Palo Alto Networks SD-WAN Virtual Instant-On Network (vION)

Certificate

Approved Algorithms (40)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Palo Alto Networks SD-WAN Virtual Instant-On Network (vION)
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Status Output<br/>Self-Test<br/>Show Status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Palo Alto Networks SD-WAN Virtual Instant-On Network (vION)
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Status Output<br/>Self-Test<br/>Show Status</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) Software Version: 6.1.2 Documentation Version: 1.4 Last Update: June 11, 2024 Palo Alto Networks, Inc. www.paloaltonetworks.com © 2024 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies. Revision Date: June 11, 2024 Document Version: 1.4

The table below provides the security levels of the various sections of FIPS 140-3 in relation to the Palo Alto Networks SD-WAN Virtual Instant-On Network (vION), hereinafter referred to as the Module or vION module. The Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) enables the integration of a diverse set of wide area network (WAN) connection types, improves application performance and visibility, enhances security and compliance, and reduces the overall cost and complexity of a WAN. Built with the intent to reduce remote infrastructure, Palo Alto Networks SD-WAN vION enables the cloud-delivered branch. The vION module software version is 6.1.2. Table 1 - Security Levels The module is designed to meet an overall security level 1. The module is a multi-chip standalone software module running on a general-purpose computing platform. FIPS 140-3 conformance testing was performed at Security Level 1 with the configurations noted in the table 2 below. Table 2 - Tested Operational Environments © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 3

Table 3 - Vendor Affirmed Operational Environments Note: The vION comes in either ION 3108V or ION 7108V, which is the same functionality just with differences such as throughput. The CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when ported to an operational environment which is not listed on the validation certificate. Modes of Operation The module has one approved mode of operation and is always in approved mode of operation after initial operations are performed (See Section 11). The module does not claim implementation of a degraded mode of operation. Section 4 provides details on the service indicator implemented by the module. The tables below list all Approved or Vendor-affirmed security functions of the module, including specific key size(s) (in bits unless noted otherwise) employed for Approved services, and implemented modes of operation. There are some algorithm modes that were tested but not implemented by the module. Only the algorithms, modes, and key sizes that are implemented by the module are shown in these tables.

4 Palo Alto Networks SD-WAN Virtual Instant-On © 2024 Palo Alto Networks, Inc.

© 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 5

Table 4 - Approved Algorithms (Crypto Library - I)

6 Palo Alto Networks SD-WAN Virtual Instant-On © 2024 Palo Alto Networks, Inc.

CAVP Cert

Algorithm and Standard

Mode/Method

Description/Key Size(s) / Key Strength(s)

Use / Function Generation (CKG) for asymmetric keys as per section 5 in SP800- 133rev2 (vendor affirmed). A seed (i.e., the random value) used in asymmetric key generation is a direct output from SP800-90Arev1 DRBG (DRBG Cert. #A3572)

Table 5 - Approved Algorithms (Crypto Library

• II) Notes:
• The module’s AES-GCM implementation conforms to FIPS 140-3 IG C.H scenario #1 following RFC 5288 for TLS. The module is compatible with TLSv1.2 and provides support for the acceptable GCM cipher suites from SP 800-

52 Rev1, Section 3.3.1. The operations of one of the two parties involved in the TLS key establishment scheme

were performed entirely within the cryptographic boundary of the module being validated. The counter portion of the IV is set by the module within its cryptographic boundary. When the IV exhausts the maximum number of possible values for a given session key, the first party, client or server, to encounter this condition will trigger a handshake to establish a new encryption key. In case the module’s power is lost and then restored, a new key for use with the AES GCM encryption/decryption shall be established.

• No parts of the SSH, TLS, SNMP and IPSec/IKE protocols, other than the KDFs, have been tested by the CAVP and CMVP. As the module can only be operated in the Approved mode of operation with Approved algorithms noted in Tables 4 - 5 above, the following options defined in SP 800-140B are not applicable to this document:
• Non-Approved Algorithms Allowed in Approved Mode of Operation
• Non-Approved Algorithms Allowed in Approved Mode of Operation with No Security Claimed
• Non-Approved Algorithms Not Allowed in Approved Mode of Operation Table 6 - Entropy Certificates Cryptographic Boundary Figure 1 below depicts the cryptographic boundary (orange color area) and physical perimeter (light blue color area). The cryptographic boundary includes all of the software components of the cryptographic libraries. The physical perimeter is the Tested Operational Environment’s Physical Perimeter (TOEPP) on which the module runs. © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 7

Figure 1 - Block Diagram

3. Cryptographic Module Interfaces The module is a software only module that operates on a general purpose computing (GPC) platform. The physical ports and logical interfaces are consistent with a GPC operating environment. The module supports the following FIPS 140-3 logical interfaces. Table 7 - Ports and Interfaces
4. Roles, Services, and Authentication The module supports role-based authentication, and provides a Crypto Officer role. The Crypto Officer role has the ability to perform all tasks and administrative actions.

8 Palo Alto Networks SD-WAN Virtual Instant-On © 2024 Palo Alto Networks, Inc.

Table 8 – Roles, Services Commands, Input and Output © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 9

10 Palo Alto Networks SD-WAN Virtual Instant-On © 2024 Palo Alto Networks, Inc.

Table 9 – Approved Services G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 11

W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroizes the SSP. Unauthenticated Services Unauthenticated Users can run the self-test service by power-cycling the module by removing the power and re-applying.

5. Software/Firmware Security Integrity Techniques The module performs the Software Integrity test by using HMAC-SHA2-256 (HMAC Cert. #A3566) during the PreOperational Self-Test. A Software Integrity Test Key (non-SSP) was preloaded to the module’s binary at the factory and used for software integrity test only at the pre-operational self-test. At Module’s initialization, the integrity of the runtime executable is verified using an HMAC-SHA2-256 digest which is compared to a value computed at build time. If at the load time the MAC does not match the stored, known MAC value, the module would enter an Error state with all crypto functionality inhibited. The module also supports the software load test by using RSA 2048 bits with SHA2-256 (RSA Cert. #A3566) for the new validated software to be uploaded into the module. A Software Load Test Key was preloaded to the module’s binary at the factory and used for software load test. In order to load new software, the Crypto Officer must authenticate into the module before loading any software. This ensures that unauthorized access and use of the module is not performed. The module will load the new update upon reboot. The update attempt will be rejected if the verification fails Integrity Test On-Demand Integrity test is performed as part of the Pre-Operational Self-Tests. It is automatically executed at power-on. The operator can power-cycle or reboot the module to initiate the software integrity test on-demand. This automatically performs the integrity test of all software components included within the boundary of the module.
6. Operational Environment The module is a modifiable operational environment as per FIPS 140-3 Level 1 specifications. The operating system is restricted to a single operator mode of operation. The application that makes calls to the module is the single user of the modules even when the application is serving multiple clients. See Table 2 for details regarding what platforms the module was tested on. The software module provides a Software Update service. The module’s validation to FIPS 140-3 is no longer valid once a non-validated software is loaded.
7. Physical Security As the module is a software only module, the physical security requirements are not applicable.

12 Palo Alto Networks SD-WAN Virtual Instant-On © 2024 Palo Alto Networks, Inc.

8. Non-Invasive Security No approved non-invasive attack mitigation test metrics are defined at this time.
9. Sensitive Security Parameters © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 13

14 Palo Alto Networks SD-WAN Virtual Instant-On © 2024 Palo Alto Networks, Inc.

© 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 15

Table 10 - SSPs Table 11 - Non-Deterministic Random Number Generation Specification The module performs the following self-tests, including the pre-operational self-tests and Conditional self-tests. Pre-Operational Self-Tests Table 12 - Pre-Operational Self-Tests The module performs the following Cryptographic Algorithm Self-Tests (CASTs). These CASTs can be initiated by rebooting the module. All CASTs run without operator intervention automatically on reboot.

16 Palo Alto Networks SD-WAN Virtual Instant-On © 2024 Palo Alto Networks, Inc.

Table 13 – CASTs (Crypto Library I) Table 14 –CASTs (Crypto Library II) © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 17

Table 16 - Conditional Pair-Wise Consistency Tests (Crypto Library I) Table 17 - Conditional Pair-Wise Consistency Tests (Crypto Library II) Periodic/On-Demand Self-Test The module performs on-demand self-tests initiated by the operator, by power cycling or rebooting the tested platform. The full suite of self-tests is then executed. The same procedure may be employed by the operator to perform periodic It is recommended that the Crypto Officer perform periodic testing of the module’s on-demand self-tests every 60 days to ensure all components are functioning correctly. Error Handling If any of the above-mentioned self-tests fail, the module reports the cause of the error and enters an error state (there is only one error state). In the Error State, no cryptographic services are provided, and data output is prohibited. The only method to recover from the error state is to reboot the module and perform the self-tests, including the pre-operational software integrity test and the conditional CASTs. The module will only enter into the operational state after successfully passing the pre-operational software integrity test and the conditional CASTs. The table below shows the different causes that lead to the Error State and the status indicators reported. Table 19 - Error State Indicators 11. Life-Cycle Assurance The module is designed to handle the various stages of a module’s life-cycle. The sections below highlight the details for each stage. Secure Delivery Procedures Software is available on Palo Alto Networks’ support site, which uses TLS 1.2 during the download process. The support site also provides a SHA2-256 checksum that Crypto Officers can use to verify the integrity of the module once it has been transferred/downloaded.

18 Palo Alto Networks SD-WAN Virtual Instant-On © 2024 Palo Alto Networks, Inc.

Secure Operation The module meets all the Level 1 requirements for FIPS 140-3. Follow the secure operations provided below to place the module in the Approved mode. The software version is 6.1.2, which is the only allowable software image for this current approved mode of operation. The module is initiated into the Approved mode of operation via the following procedure:

1. Install the vION on the platform
2. Using the Controller, navigate to the device that is to be initiated
3. Select “FIPS” a. Click “proceed” to begin initialization procedure
4. The module will begin initialization that includes the following: a. Zeroization of any sensitive information or data b. Power cycle of the device followed by running all self-tests
5. Once initialization is complete, the module provides the following status output: a. Device Mode: “fips” b. Self-tests: “Power-up self test successful” Once the module has completed initialization into the Approved mode of operation, any non-Approved configurations/algorithms are rejected automatically by the module and an error message is output. End of Life / Sanitization End of life dates for software and hardware modules are announced publicly via Palo Alto Networks’ services website. Crypto Officers should follow the procedure below for the secure destruction of their module: Note: This process will cause the module to no longer function after it has wiped all configurations and keys.
6. Access the module as Crypto Officer
7. Execute command: “disable system” a. Confirm command
8. Module will begin zeroization process and wipe all security parameters and configurations
9. Mitigation of Other Attacks This module is not designed to mitigate against any other attacks outside of the FIPS 140-3 scope. © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Virtual Instant-On Network (vION) 19