Specifications

Security Target Version 1.0 9/29/2014
10
traffic (data from wireless clients) over the IP wired network. As a result, APs can be distributed as necessary and
need not be kept in close proximity with a physically secure connection to the associated Controller.
In an encrypted WLAN, a wireless client first associates with an AP and then authenticates (IEEE 802.11i
4
) using
credentials to obtain access to the network (an IP address) and establish a session with the TOE. The authenticated
wireless client is then assigned a role based on the configuration in the Mobility Controller.
Each authenticated wireless client can also be placed into a VLAN. While all authenticated wireless clients can be
placed into a single VLAN, the TOE (Mobility Controller) allows administrators to group wireless clients into
separate VLANs. This enables separation and isolation of groups of wireless clients and their access to network
resources. For example, administrators can place authorized employee clients into one VLAN and temporal clients,
such as contractors or guests, into a separate VLAN.
2.1 TOE Overview
The TOE consists of the following components:
• Aruba Mobility Controllers
• Aruba Access Points
• ArubaOS.
In the CC evaluated configuration, the TOE (all components that make up the WLAN access system—at a
minimum, one Controller and one AP) must be configured to operate in the FIPS 140-2 Approved mode of
operation. In FIPS-Approved mode, various weak protocols and algorithms are disabled. Please reference the
appropriate FIPS 140-2 Security Policy documents for each controller and access point for more details at
http://csrc.nist.gov/groups/STM/cmvp/index.html.
2.2 TOE Architecture
At a high level, Aruba Mobility Controllers are hardware appliances consisting of a multicore network processor,
Ethernet interfaces, and required supporting circuitry and power supplies enclosed in a metal chassis. The software
running on the Mobility Controller is called ArubaOS, which consists of two main components, both implemented
on multiple cores within a single network processor:
• Control Plane (CP)—implements functions which can be handled at lower speeds such as Mobility
Controller system management (CLI and Web GUI), user authentication (e.g. 802.1X, RADIUS, LDAP),
Internet Key Exchange (IKE), auditing/logging (syslog), Wireless IDS (WIDS), and termination of
protocols operating at the system level (e.g. SSH, TLS, NTP, etc.). The Control Plane runs the Linux
operating system along with various user-space applications (described below).
• Data Plane (DP)—implements functions that must be handled at high speeds such as high-speed switching
functions (forwarding, VLAN tagging/enforcement, bridging), termination of 802.11 associations/sessions,
tunnel termination (GRE, IPsec), stateful firewall and deep packet inspection functions, and cryptographic
acceleration. The Data Plane runs a lightweight, proprietary real-time OS which is known as “SOS” (an
acronym whose definition is no longer known).
The Control Plane and Data Plane are inseparable. Administrators install the software by loading a single file,
identified as “ArubaOS”. Internally, the Mobility Controller unpacks the ArubaOS software image into its various
components. A given ArubaOS software image has a single version number, and includes all software components
necessary to operate both mobility controllers and APs. The mobility controller is responsible for storing the
ArubaOS components needed to operate the APs, allowing APs to download their operating software from the
mobility controller.
The CP runs the Linux OS, along with various custom user-space applications which provide the following CP
functions:
• Monitors and manages critical system resources, including processes, memory, and flash
4
Implements 802.1X for wireless access points to address the security vulnerabilities found in WEP.