Forcepoint Next Generation Firewall

Certificate

Approved Algorithms (46)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Forcepoint Next Generation Firewall
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>upgrade<br/>firmware load<br/>update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Status output</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Forcepoint Next Generation Firewall
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>upgrade<br/>firmware load<br/>update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Status output</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Forcepoint Next Generation Firewall 10900-A Stonelake Blvd. Austin, TX 78759, USA www.forcepoint.com

Revision History A March 9, 2022 Initial release. B February 22, 2024 CMVP Comment Responses © 2024 Forcepoint. This document may be freely reproduced and distributed whole and intact including this Preface This is a non-proprietary Cryptographic Module Security Policy for the Next Generation Firewall (Hardware Version: 2201, 2205, 2210, 3401 and 3410; firmware Version: 6.10.3.26158) from Forcepoint. This Security Policy describes how the Next Generation Firewall appliances (referred as NGFW appliances, modules, firewalls) meet the security requirements of Federal Information Processing Standards (FIPS) Publication 140-3, which details the U.S. and Canadian government requirements for cryptographic modules. More information about the FIPS 140-3 standard and validation program is available on the National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS) Cryptographic Module Validation Program (CMVP) website at https://csrc.nist.gov/projects/cryptographic-module-validation-program This document also describes how to run the modules in a secure Approved mode of operation. This policy was prepared as part of the Level 2 FIPS 140-3 validation of the module. The Next Generation Firewall appliances are referred to in this document as the NGFW appliances, crypto modules, or modules.

ISO/IEC 24759 Section 6 [Number Below]

FIPS 140-3 Section Title General Cryptographic Module Specification Cryptographic Module Interfaces Roles, Services, and Authentication Software/Firmware Security Operational Environment Physical Security Non-Invasive Security Sensitive Security Parameter Management Self-Tests Life-Cycle Assurance Mitigation of Other Attacks

Security Level

The Forcepoint Next Generation Firewall meets all level 2 security requirements for FIPS 140-3 as summarized in the table TABLE 1: SECURITY LEVELS

The NGFW appliances are high-performance network security appliances that add a broad range of built-in security features, including VPN, IPS, anti-evasion, TLS inspection, SD-WAN, and mission-critical application proxies, to a traditional firewall and provides end-to-end protection across the entire enterprise network. All appliances can be

Cryptographic Module Specification deployed as either a Layer 2 or Layer 3 firewall or a next generation IPS. However, in the FIPS 140-3 approved mode, the appliances are deployed in Firewall/VPN mode of operation, which provides access control and VPN connectivity. Each of the appliances run NGFW firmware version 6.10.3.26158 based on the NGFW OS 10 operating system with Linux kernel version 4.19.

The cryptographic module is a hardware module of type multi-chip standalone. The cryptographic boundary of the module is shown in the figures below. The cryptographic boundary is defined as the outer edge of the chassis. The NGFW 2201, 2205, and 2210 appliances are a 1U rack-mounted design featuring modular connectivity. All the units are equipped with 9x GE RJ45 and 4x (2201) or 8x (2205, 2210) 10 Gbps SFP+ fixed Ethernet ports, and include an interface module slot, allowing for additional connectivity. The appliances contain an integrated, dual redundant (on the 2210), power supply that supports a wide range of voltages: 100

• 240 VAC or -72
• -36 VDC. The operating temperature range of the appliances is between +5°C to +40°C (+41°F to +104°F). FIGURE 1: 2201 FRONT PANEL FIGURE 2: 2201/2205 REAR PANEL FIGURE 3: 2205/2210 FRONT PANEL FIGURE 4: 2210 REAR PANEL

Cryptographic Module Specification The NGFW 3401 and 3410 are a 2U rack-mounted design featuring modular connectivity. The NGFW 3400 series is equipped with 1x GE RJ45 and 2x 10 Gbps SFP+ fixed Ethernet ports, and includes eight Network I/O slots, allowing for additional connectivity. The appliance contains an integrated, dual redundant, power supply that supports a wide range of voltages: 100

• 240 VAC or -72
• -36 VDC. The operating temperature range of the appliances is between +5°C to +40°C (+41°F to +104°F). FIGURE 5: 3400 SERIES FRONT PANEL FIGURE 6: 3400 SERIES REAR PANEL

Model

Hardware [Part Number and Version] 2201 2205 2210

Firmware Version Firmware: 6.10.3.26158 Firmware: 6.10.3.26158 Firmware: 6.10.3.26158

Distinguishing Features

The following tested configurations are covered in this security policy: TABLE 2: CRYPTOGRAPHIC MODULE TESTED CONFIGURATION •      Intel Xeon D-2123IT Skylake Processor •      1 Power Supply Unit •      2 x 16 GB DDR4 RAM •      Intel Xeon D-2145NT Skylake Processor •      1 Power Supply Unit •      4 x 10GE PCIe card •      2 x 16 GB DDR4 RAM •      Intel Xeon D-2177NT Skylake Processor •      2 Power Supply Units •      4 x 10GE PCIe card •      2 x 16 GB DDR4 RAM

Model

Hardware [Part Number and Version] 3401 3410

Firmware Version Firmware: 6.10.3.26158 Firmware: 6.10.3.26158

Distinguishing Features

Cryptographic Module Specification •      Intel Xeon 4210 Cascade Lake Processor •      2 Power Supply Units •      8 Port Gigabit Ethernet RJ45 Module •      8 x 8GB RDIMM D4 RAM •      Intel Xeon 6230N Cascade Lake Processor •      2 Power Supply Units •      8 Port Gigabit Ethernet RJ45 Module •      12 x 16GB RDIMM D4 RAM

The following cryptographic library and associated CAVP certificates are used by the cryptographic module:

The approved algorithms implemented by the module alongside their mapping to the certificates above alongside algorithms use by services are listed in the table below. Note that the referenced algorithm certificates may contain more tested options than are utilized by the module, and that only those listed in the table below are implemented and used.

TABLE 3: APPROVED ALGORITHMS monitoring data, management connections and services, peer connections, VPN, HTTPS, and TLS connections Affirmed pairs per FIPS 186-4 services that utilize internal

2 No parts of the IKEv1, IKEv2, or TLS protocol, other than the approved cryptographic algorithms and the KDFs, have

been tested by the CAVP and CMVP

Cryptographic Module Specification No                        key generation within the module #A2155           ECDSA               Key Pair Generation,      P-224, P-256, P-384       Used in TLS and VPN connections #A2155           HMAC                SHA-1, SHA2-224,          > 256 bit keys            Used for authentication of SHA2-256, SHA2-384,                                 configuration files, logs, and SHA2-512                                            monitoring data, management connections and services, peer connections, VPN, HTTPS, TLS connections and SNMP monitoring.

Cryptographic Module Specification #A2155           KAS                 KAS-ECC-SSC with CVL   See KAS-ECC-SSC and       Establishing session keys for VPN KAS-FFC-SSC with CVL   See KAS-FFC-SSC and       Establishing session keys for VPN KAS-FFC-SSC with CVL   See KAS-FFC-SSC and       Establishing session keys for VPN #A2155           KAS-ECC-            ephemeralUnified       Domain Parameter          Establishing shared secrets for TLS

3 Key establishment methodology provides between 112 and 256 bits of encryption strength.

4 Key establishment methodology provides between 112 and 202 bits of encryption strength.

Cryptographic Module Specification #A2155           KAS-FFC-SSC         dhEphem                Domain Parameter        Establishing shared secrets for TLS #A2155           KTS6                AES-KWP                AES-256                 Used in VPN connections

5 Key establishment methodology provides 128 and 256 bits of encryption strength.

6 Key establishment methodology provides 256 bits of encryption strength.

Forcepoint NGFW FIPS Library

Cryptographic Module Specification #A2155           RSA                 Key Pair Generation,     1024 (verification      Used in TLS and VPN connections #A2155           SHS                 SHA-1, SHA2-224,         BYTE only               Used in HTTPS user authentication SHA2-512                                         level algorithms #A2209           AES                 AES-ECB, AES-CFB128      Direction: Encrypt,     Used in peer connections, SNMP Decrypt                 monitoring

Forcepoint NGFW Cryptographic Kernel Module

Forcepoint NGFW Entropy Library

#A2166 SHS SHA-1, SHA2-224, BYTE only Used as a prerequisite for higher-

TABLE 4: NON-APPROVED ALGORITHMS ALLOWED IN THE APPROVED MODE OF OPERATION WITH NO SECURITY CLAIMED

The figures in section Module Description identify the physical interfaces to the cryptographic module. The following TABLE 5: PORTS AND INTERFACES

Roles, Services, and Authentication 4. Roles, Services, and Authentication

The mapping of the cryptographic module’s roles services is in the table below: TABLE 6: ROLES, SERVICES, INPUT AND OUTPUT Crypto officer Display versioning NA Module version

Roles, Services, and Authentication Crypto officer Peer Connection Service NA Heartbeat, state synchronization data, synchronization data Crypto officer Modify and apply Configuration Configuration status The module supports role-based authentication within the module, where all roles must authenticate to the module by providing their authentication data. The module does not implement a limit on consecutive authentication attempts, as described in section 5.2.2 of SP 80063B. However, this is mitigated by the two-second delay for failed user password attempts and by a conservative argument about network session rate for the other authenticators. The success probability for random attempts during a one-minute period, as shown in the third column of the below table, shows that the module is well protected against password guessing attacks for all authenticators.

Roles, Services, and Authentication the strength is somewhat less than 80 bits but does not specify a value. For simplicity, 80 bits are used in the analysis below. This does not change the conclusion if the actual strength is somewhat less than 80 bits. TABLE 7: ROLES AND REQUIRED IDENTIFICATION AND AUTHENTICATION

Roles, Services, and Authentication

Roles, Services, and Authentication

All services listed in the table below can be accessed in approved mode and when in this mode exclusively use the security functions listed in Cryptographic Algorithms. Notes on the content of Table 8: Module Services:  In the ‘Access Rights to Keys and/or SSPs’ column:

• G = Generate: The module generates or derives the SSP.
• R = Read: The SSP is read from the module (e.g., the SSP is output).
• W = Write: The SSP is updated, imported, or written to the module.
• E = Execute: The module uses the SSP in performing a cryptographic operation.
• Z = Zeroize: The module zeroizes the SSP. In the ‘Keys and/or SSPs’ column: For a complete description of SSP referenced from the table, see section SSP Management.

Roles, Services, and Authentication TABLE 8: MODULE SERVICES Started in FIPS 140

Roles, Services, and Authentication Shut down the                     Terminate module   None                      Ephemeral SSPs7   Crypto officer   Z                       Power LED A shut down module is indicated by an unlit power LED.

7 The designation of ‘Ephemeral SSPs’ encompasses any keys noted to be stored solely in the module’s SDRAM in Table 10: Summary of SSPs

Roles, Services, and Authentication System zeroization complete following reboot. SMC monitoring interface: version displayed in SMC monitoring window.

Roles, Services, and Authentication SMC: Approved mode displayed in SMC monitoring window succeeded. Log field: Cryptographic selftests succeeded

Roles, Services, and Authentication Connection established

8 The designation of ‘TLS SSPs’ encompasses the TLS Encryption Key, TLS Authentication Key, TLS Pre-Master Secret, TLS Master Secret, TLS ECDSA Private Key, TLS

ECDSA Public Key, TLS ECDH Private Key, TLS ECDH Public Key, TLS Trusted Certificates

9 The designation of ‘DRBG SSPs’ encompasses the 256-bit DRBG Entropy Input, 256-bit DRBG Seed, 128-bit DRBG ‘V’ Value, and 256-bit DRBG ‘Key’ Value

Peer NGFW modules establish secure network connection within a cluster.

AES, DRBG, ECDSA, HMAC, KAS-ECC- SSC, KAS-FFC-SSC, RSA, SHA, TLS KDF

Cluster Protocol Key, State Synchronization Key, HTTPS RSA Private Key, HTTPS RSA Public Key, IKE Encryption Key, IKE Authentication Key, SKEYID, SKEYID_d, SKEYSEED, SK_d, SK_pi, SK_pr, IPsec Encryption Key, IPsec Authentication Key, VPN RSA Private Key, VPN RSA Public Key, VPN ECDSA Private Key, VPN ECDSA Public Key, VPN DH Public Key, VPN ECDH Public Key TLS SSPs8 DRBG SSPs9

Crypto officer

G,R,W,E

Roles, Services, and Authentication dsd: FIPS: starting in FIPS compliant mode RSA Public Key, IKE ssd: FIPS: starting in SKEYSEED, SK_d, sendlogd: FIPS: SK_pi, SK_pr, IPsec starting in FIPS Encryption Key, compliant mode

<filename> has been created TLS SSPs8 slapd: FIPS: running in FIPS compliant mode

Verify and apply the configuration changes to the modules securely including configuration of client protection and server protection certificate authority and TLS credentials.

AES, HMAC, KBKDF, PBKDF

Configuration file encryption key, Configuration file authentication key, Key Encryption Passphrase, Key Encryption Key, VPN Pre-Shared Key, Client Protection CA RSA Private Key, Client Protection IM CA RSA Private Key, Client Protection IM CA ECDSA Private Key, Client Protection RSA Private Key, Client Protection ECDSA Private Key, SNMP Encryption Key, SNMP Authentication Key, Cluster Protocol Key

Crypto officer

G,R,W,E

Roles, Services, and Authentication PBKDF Inspection: System Policy-Loaded

10 The designation of ‘VPN SSPs’ encompasses the VPN RSA Private Key, VPN ECDSA Private Key, VPN Pre-Shared Key, VPN DH Private Key, VPN DH Shared Secret,

VPN ECDH Private Key, VPN ECDH Shared Secret, VPN Key Wrapping Key, VPN RSA Public Key, VPN ECDSA Public Key, VPN DH Public Key, VPN ECDH Public Key

HTTPS SSPs11 New user has been authorized User has been reauthorized

11 The designation of ‘HTTPS SSPs’ encompasses the HTTPS Encryption Key, HTTPS Authentication Key, HTTPS Pre-Master Secret, HTTPS Master Secret, HTTPS RSA

Private Key, HTTPS DH Private Key, HTTPS ECDH Private Key, HTTPS RSA Public Key, HTTPS DH Public Key, HTTPS ECDH Public Key

Roles, Services, and Authentication Inspection SSPs Decrypted=true

12 The designation of ‘Inspection SSPs’ encompasses the Inspection DH Private Key, Inspection ECDH Private Key, Inspection Encryption Key, Inspection

Authentication Key, Inspection Pre-Master Secret, Inspection Master Secret, Inspection DH Public Key, Inspection ECDH Public Key

13 The designation of ‘Client Protection SSPs’ encompasses the Client Protection CA RSA Private Key, Client Protection IM CA RSA Private Key, Client Protection IM

CA ECDSA Private Key, Client Protection RSA Private Key, Client Protection ECDSA Private Key, Client Protection CA RSA Public Key, Client Protection IM CA RSA

14 The designation of ‘Server Protection SSPs’ encompasses the Server Protection RSA Private Key, Server Protection ECDSA Private Key, Server Protection RSA Public

Roles, Services, and Authentication Decrypted=true SMC Monitoring data shown in the SMC monitoring window

15 The designation ‘SSM SSPs’ encompasses the SSM HTTPS DH Private Key, SSM HTTPS DH Public Key, SSM HTTPS ECDH Private Key, SSM HTTPS ECDH Public Key,

SSM HTTPS Encryption Key, SSM HTTPS Authentication Key, SSM HTTPS Pre-Master Secret, SSM HTTPS Master Secret, SSM Client Protection RSA Private Key, SSM Client Protection ECDSA Private Key, SSM Client Protection RSA Public Key, and SSM Client Protection ECDSA Public Key

SNMP Monitoring SNMP manager SNMP Encryption User R,E Log field smonitd: FIPS starting in FIPS compliant mode

Roles, Services, and Authentication

The module operates in an alternating bypass mode according to the policies set. The enabling and disabling of the bypass capability is performed via ‘Modify and apply configuration’ service allocated to the CO role. The module implements the following forms of alternating bypass: VPN network traffic: For policy-based VPN traffic, the module operates with bypass deactivated if the module action is set to IPsec VPN, where the module is operating to provide VPN service for the specified source/destination addresses. The module will encrypt/decrypt network traffic according to the policy. The module operates with bypass activated if the module action is set to allow in Access rules for network traffic, where the module is accepting/sending plaintext data for the specified source/destination addresses. For route-based VPN traffic, the module operates with bypass deactivated when network traffic is routed to module interfaces that are designated as endpoints for a VPN tunnel and is sent into the VPN tunnel. If Access rules allow the traffic, traffic is automatically sent through the tunnel to the endpoint. The module operates with bypass activated when network traffic is routed to module interfaces that accept plaintext data. Based on the Access rule (allow/discard), the traffic is either forwarded to the endpoint or dropped. In both cases, to activate the bypass feature, two independent actions must be taken by a CO. The CO must create the firewall policy allowing the bypass feature and apply the policy to the module to enable it. Firewall network traffic: The default action for network traffic in firewall Access rules is discard. For firewall traffic, the module operates with bypass deactivated if the traffic from the endpoint is sent/received using HTTPS, and the module action is set to allow. If traffic from the endpoint is passed directly to the module using HTTP, and the module action is set to allow, then the module is operating with bypass activated. For incoming traffic, if the HTTPS option is selected, the module connections with the endpoint are encrypted using TLS (bypass deactivated). If the HTTP option is selected, the module accepts connections in plaintext (bypass activated). For Outgoing traffic, If HTTPS is selected, web traffic will be re-encrypted using TLS (bypass deactivated). If HTTP is configured, web traffic is sent in plaintext (bypass activated). Two independent actions must be taken by a CO. The CO must create the firewall policy allowing bypass and apply to the module to enable it. The rules in the policy that is currently applied to the module specify whether the module allows the encrypted or plaintext traffic. The status information for the bypass activation and deactivation can be viewed via established management connection from SMC as indicated below: Bypass

• When bypass is activated, the Situation field in the Logs view shows “Connection Allowed” and the TLS decrypted field in the Connections view is blank. IPSEC VPN/HTTPS
• The Situation field in the Logs view indicates the respective operations performed by these services. For example, “IPsec-SA-Responder-Done”.

Roles, Services, and Authentication TLS inspection – For this service the Situation field in the Logs view shows “Connection_Allowed” and the TLS decrypted field in Connections view is "true".

The Export Logs and Monitoring Data Service and the Peer Connection Service are self-initiated cryptographic output capabilities supported by the module. In both cases, these services are triggered by the module itself without a specific request to perform the service. The Export Logs and Monitoring Data Service is enabled on the first policy push from the SMC where the Log Server address is specified. This is configured through two independent steps: adding the Log Server and activating the policy. The Peer Connection Service is enabled when the module is joined to a cluster. While the module is in a cluster, this communication happens, and it stops when module is removed from the cluster. This is also configured through two independent steps:

• Installing the new engine (module) and performing the initial configuration after adding the engine to the Firewall Cluster element’s properties and defining the node-specific IP addresses of the new node.
• Refreshing the security policy of the Firewall Cluster. The Crypto officer can make usage of the module’s Show status service to determine if the self-initiated cryptographic output capability is active by observing the ‘Status’ tab on the SMC Web GUI:

Software/Firmware Security FIGURE 7: SELF-INITIATED CRYPTOGRAPHIC OUTPUT CAPABILITY STATUS ON SMC WEB GUI 5. Software/Firmware Security

The Forcepoint Next Generation Firewall’s firmware integrity is checked on startup as described in section Self-Tests. The module runs the self-test functions to check the firmware integrity as well as the cryptographic algorithms used. Any failures during these tests will result in a module halt in which an error message is output, the module reboots and data output is inhibited. The images are stored as signed binaries using the “Firmware Integrity Check Public Key” which uses ECDSA with P-521 and SHA2-512. The operator can trigger an on-demand check of the module firmware by rebooting the module. 6. Operational Environment Per Section 7.5 of the FIPS 140-3 Management Manual, this section is not-applicable. The module supports a non-modifiable operating environment as defined by ISO/IEC 19790:2012 and meets the Level 2 Physical Security requirements.

Hardware Module

Number of Tamper Evident Labels Required

Physical Security 7. Physical Security

The module is enclosed in a strong metal (steel) enclosure that provides tamper-evidence. Any tampering that might compromise a module’s security is detectable by visual inspection of the physical integrity of a module. The Crypto Officer should perform a visual inspection of the module at regular intervals. The module’s enclosure is opaque to resist visual inspection of the device design, physical probing of the device and attempts to access sensitive data on individual components of the device. The following table depicts the number of tamper evident labels required for each hardware module: NGFW 2201 2 NGFW 2205 3 NGFW 2210 4 NGFW 3400 14 Each shipment of the Forcepoint NGFW FIPS Kit includes 25 tamper labels. Additional tamper labels can be purchased in single boxes of 25 (SKU: ACFIPS3) from Forcepoint. In addition to the strong metal enclosure, the module employs uniquely numbered tamper-evident labels. The following images depict the tested, Approved TEL configurations for the modules:

Physical Security FIGURE 8: 2205/2210 FRONT TEL PLACEMENTS FIGURE 9: 2210 REAR TEL PLACEMENTS

Physical Security FIGURE 10: 2201 FRONT TEL PLACEMENT FIGURE 11: 2201/2205 REAR TEL PLACEMENT

Physical Security FIGURE 12: 3400 SERIES FRONT TEL PLACEMENTS FIGURE 13: 3400 SERIES RIGHT SIDE TEL PLACEMENT

Physical Security FIGURE 14: 3400 SERIES REAR TEL PLACEMENTS FIGURE 15: 3400 SERIES LEFT SIDE TEL PLACEMENT

The module also employs internal baffles to deter visual observation of the internal components of the modules through vents. The following image depicts a vent that is protected by a baffle:

Physical Security FIGURE 16: DEPICTION OF VENT PROTECTED BY INTERNAL BAFFLE

Physical Security Mechanism

Recommended Frequency of Inspection/Test On receipt of module following transport. At any point following any un-authorized access to the environment hosting the module. Following any extended periods of unattended storage for the module.

Inspection/Test Guidance Details

The following routine inspections are recommended. enclosure surfaces and tamper-evident seals for signs of tamper. Any attempts to remove the covers will result in tamper evidence. Example (but not exhaustive) pictures of potential attempts to tamper a module are shown below:

Non-Invasive Security If any evidence of tampering is observed on the module enclosures or tamper-evident seals, the modules shall be considered in a non-compliant state. Upon such discovery, the CO shall immediately take the module out of operation and contact Forcepoint Customer Support.

8. Non-Invasive Security N/A: Section 8, Non-Invasive Security is Not-Applicable as there are currently no requirements in SP 800-140F.
9. SSP Management

The following table lists Sensitive Security Parameters (SSP) used to perform approved security functions supported by the cryptographic module. The following notes should be observed when reading the table: • When reading the ‘strength’ column, the listed security strength is calculated using methods in FIPS 140-3 IG D.B, ‘Strength of SSP Establishment Methods’.

SSP Management

• When reading the ‘Security Function and Cert Number’ column, this is the security function that will consume the SSP.
• When reading the ‘Use and Related Keys’ column, this will contain the other SSPs that are either established via the SSP, other SSPs that are used to establish the SSP, or if it is a key pair the associated public or private component will be listed as well. TABLE 10: SUMMARY OF SSPS 56Arev3 Master Secret Authentication Key

SSP Management TLS (KTS)                                               Power off           SKEYSEED, SK_d, SK_pi, SK_pr TLS (KTS)                                               Power off           SKEYSEED, SK_d, SK_pi, SK_pr TLS (KTS)                                               Power off           Secret, VPN ECDH Shared Secret, VPN Pre-Shared Key, IKE Authentication Key, IPsec Encryption Key, IPsec Authentication Key

SSP Management TLS (KTS)                                               Power off           Secret, VPN ECDH Shared Secret, VPN Pre-Shared Key, IKE Authentication Key, IPsec Encryption Key, IPsec Authentication Key TLS (KTS)                                               Power off           SKEYSEED, SK_d, SK_pi, SK_pr TLS (KTS)                                               Power off           SKEYSEED, SK_d, SK_pi, SK_pr Encrypted via                                                               Related SSPs: VPN RSA Public #A2155                    TLS (KTS)                                disk                               SKEYSEED, SK_d, SK_pi, SK_pr

SSP Management #A2155      Testing                                                           Power off           Related SSPs: VPN DH Public Candidates                                                                            Key, VPN DH Shared Secret #A2155                                 Agreement                              Power off           Related SSPs: VPN DH Private Key, VPN DH Public Key #A2155      Testing                                                           Power off           Related SSPs: VPN ECDH Public Candidates                                                                            Key, VPN ECDH Shared Secret VPN ECDH Shared               112-256    KDF IKE     N/A          N/A           Established via KAS-    Plaintext in   Automatically       Elliptical curve Diffie-Hellman #A2155                                 Agreement                              Power off           Related SSPs: VPN ECDH Private Key, VPN ECDH Public Key Related SSPs: Cluster Protocol

SSP Management agreement using NIST                                           HTTPS ECDH Private Key, HTTPS SP 800-56Arev3                                                 ECDH Public Key, HTTPS Master Secret #A2155                                                                               the session         Related SSPs: HTTPS Pre-master or Power off        Secret, HTTPS Encryption Key, HTTPS Authentication Key #A2155      Testing                                                                  Power off           Related SSPs: HTTPS DH Public Candidates                                                                                   Key, HTTPS Pre-master Secret Candidates                                                                                   Public Key, HTTPS Pre-master Secret

SSP Management Key                                                                TLS (KTS)                                                         Related SSPs: Client Protection CA RSA Public Key Key                                                                                                                                  Related SSPs: Client Protection IM CA RSA Public Key Private Key                              #A2155      Candidates                                                                      Related SSPs: Client Protection IM CA ECDSA Public Key Related SSPs: Client Protection TLS (KTS)                                                         Related SSPs: Server Protection Key                                      #A2155      Candidates                                                                      Related SSPs: Client Protection

SSP Management Candidates Related SSPs: Inspection DH Public Key, Inspection PreMaster Secret Candidates Related SSPs: Inspection ECDH Public Key, Inspection PreMaster Secret the session Related SSPs: Inspection Master agreement using NIST Public Key, Inspection DH SP 800-56Arev3 Private Key, Inspection DH Public Key, Inspection Master Secret

SSP Management #A2155                                                                        the session         Related SSPs: Inspection Preor Power off        Master Secret, Inspection Encryption Key, Inspection Authentication Key Candidates                                                                            Related SSPs: SSM HTTPS DH Public Key, SSM HTTPS PreMaster Secret Candidates                                                                            Related SSPs: SSM HTTPS ECDH Public Key, SSM HTTPS PreMaster Secret the session         Related SSPs: SSM HTTPS Master Key                                      #A2155                                                                        the session         Related SSPs: SSM HTTPS Master

SSP Management agreement using NIST                                         Private Key, SSM HTTPS DH SP 800-56Arev3                                               Public Key, SSM HTTPS ECDH Private Key, SSM HTTPS ECDH Public Key, SSM HTTPS Master Secret #A2155                                                                            the session         Related SSPs: SSM HTTPS Preor Power off        Master Secret, SSM HTTPS Encryption Key, SSM HTTPS Authentication Key Protection RSA                bits       #A2155      B.3.6                                                  SDRAM                              the SSM Proxy Service Private Key                                                                                                                                    Related SSPs: SSM Client Protection RSA Public Key Private Key                              #A2155      Candidates                                                                                Related SSPs: SSM Client Protection ECDSA Public Key Public Key                                                         part of TLS                                                                 Related SSPs: SSM Client

SSP Management Plaintext as Related SSPs: VPN RSA Private

SSP Management Candidates    part of IKE                                                      Key, VPN DH Shared Secret Candidates    part of IKE                                                      Key, VPN ECDH Shared Secret Plaintext as                                                     Related SSPs: HTTPS RSA Private Candidates    part of TLS                                                      Key, HTTPS Pre-master Secret

SSP Management Candidates    part of TLS                                                       Private Key, HTTPS Pre-master protocol                                                          Secret TLS (KTS)                                                         Related SSPs: Client Protection CA RSA Private Key Key                                                                                                                                  Related SSPs: Client Protection IM CA RSA Private Key Public Key                               #A2155      Candidates                                                                      Related SSPs: Client Protection IM CA ECDSA Private Key part of TLS                                                       Related SSPs: Client Protection TLS (KTS)                                                         Related SSPs: Server Protection

SSP Management protocol                                                          Private Key, Inspection PreMaster Secret protocol                                                          Private Key, Inspection PreMaster Secret Candidates   part of TLS                                                       Related SSPs: SSM HTTPS DH protocol                                                          Private Key, SSM HTTPS PreMaster Secret Candidates   part of TLS                                                       Related SSPs: SSM HTTPS ECDH protocol                                                          Private Key, SSM HTTPS PreMaster Secret

SSP Management Certificates                  bits       #A2155                   Encrypted via                         SDRAM                          authenticating internet servers 256-bit DRBG Seed input                                                Seed input                                                Seed

SSP Management Cluster Protocol              256        HMAC        N/A           Input           Input                 Plaintext or   Disk erasure    Used for authentication within Synchronization                          #A2155      unmodified    Output                                SDRAM                          authentication in the state Related SSPs: Configuration File Encryption Key, Configuration File Authentication Key Configuration File            256        PBKDF       CKG using     N/A             Generated             Plaintext on   Disk erasure    Used to derive the key pair Protection                               Cert.       unmodified                                          disk                           obfuscation and integrity Related SSPs: None or Power off    Related SSPs: Configuration file protection Key

SSP Management protection Key Passphrase                               Cert.                    Encrypted via                        disk                                used to protect private keys Related SSPs: Key Encryption Passphrase Public Key 16                            #A2155                                                                                            Related SSPs: None

16 The key “Firmware Integrity Check Public Key” is not considered to be an SSP, but otherwise included for completeness.

The module includes a non-deterministic Random Number Generator (RNG) within the module boundary. The non-deterministic RNG is used exclusively to feed an approved SHA-3 conditioning function where in-turn the output of the conditioning function is used to seed the DRBG. The Non-Deterministic RNG complies with SP 800-90B and has been certified using FIPS 140-3 IG D.J with guidance set out in FIPS 140-3 IG D.K. TABLE 11: NON-DETERMINISTIC RANDOM NUMBER GENERATION SPECIFICATION CPU timing jitter Full-entropy output SP 800-90B compliant Non-Deterministic RNG using a softwarebased noise source internal to the module boundary. Output from the noise source is fed through an approved conditioning function based on SHA3-256. Raw noise is generated based on non-deterministic jitter inherent in CPUs from factors such as CPU instruction pipelines, CPU clock cycles being different from memory bus clock speeds, CPU frequency scaling, CPU power management, instruction and data cache states, CPU topology, different CPU cache technologies, CPU branch prediction, hardware interrupts, etc. The module achieves full entropy from the output of the conditioning function where every 512-bits used to seed the DRBG All outputs from the noise source are subjected to health testing ahead of being fed to the conditioning function. 10. Self-Tests

The module performs the pre-operational self-tests upon power-up to confirm the firmware integrity, and to check the continued correct operation of the random number generator and each of the implemented cryptographic algorithms used in support of the integrity checks. While the module is running these self-tests, all data output interfaces are disabled until the successful completion of the self-tests. If one of the pre-operational self-tests fails or a conditional self-test fails, the module enters an error state. An error message is output on the status output interface specifying the library within the module that failed the self-test. In this state, all data output via the module’s data output interfaces is inhibited. The module proceeds to reboot and reruns all self-tests. Successful completion of the self-tests will clear the error state, and the module will return to the Approved mode of operation. For any consecutive failure of the self-tests during restart, the appliance continues to restart. If the problem persists, CO intervention is required to either perform a restore to factory defaults settings and reinstall, or power-off and contact Forcepoint Customer Support.

Test

Operations Performed Verify Bypass

Indicator

Self-Tests TABLE 12: PRE-OPERATIONAL SELF-TESTS Root Filesystem Integrity Test (ECDSA with P-521 Verify Error output and module and SHA2-512) reboot. Pre-operational Bypass Test Bypass Error output and module reboot.

The module automatically performs conditional self-tests based on the module operation. These self-tests do not require operator input to initiate. Implemented conditional tests are in one of the following forms:

• Known Answer Test (KAT)
• Pair-Wise Consistency Test (PCT)
• Health tests
• Bypass tests All KATs alongside health testing of the noise source are performed immediately following the pre-operational selftests at module power-on TABLE 13: CONDITIONAL CRYPTOGRAPHIC ALGORITHM SELF-TESTS Forcepoint NGFW FIPS Cryptographic Module and decryption encryption and Hellman (KAS- #A2155 Load Computation module reboot.

AES-CBC, CFB, ECB, OFB 128, 192, 256

Cert. #A2166

Upon Library Load

Encryption, Decryption

Self-Tests Diffie-Hellman                                     #A2155     Load             Computation       module reboot. signing                                            #A2155     Load                               module reboot. Bypass Test                                        #A2155     Files Received                     module reboot. signing                PKCS#1v1.5                  #A2155     Load                               module reboot. Forcepoint NGFW FIPS Library end decryption PBKDF2                                             #A2209     Load                               module reboot. Forcepoint NGFW Cryptographic Kernel Module

Self-Tests authenticated Forcepoint NGFW Entropy Library Count Test                                                        Upon Entropy Subsequent Entropy module reboot. Proportion                                                        Upon Entropy Samples within          module reboot. TABLE 14: CONDITIONAL PAIR-WISE CONSISTENCY TESTS created for digital                                          #A2155   Generation                          and module signature purposes                                                                                        reboot. PCT for ECDSA key pairs              ECDSA                   Cert.    Upon ECDSA Key Sign, Verify         Error output created for digital                                          #A2155   Generation                          and module signature purposes                                                                                        reboot. created for key agreement                                    #A2155   Generation       Recalculation      and module purposes                                                                                                  reboot. created for key agreement                                    #A2155   Generation    Recalculation         and module purposes                                                                                                  reboot.

Life-Cycle Assurance 11. Life-Cycle Assurance Operating the module without following the guidance below will result in non-compliant behavior and is outside the scope of this Security Policy.

Upon receiving the NGFW hardware, the CO shall check that the appliance is not damaged and that all required parts and instructions are included. If the Network Components are not installed in the appliance, the CO must insert them by performing the following: Note: Read all safety instructions before installing the Network Components. Do not install any Network Components while the appliance is on. Fasten a grounding strip from the wrist to the appliance.

1. Locate the Network Component slots on the front of the appliance.
2. If the appliance was shipped with the Network Component slot(s) covered by a plate, remove the thumbscrew and plate from the appliance. Store the thumbscrew and plate in case the Network Component is eventually removed.
3. Push the Network Component into the slot. The Network Component is properly installed when the front of the Network Component is flush with the front of the appliance. The NGFW uses tamper-evident seals to protect against unauthorized access to the internal components of the chassis through removable covers. The CO shall apply labels to the module as depicted in section Tamper-Evident Labels.

The administration of the NGFW modules is done through the SMC, which provides centralized administrative functionalities for all the managed NGFW modules. The SMC can be shipped preinstalled on its own Forcepoint hardware appliance, installed as a virtual machine on a virtualization platform, or installed on a third-party Windows or Linux platform. The SMC can be accessed by an administrator via a Java-based Management Client running on the administrator’s workstation. Using the Management Client, create a configuration for the NGFW Engine in the Approved Mode of Operation. 1. To use HTTPS User Authentication and TLS Inspection for Client Protection or Server Protection, create a TLS Cryptography Suite Set element. Select only the Approved and Allowed algorithms and TLS cipher suites. The Management Connection Service, Peer Connection Service, Key Pair Management Service, and User Management Service utilize the TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 cipher suite. Refer to Table 3: Approved Algorithms above for a list of algorithms implemented. For more information, see the “Create TLS Cryptographic Suite Set elements” topic of the Forcepoint NGFW Product Guide.

• In accordance with the NGFW Product user guide, the following TLS Cipher Suites are utilized within the module:
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

Life-Cycle Assurance o TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 o TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 o TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 o TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 o TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 o TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 o TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 o TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 o TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

2. To use certificates signed by a Certificate Authority (CA) that is not one of the default Trusted Certificate Authority elements, create a Trusted Certificate Authority element. Import only a certificate signed using a Approved signature algorithm. For more information, see the “Create Trusted Certificate Authority elements” topic of the Forcepoint NGFW Product Guide.
3. To use HTTPS User Authentication, create a TLS Profile element. Select the TLS Cryptography Suite Set element, the Trusted Certificate Authority, and the minimum TLS version. For more information, see the “Create TLS Profile elements” topic of the Forcepoint NGFW Product Guide.
4. Create the NGFW Engine Element by defining the properties in the Engine Editor. • Browse to Advanced Settings, then select FIPS-Compatible Operating Mode. • Select “FIPS-Disable Remote Engine Upgrades” for the NGFW to prevent firmware load attempts from the SMC. • To use HTTPS User Authentication, browse to Add-Ons | User Authentication, then enable HTTPS and select the TLS Profile element. Use 2048 or greater as the Key Length when creating a certificate signing request in HTTPS Settings. For more information, see the “Enable browser-based user authentication” topic of the Forcepoint NGFW Product Guide. • To use TLS Inspection for Client Protection, create a Client Protection Certificate Authority element and import the private key and the certificate used to issue certificates in TLS Inspection. Use only the Approved algorithms and key size for the key pair and certificate. In the Engine Editor, browse to Add-Ons | TLS Inspection, then select the Cryptography Suite Set. For more information, see the “Configure TLS inspection for client protection” and “Activating TLS inspection” topics in the “Setting up TLS Inspection” chapter of the Forcepoint NGFW Product Guide. • To use TLS Inspection for Server Protection, browse to Add-Ons | TLS Inspection, then select the Cryptography Suite Set. For more information, see the “Activating TLS inspection” topic in the “Setting up TLS Inspection” chapter of the Forcepoint NGFW Product Guide. • When using TLS Inspection or Sidewinder HTTPS proxy, create a Firewall Policy that has an Access rule that allows the TLS connection and create an Inspection Policy that has an Inspection rule that terminates connections that match the TLS_Certificate-Verify-Failed Situation. On the Inspection tab of the Firewall Policy, you must select the Inspection Policy that you created. • To use Sidewinder HTTP and HTTPS proxies, browse to Add-Ons | Sidewinder Proxy, click Advanced, then set the value of the tls_cipher_override property to TLSv1.2+ECDHE+AES!AESCCM:TLSv1.2+DHE+AES!AESCCM!DSS on the HTTP tab. For more information, see the “Advanced settings for Sidewinder Proxies” topic in the “Sidewinder Proxies” chapter of the Forcepoint NGFW Product Guide.

Life-Cycle Assurance • When using IPsec, disable Automated RSA Certificate Management. Browse to VPN | Certificates, then deselect Automated RSA Certificate Management. • To use IPsec, right-click the Gateway element, then select Tools | Generate Certificate to create a certificate signing request. Select RSA with 2048 or greater key size, or ECDSA as the Public Key Algorithm. For more information, see the “Create a VPN certificate or certificate request for a VPN Gateway element” topic in the “Managing VPN certificates” chapter of the Forcepoint NGFW Product Guide.

5. To use an IPsec VPN, create a VPN Profile element. Use only the Approved and Allowed algorithms and key sizes in the profile. Refer to Table 3: Approved Algorithms above for a list of algorithms implemented. Additionally, in the profile element, the IPsec Tunnel Lifetime should be set to less than 232 bytes. Select the VPN Profile element. For more information, see the “Create VPN Profile elements” topic in the “VPNs in Forcepoint NGFW” chapter of the Forcepoint NGFW Product Guide.
6. Create Access Rules to configure the Alternating Bypass Feature.
7. Save the initial configuration for the NGFW Engine. Make a note of the one-time password, which is required for initial contact with the SMC. See section “Setting up the Approved Configuration” for setting up the device configurations.

The NGFW appliances are delivered in an operational state with the most recent firmware preinstalled. The NGFW firmware must be upgraded to the FIPS 140-3 validated NGFW firmware version to be placed in the Approved mode of operation. Note: The upgrade to the FIPS 140-3 validated NGFW firmware version is necessary even if the same version was installed previously. This is required because the file system checksum is stored during the upgrade process. A method to update the firmware image with a SHA2-512 checksum signed with ECDSA P-521 is provided. Prior to installing the new image, its associated checksum is checked. If the signature check fails, the new firmware is ignored, and the current firmware remains loaded. If the signature check passes, the new image will be installed and executed after the appliance is restarted. Any firmware loaded into the module other than version 6.10.3.26158 is out of the scope of this validation and will mean that the module is not operating in the approved mode of operation. A FIPS 140-3 Validated NGFW firmware version is downloaded as follows:

1. Login to the Forcepoint Support https://support.forcepoint.com/Login
2. Proceed to the Forcepoint NGFW downloads section.
3. Download the firmware version 6.10.3.26158 installation file (sg_engine_6.10.3.26158_x86-64-small.zip).
4. Verify the SHA checksum. Note: The correct checksums are shown on the download page and can also be found in the release notes After downloading the firmware, the operator can upgrade to a FIPS 140-3 validated firmware version:
5. Save the FIPS 140-3 validated NGFW firmware version upgrade .zip file to the root directory of a USB drive. Note – The firmware upgrade zip file must be in the root directory of the media.
6. Connect to the appliance using a monitor and keyboard.
7. Power on the appliance and start the NGFW Configuration Wizard.

Life-Cycle Assurance

4. Select the Firewall/VPN option.
5. Select Upgrade. The Select Source Media dialog opens.
6. Select the appropriate media type and select OK. The firmware update signature is verified.
7. Select OK. The upgrade starts.
8. Select “Set kernel in FIPS mode” after restart. Select OK.
9. The NGFW appliance restarts and displays the upgraded version.
10. Verify the NGFW firmware version to ensure that the FIPS validated NGFW firmware version is loaded.

To configure the NGFW Engine:

1. Start the NGFW Configuration Wizard as instructed in the Configuring the Engine in the Engine Configuration Wizard section of the NGFW Installation Guide.
2. Configure the network interfaces according to your environment as instructed in the Configuring the Network Interfaces section of the NGFW Installation Guide. a. Configure the operating system settings according to the "Configuring the Operating System Settings" section of the NGFW Installation Guide. b. Select both: - "Restricted FIPS-compatible operating mode" (This automatically disables the SSH daemon and root password options in the Engine Configuration Wizard). - "FIPS 140-3 compatible mode" (This setting ensures the module uses only FIPS 140-3 approved algorithms and security functions).
3. Contact the Management Server as instructed in the Contacting the Management Server section of the NGFW Installation Guide. Enter node IP address manually is selected by default and other IP address options are disabled when the “Restricted FIPS-compatible operating mode” setting is enabled. The engine restarts.
4. To verify the “FIPS 140-3 compatible operating mode” setting is activated: a. Verify that the following messages are displayed on the console when the engine restarts: - FIPS: rootfs integrity check OK (Displayed after the root file system integrity test has been executed successfully) - FIPS power-up tests succeeded (Displayed after the FIPS 140 power-up tests have been executed successfully) b. Continue as instructed in the “After Successful Management Server Contact” section of the NGFW Installation Guide. Note: If the engine does not enter the “Restricted FIPS-compatible operating mode” even though it is configured to do so, or if the power-up tests fail (a power-up test error message is displayed or the success message is not displayed), the appliance must be reset to factory settings and reinstalled. Note: The “FIPS 140-3 compatible operating mode” and “Restricted FIPS-compatible operating mode” settings must be enabled during the initial configuration of the appliance.

Resetting the appliance to factory settings is not part of the normal installation procedure. There is no need to reset the appliance to factory settings before starting to use it for the first time. These instructions can be used to reset the appliance to factory settings when necessary, such as when initial configuration has been completed without enabling the “Restricted FIPS-compatible operating mode”, during use, or when the appliance is being removed from use. To reset the appliance to factory settings:

1. Reboot the appliance and select System restore options from the boot menu. NGFW System Restore starts.
2. Enter 2 for Advanced data removal options.
3. Enter one of the following options: • 1 for 1 pass overwrite • 8 for a Custom number of overwrite passes If you selected Custom, enter the number of overwrite passes. A larger number of overwrites is more secure, but it may take a considerable amount of time depending on the appliance storage capacity

Mitigation of Other Attacks

12. Mitigation of Other Attacks This section is not applicable. The modules do not claim to mitigate any attacks beyond the FIPS 140-3 Level 2 requirements for this validation.
13. Guidance

1. At the Home screen of the SMC that is being used to manage the module, click on the firewall.
2. On the right-hand column, under “Info”, the firewall version (and update package) will be in the “General” tab FIGURE 17: DEPICTION OF THE MODULE VERSION DISPLAYED IN THE SMC GUI

When configured according to the guidance in this Security Policy, the modules do not support a Non-Approved mode of operation.

The notes below provide additional guidance and policies that must be followed by module operators: • Use of AES GCM: The module generates AES GCM IV in accordance with SP 800-38D in compliance with IG C.H scenario 1. The GCM IV generation in the TLS context follows RFC 5288 and SP 800-52rev2 section

3.3.1 and shall only be used for the TLS protocol version 1.2. The GCM IV generation in the IPsec context

follows RFC 4106 and RFC 7296 and shall only be used with IPsec and IKEv2 to be compliant with IG C.H. The implementation of the 64-bit nonce_explicit part of the IV is deterministic and management logic is inside the module. By the design of the module and by virtue of the data size limit (see above section Creating a Configuration for the Approved Mode of Operation) set, the maximum number possible value of 2^64 for nonce_explicit part of the IV is never reached. In case the module’s power is lost and then restored, the key used for the AES GCM encryption or decryption shall be re-distributed. • Use of PBKDF: The module implements key derivation through the SP 800-132 PBKDF2. The module supports option 1a from Section 5.4 of SP 800-132, whereby the MK is used directly as the DPK. Keys derived from passwords or passphrases are only used for data at rest. The length of the salt should be at least 128 bits and the length of the password or passphrase should be at least 10 characters, which provides the probability of guessing this password or passphrase to be (1/94)10. The caller shall observe all requirements and should consider all recommendations specified in SP 800-132 with respect to the strength of the generated key, including the quality of the password and the quality of the salt. Keys derived from passwords, as shown in SP 800-132, may only be used in storage applications. For encrypted private key entry as part of the configuration, the PBKDF2 iteration count must be between

1000 and 10000 to allow the recommended minimum in SP 800-132 while keeping performance the

impact small, and the passphrase must be at least 14 characters. • Use of insecure protocols – The following insecure protocols are disabled by default: SSH, Console Access, and WIFI Interfaces. The root password option is automatically disabled. To maintain compliance with FIPS requirements, these protocols and services shall not be enabled. • Network Component replacement – As noted earlier, the NGFW appliances are modular by design. The Network Components are field-replaceable. Operators in the field can order the desired Network Components directly from Forcepoint Customer Support using the appropriate part numbers. The CO must install the Network Components as described in section Hardware Setup above. Because these Network Components play a role in maintaining the module’s physical security, they are secured in place using tamper-evident labels. Thus, replacing a Network Component necessitates the replacement of any tamper-evident label affixed to the Network Component as well. When a CO orders Network Components, they must also order a Forcepoint NGFW FIPS kit with the Stock Keeping Unit ACFIPS3. The FIPS kit is delivered with the number of tamper-evident labels required for proper installation (see details per NGFW appliance in section Tamper-Evident Labels). Module operators must follow the guidance below to ensure continued compliance with FIPS requirements:

1. Zeroize all keys and CSPs on the module.
2. Remove power from the module.
3. Remove the Network Component to be replaced.
4. Remove any remaining bits of the now-broken tamper-evident label from the module chassis.
5. Install the replacement Network Component in the open slot.
6. Using a 99% isopropyl alcohol solution, clean the chassis surface in the area where the replacement tamper-evident label will be placed.
7. Affix the replacement tamper-evident label to the chassis (refer to section Tamper-Evident Labels for placements). Allow 24 hours for the seal to fully cure.
8. Apply power to the module

Forcepoint NGFW Installation Guide: https://help.forcepoint.com/docs/ngfw/v610/install/ngfw_6100_ig_a_en-us.pdf Forcepoint NGFW Product Guide: https://help.forcepoint.com/docs/ngfw/v610/mgmt/ngfw_6100_pg_a_en-us.pdf

Term

Definition

Appendix A. Acronyms and Abbreviations Appendix A. Acronyms and Abbreviations AES                             Advanced Encryption Standard ANSI                            American National Standards Institute API                             Application Programming Interface CBC                             Cipher Block Chaining CKG                             Cryptographic Key Generation CFB                             Cipher Feedback CMVP                            Cryptographic Module Validation Program CO                              Crypto Officer CSP                             Critical Security Parameter CTR                             Counter CVL                             Component Validation List DH                              Diffie-Hellman DRBG                            Deterministic Random Bit Generator ECB                             Electronic Code Book ECC                             Elliptic Curve Cryptography ECDH                            Elliptic Curve Diffie-Hellman ECDSA                           Elliptic Curve Digital Signature Algorithm FFC                             Finite Field Cryptography FIPS                            Federal Information Processing Standard GCM                             Galois Counter Mode HMAC                            Keyed-Hash Message Authentication Code IG                              Implementation Guidance

Term

Definition

Appendix A. Acronyms and Abbreviations ISO/IEC                         International Organization for Standardization / International Electrotechnical Commission I/O                             Input/Output IV                              Initialization Vector KAS                             Key Agreement Scheme KAT                             Known Answer Test KBKDF                           Key-Based Key Derivation Function KDF                             Key Derivation Function KTS                             Key Transport Scheme LED                             Light Emitting Diode MAC                             Message Authentication Code Mbps                            Megabits per second NIST                            National Institute of Science and Technology N/A                             Not Applicable OFB                             Output Feedback PBKDF                           Password Based Key Derivation Function PCT                             Pair-Wise Consistency Test PKCS                            Public-Key Cryptography Standards POST                            Power-on Self-Test RNG                             Random Number Generator RSA                             Rivest Shamir Adleman SHA                             Secure Hash Algorithm SSC                             Shared Secret Computation SSP                             Sensitive Security Parameter

Term

Definition

Appendix A. Acronyms and Abbreviations USB Universal Serial Bus