (Page 9)

9
FIPS 140-2 Nonproprietary Security Policy for Cisco 7206VXR NPE-400 Router with VAM
OL-3959-01
Cryptographic Key Management
Figure 4 Tamper Evidence Label Placement (Front View)
Figure 5 Tamper Evidence Label Placement (Rear View)
Cryptographic Key Management
The router securely administers both cryptographic keys and other critical security parameters such as
passwords. The tamper evidence seals provide physical protection for all keys. All keys are also
protected by the password-protection on the Crypto Officer role login, and can be zeroized by the Crypto
Officer. Keys are exchanged manually and entered electronically via manual key exchange or Internet
Key Exchange (IKE).
The modules contain a cryptographic accelerator card (VAM), which provides DES (56-bit) (only for
legacy systems), and 3DES (168-bit) IPSec encryption, MD5 and SHA-1 hashing, and has hardware
support for DH and RSA key generation.
The module supports the following critical security parameters (CSPs):
119934
ETHERNET 10BT
ENABLED
0 2
1 3 LINK 0 1 2 3
FAST SERIAL EN
TD TC RD RC LB CD TD TC RD RC LB CD TD TC RD RC LB CD TD TC RD RC LB CD
ENABLED M II L IN K R J4 5
FAST ETHERNET
0
TOKEN RING
0 1 2 3
MII EN RJ45 EN RJ45 LINK 1O PWR OK
R J-4 5 C PU RE
SE T FAST ETHERNET INPUT/OUTPUT CONTROLLER
ENABLED
PCMCIA EJECT SLOT 0
SLOT 1 FE MII
Auxiliary
port
Console
port
Port adapter
lever
I/O controller
0
2
4
1
3
5
6
ETHERNET-10BFL
E N
R X
0 1 2 3 4 TX R X TX R X TX R X TX R X TX
Port adapters
Cisco 7200
Series
PC card slots
Optional Fast Ethernet port
(MII receptacle and RJ-45 receptacle)
119933
NETWORK PROCESSING ENGINE-150
Internal fans
Network processing engine
or network services engine
AC-input
power supply
AC-input
receptacle
Power supply
filler plate
Chassis
grounding
receptacles
Power switch