AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points

Certificate

Approved Algorithms (59)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C1["[high] Firmware / bootloader<br/>versions disclosed<br/>(identity, not provenance)<br/><i>ArubaOS 8.10.0.5-FIPS</i>"]
    C2["[high] Firmware update / recovery<br/>/ rollback services<br/><i>Update module firmware<br/>Update module firmware16<br/>Upgrade module firmware via the console port</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Self-test triggered by CO/User reboot</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>bootloader</i>"]
  end
  subgraph Inference["Derived inference"]
    I1["Component identity is<br/>disclosed, but provenance<br/>and patch lineage are not."]
    I2["Trusted code is reachable<br/>through update and<br/>recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R1["Do the vendor version<br/>strings obscure the<br/>upstream baseline, fork<br/>lineage, or known-CVE<br/>exposure?"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E1["SBOM / component baselines<br/>· patch and backport<br/>manifest · CVE disposition"]
    E2["update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C1 --> I1 --> R1 --> E1
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C1,C2,C3,C5,C6 clue;
  class I1,I2,I3,I5,I6 infer;
  class R1,R2,R3,R5,R6 risk;
  class E1,E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C1["[high] Firmware / bootloader versions disclosed (identity, not provenance)<br/><i>ArubaOS 8.10.0.5-FIPS</i><br/>src: certificate.firmwareVersions"]
    C2["[high] Firmware update / recovery / rollback services<br/><i>Update module firmware<br/>Update module firmware16<br/>Upgrade module firmware via the console port</i><br/>src: securityPolicy.services"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Self-test triggered by CO/User reboot</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>bootloader</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C1,C2,C3 clueHigh;
  class C5,C6 clueLow;

Security Policy, page by page

Non-Proprietary AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Document Version 1.0 October 2024 1| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary © 2024 Hewlett Packard Enterprise Company. Hewlett Packard Enterprise Company trademarks include , HPE Aruba Wireless Networks, HPE Aruba Networking, the registered HPE Aruba Networking the Mobile Edge Company logo, HPE Aruba Networking Mobility Management System, Mobile Edge trademarks are the property of their respective owners. HPE Aruba Networking is a Hewlett Packard Enterprise company. The resource assets in this firmware may include abbreviated and/or legacy terminology for HPE Aruba Networking products. See www.arubanetworks.com for current and complete HPE Aruba Networking product lines and names. Open Source Code Certain Hewlett Packard Enterprise Company products include Open Source software code developed by third parties, including software code subject to the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other Open Source Licenses. The Open Source code used can be found at this site: https://www.arubanetworks.com/open_source Legal Notice The use of Hewlett Packard Enterprise Company switching platforms and software or firmware, by all individuals or corporations, to terminate other vendors’ VPN client devices constitutes complete acceptance of liability by that individual or corporation for this action and indemnifies, in full, Hewlett Packard Enterprise Company, from vendors. Warranty This hardware product is protected by the standard HPE Aruba Networking warranty of one year parts/labor. For more information, refer to the ARUBACARE SERVICE AND SUPPORT TERMS AND CONDITIONS. Altering this device (such as painting it) voids the warranty. www.arubanetworks.com

San Jose, CA, USA 95002 Phone: 408.941.4300 2| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Contents 1.1 1.2 1.3 1.4 2.1 2.1.1 2.2 2.3 2.3.1 2.3.2 2.3.3 2.3.4 2.3.5 2.4 2.5 2.6 2.7 2.8 2.9 4.1 4.2 4.2.1 4.2.2 4.2.3 4.2.4 4.3 4.3.1 4.3.2 7.1 7.2 7.3 7.3.1 7.3.2 7.3.3 7.3.4 7.3.5 7.3.6 7.3.7 7.3.8 7.4 9.1 11.1 11.2 11.3 11.4 11.5 11.6 11.6.1 3| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary 11.6.2 11.6.3 11.7 11.8 11.8.1 11.9 Figures 4| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Tables Preface notice. Products identified herein contain confidential commercial firmware. Valid license required. Document Revision History The following table lists the history of the revisions of this document by version number and date of revision. Table 1

• Document Revision History 1.0 5|

This section describes:

• The purpose of this document.
• HPE Aruba Networking documents related to this document contents.
• Where to go for additional HPE Aruba Networking product information.
• Acronyms and abbreviations.
• The assurance security levels for each of the areas described in the FIPS 140-3 Standard.

This release supplement provides information regarding the HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 validation from HPE Aruba Networking. HPE Aruba Networking is a Hewlett Packard Enterprise company. The material in this supplement modifies the general HPE Aruba Networking hardware and firmware documentation included with this product and should be kept with your HPE Aruba Networking product documentation. This supplement primarily covers the non-proprietary Cryptographic Module Security Policy for the HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP655 Access Points with ArubaOS FIPS Firmware. This security policy describes how the Wireless Access Points (APs) meet the security requirements of FIPS 140-3 Level 2 and how to place and maintain the APs in the secure FIPS 140-3 mode. This policy was prepared as part of the FIPS 140-3 Level 2 validation of the product. FIPS 140-3 (Federal Information Processing Standards Publication 140-3, Security Requirements for Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. FIPS 140-3 aligns with ISO/IEC 19790:2012(E) and includes modifications of the Annexes that are allowed to the Cryptographic Module Validation Program (CMVP), as a validation authority. The testing for these requirements will be in accordance with ISO/IEC 24759:2017(E), with the modifications, additions or deletions of vendor evidence and testing allowed as a validation authority under paragraph 5.2. More information about the FIPS 140-3 standard and validation program is available on the National Institute of Standards and Technology (NIST) website at: https://csrc.nist.gov/projects/cryptographic-module-validation-program In addition, in this document, the HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points with ArubaOS FIPS Firmware are referred to as the Wireless Access Point, the AP, the module, the cryptographic module, HPE Aruba Networking Wireless Access Points, HPE Aruba Networking Wireless APs, HPE Aruba Networking Access Points, HPE Aruba Networking APs, and AP-5XX and AP-6XX Wireless APs.

More information is available from the following sources:

• See the HPE Aruba Networking web site for the full line of products from HPE Aruba Networking: https://www.arubanetworks.com
• The NIST Validated Modules web site contains contact information for answers to technical or sales-related questions for the product: https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search Enter HPE Aruba Networking in the Vendor field then select Search to see a list of FIPS validated HPE Aruba Networking products. Select the Certificate Number for the Module Name ‘HPE Aruba Networking AP-5xx and AP-6xx Access Points’. 6| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

AES AP CAVP CBC CCCS CLI CMVP CO CPSec CSE CSP ECO EMC EMI ESV FE GE GHz HMAC Hz IKE IPsec KAT KEK L2TP LAN LED PCT PSP SFTP SHA SNMP SSP SPOE TEL TFTP WLAN 7| Advanced Encryption Standard Access Point Cryptographic Algorithm Validation Program Cipher Block Chaining Canadian Centre for Cyber Security, a branch of CSE Command Line Interface Cryptographic Module Validation Program Crypto Officer Control Plane Security protected Communications Security Establishment Critical Security Parameter External Crypto Officer Electromagnetic Compatibility Electromagnetic Interference Entropy Source Validation Fast Ethernet Gigabit Ethernet Gigahertz Hashed Message Authentication Code Hertz Internet Key Exchange Internet Protocol security Known Answer Test Key Encryption Key Layer-2 Tunneling Protocol Local Area Network Light Emitting Diode Pairwise Consistency Test Public Security Parameter Secure File Transfer Protocol Secure Hash Algorithm Simple Network Management Protocol Sensitive Security Parameter Serial & Power Over Ethernet Tamper-Evident Label or seal Trivial File Transfer Protocol Wireless Local Area Network HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points and associated modules are intended to meet overall FIPS 140-3 Level 2 requirements as shown in the following table. Table 2

• Security Levels 8| N/A N/A N/A HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Purpose and Use: AP-655 Access Points (each also referred to as ‘the module’ and ‘AP’) are hardware type cryptographic modules with ArubaOS version 8.10 FIPS Firmware, all contained in hard, opaque plastic cases. Each under FIPS 140-3 Level 2 requirements. ArubaOS is the operating system for HPE Aruba Networking Mobility Conductors, Mobility Cryptographic services are provided by components of ArubaOS. An access point is a hardware device that creates a wireless local area network (WLAN), connects to a wired router, switch, or hub via an Ethernet cable, and projects a Wi-Fi signal to a designated area. See the diagram and tables below and in following sub-sections for AP details. Module Embodiment: Multiple-chip Standalone Module Characteristics: None

Each access point’s case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. Refer to section 2.3, Operating Environments, for information on each HPE Aruba Networking AP’s hardware, including the processor for each listed in Table 5, Cryptographic Module Tested Configurations. The cryptographic services available to each HPE Aruba Networking AP are provided by the following components: Table 3

• Cryptographic Components 1.0 3.3.1 1.0 1.0

Table 4

• Version Information 9| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The module contains a limited operational environment. The HPE Aruba Networking operating system runs on the HPE Aruba Networking access point hardware with cryptographic services provided by the ArubaOS operating system. See the following table of Cryptographic Module Tested Configurations for details. Only the versions that explicitly appear on the validation certificate are formally validated. Table 5

• Cryptographic Module Tested Configurations Note:
• For radio regulatory reasons, HPE Aruba Networking part numbers ending with -USF1 are to be sold in the US only. Part numbers ending with -RWF1 are considered ‘rest of the world’ and must not be used for deployment in the United States. From a FIPS perspective, both -USF1 and -RWF1 models are identical and fully FIPS 140-3 compliant. Tested Operational Environment’s Physical Perimeter (TOEPP): The physical perimeter is the production grade enclosure of the hardware chassis of the HPE Aruba Networking access point hardware devices. HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

This section introduces the HPE Aruba Networking AP-510 Series Campus Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-514 and AP-515 APs, their physical attributes, and their interfaces. Figure 1 - AP-514 Campus Access Point

• Front Figure 2 - AP-514 Campus Access Point
• Back Figure 3 - AP-515 Campus Access Point
• Front 11| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Figure 4 - AP-515 Campus Access Point

• Back With a maximum concurrent data rate of 4.8 Gbps in the 5 GHz band and 575 Mbps in the 2.4 GHz band (for an aggregate peak data rate of 3 Gbps), the 510 Series Access Points deliver high performance 802.11ax access for mobile and IoT devices in indoor environments for any enterprise environment. The high performance and high density 802.11ax 510 Series Access Points support all mandatory and several optional 802.11ax features, which include up- and downlink Orthogonal Frequency Division Multiple Access (OFDMA) with up to 16 resource units for increased user data rates and reduced latency, bi-directional MultiUser Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, 4x4 MIMO with up to four spatial streams (4SS) in the 5 GHz band and 2x2 MIMO with up to two spatial streams (2SS) in the 2.4 GHz band, channel bandwidths up to 160 MHz (in

5 GHz; 40 MHz in 2.4 GHz), and up to 1024-QAM modulation. Each AP supports up to 512 associated client

devices per radio and has a total of four dual band antennas. In addition to 802.11ax standard capabilities, the Wi-Fi 6 510 Series supports unique features like Aruba ClientMatch radio management and additional radios (Bluetooth 5 and Zigbee) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS 8 features like Aruba Activate and AirMatch with machine learning technology to automatically optimize the wireless network performance. The AP-514 has four (female) RP-SMA connectors for external dual band antennas (A0 through A3, corresponding with radio chains 0 through 3). The AP-515 has four integrated dual-band downtilt omnidirectional antennas for 4x4 MIMO with peak antenna gain of 4.2 dBi in 2.4 GHz and 7.5 dBi in 5 GHz. Builtin antennas are optimized for horizontal ceiling mounted orientation of the AP. The downtilt angle for maximum gain is roughly 30 degrees. Additionally, Advanced Cellular Coexistence (ACC) minimizes the impact of interference from 3G/4G LTE cellular networks, Dynamic Frequency Selection (DFS) maximizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-514 and AP-515 offer centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.1.1 Physical Description The HPE Aruba Networking AP-514 and AP-515 Campus Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support four integrated omni-directional downtilt antennas each. The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The Access Point configurations validated during the cryptographic module testing included:

• 12| AP-514 HW: AP-514-USF1 (HPE SKU Q9H68A) HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary

• 2.3.1.2 AP-515 HW: AP-515-USF1 (HPE SKU Q9H73A) Dimensions / Weight The AP has the following physical dimensions:
• 2.3.1.3
• 2.3.1.4 Dimensions/weight (AP-515 unit, excluding mount bracket):
• 200mm (W) x 200mm (D) x 46mm (H) / 7.9” (W) x 7.9” (D) x 1.8” (H)
• 810g / 28.5oz Dimensions/weight (AP-515; shipping):
• 230mm (W) x 220mm (D) x 72mm (H) / 9.1” (W) x 8.7” (D) x 2.8” (H)
• 1,010g / 35.5oz Environmental Operating:
• Temperature: 0° C to +50° C (+32° F to +122° F)
• Humidity: 5% to 93% non-condensing Storage and transportation:
• Temperature: -40° C to +70° C (-40° F to +158° F)
• Humidity: 5% to 93% non-condensing Interfaces The module provides the following network interfaces:
• E0: One HPE Smart Rate port (RJ-45, Auto-sensing link speed 100/1000/2500BASE-T and MDI/MDX)
• 802.3az Energy Efficient Ethernet (EEE)
• PoE-PD: 48 Vdc (nominal) 802.3af/at/bt POE (class 3 or higher) E1: One HPE Smart Rate port (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
• Link Aggregation (LACP) support between both network ports for redundancy and capacity
• 802.3az Energy Efficient Ethernet (EEE) Antenna interfaces:
• 802.11a/b/g/n/ac/ax four external antenna (AP-514) or four internal antenna (AP-515) DC power interface:
• 12Vdc nominal, +/- 5% 2.1mm/5.5mm center-positive circular plug with 9.5-mm length USB 2.0 host interface (Type A connector) Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio:
• 13| Bluetooth 5.0: up to 8dBm transmit power (class 1) and -95dBm receive sensitivity Zigbee: up to 8dBm transmit power and -97dBm receive sensitivity HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Other Interfaces:

• Visual indicators (two multi-color LEDs): for System and Radio status Reset button: factory reset (during device power up) Serial console interface (proprietary; optional adapter cable available; disabled in Approved mode) Figure 5 - AP-510 Series Campus Access Point
• Interfaces Table 6 - AP-510 Series Status Indicator LEDs 14| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

This section introduces the HPE Aruba Networking AP-530 Series Campus Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-534 and AP-535 APs, their physical attributes, and their interfaces. Figure 6 - AP-534 Campus Access Point

• Front Figure 7 - AP-534 Campus Access Point
• Back Figure 8 - AP-535 Campus Access Point
• Front 15| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Figure 9 - AP-535 Campus Access Point

• Back With a maximum concurrent data rate of 2.4 Gbps in the 5 GHz band and 1,150 Mbps in the 2.4 GHz band (for an aggregate peak data rate of 3.55 Gbps), the 530 Series Access Points deliver high performance 802.11ax access for mobile and IoT devices in indoor environments for any enterprise environment. The high performance and high density 802.11ax 530 Series Access Points support all mandatory and several optional 802.11ax features, which include up- and downlink Orthogonal Frequency Division Multiple Access (OFDMA) with up to 37 resource units for increased user data rates and reduced latency, up- and downlink Multi-User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, 4x4 MIMO with up to four spatial streams (4SS) in both the 5 GHz and 2.4 GHz bands, channel bandwidths up to 160 MHz (in 5 GHz; 40 MHz in 2.4 GHz), and up to 1024-QAM modulation. Each AP supports up to 1,024 associated client devices per radio and has a total of four dual band antennas. In addition to 802.11ax standard capabilities, the Wi-Fi 6 530 Series supports unique features like Aruba ClientMatch radio management and additional radios (Bluetooth 5 and Zigbee) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS 8 features like Aruba Activate and AirMatch with machine learning technology to automatically optimize the wireless network performance. The AP-534 has four (female) RP-SMA connectors for external dual band antennas (A0 through A3, corresponding with radio chains 0 through 3). The AP-535 has four integrated dual-band downtilt omnidirectional antennas for 4x4 MIMO with peak antenna gain of 3.5 dBi in 2.4 GHz and 5.4 dBi in 5 GHz. Built-in antennas are optimized for horizontal ceiling mounted orientation of the AP. The downtilt angle for maximum gain is roughly 30 degrees. Additionally, Advanced Cellular Coexistence (ACC) minimizes the impact of interference from 3G/4G LTE cellular networks, Dynamic Frequency Selection (DFS) maximizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-534 and AP-535 offer centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.2.1 Physical Description The HPE Aruba Networking AP-534 and AP-535 Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support four integrated omni-directional downtilt antennas each. The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The Access Point configuration validated during the cryptographic module testing included:
• 16| AP-534 HW: AP-534-USF1 (HPE SKU JZ342A) AP-535 HW: AP-535-USF1 (HPE SKU JZ347A) HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary 2.3.2.2 Dimensions / Weight The AP has the following physical dimensions:

• 2.3.2.3
• 2.3.2.4 Dimensions/weight (AP-535 unit, excluding mount bracket):
• 240mm (W) x 240mm (D) x 57mm (H) / 9.4” (W) x 9.4” (D) x 2.1” (H)
• 1,270g / 44.8oz Dimensions/weight (AP-535; shipping):
• 285mm (W) x 300mm (D) x 105mm (H) / 11.2” (W) x 11.9” (D) x 4.1” (H)
• 1,930g / 68.1oz Environmental Operating:
• Temperature: 0° C to +50° C (+32° F to +122° F)
• Humidity: 5% to 93% non-condensing Storage and transportation:
• Temperature: -40° C to +70° C (-40° F to +158° F)
• Humidity: 5% to 93% non-condensing Interfaces The module provides the following network interfaces:
• E0: One HPE Smart Rate port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX)
• 802.3az Energy Efficient Ethernet (EEE)
• PoE-PD: 48 Vdc (nominal) 802.3at/bt POE (class 4 or higher) E1: One HPE Smart Rate port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX)
• Link Aggregation (LACP) support between both network ports for redundancy and capacity
• 802.3az Energy Efficient Ethernet (EEE)
• PoE-PD: 48 Vdc (nominal) 802.3at/bt POE (class 4 or higher) Antenna interfaces:
• 802.11a/b/g/n/ac/ax four external antenna (AP-534) or four internal antenna (AP-535) DC power interface:
• 48Vdc nominal, +/- 5% 1.35mm/3.5mm center-positive circular plug with 9.5-mm length USB 2.0 host interface (Type A connector) Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio:
• Bluetooth 5.0: up to 8dBm transmit power (class 1) and -95dBm receive sensitivity Zigbee: up to 8dBm transmit power and -99dBm receive sensitivity Other Interfaces:
• 17| Visual indicators (two multi-color LEDs): for System and Radio status Reset button: factory reset (during device power up) Serial console interface (proprietary; optional adapter cable available; disabled in Approved mode) HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Figure 10 - AP-530 Series Campus Access Point

• Interfaces Table 7 - AP-530 Series Status Indicator LEDs 18| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

This section introduces the HPE Aruba Networking AP-580 Series Outdoor Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-584, AP-585 and AP-587 APs, their physical attributes, and their interfaces. Figure 11 - AP-585 Outdoor Access Point

• Side Figure 12 - AP-584 Outdoor Access Point
• Bottom (without cover) Figure 13 - AP-585 Outdoor Access Point
• Top Figure 14 - AP-587 Outdoor Access Point
• Rear With a maximum concurrent data rate of 2.4 Gbps in the 5 GHz band and 574 Mbps in the 2.4 GHz band (for an aggregate peak data rate of 2.97 Gbps), the AP-580 Series Access Points deliver 802.11ax Gigabit Wi-Fi

6 performance to large scale outdoor environments including universities, large enterprises, and industrial

applications. Weatherproofed, and temperature hardened to survive in the harshest outdoor environments, the 580 Series APs withstand exposure to extreme high and low temperatures, persistent moisture, and precipitation, and are fully sealed to keep out airborne contaminants. All electrical interfaces include industrial surge protection and are IP66/67 certified. 19| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary The high performance and high density 802.11ax 580 Series Access Points support all mandatory and several optional 802.11ax features, which include Uplink and Downlink Orthogonal Frequency Division Multiple Access (OFDMA) for increased user data rates and reduced latency, bi-directional Multi-User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, dual-radio 4x4 MIMO with up to four spatial streams (4SS) in 5 GHz and 4x4 with up to four spatial streams (4SS) in 2.4 GHz, and up to 1024-QAM modulation. Each AP supports up to 1,024 associated client devices per radio and up to 16 BSSIDs per radio. The AP-584 has a total of five Nf connectors for external antennas (four external dual band antennas and one BT antenna), the AP-585 has four internal dualband omni-directional antennas for 4x4 MIMO in 2.4 GHz with peak antenna gain of 4.4 dBi and 4x4 MIMO in

5 GHz with peak antenna gain of 5.8 dBi plus a BT antenna with 4.8 dBi, and the AP-587 has four internal

dual-band directional antennas for 4x4 MIMO in 2.4 GHz with peak antenna gain of 5.8 dBi and 4x4 MIMO in

5 GHz with peak antenna gain of 6.6 dBi plus a BT antenna with 6.3 dBi. In addition to 802.11ax standard

capabilities, the Wi-Fi 6 AP-580 Series supports unique features like Aruba ClientMatch radio management and an additional radio (Bluetooth Low-Energy (BLE)) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS 8+ features like Aruba Activate and Air Slice with machine learning technology to automatically optimize the wireless network performance. Additionally, Aruba Advanced Cellular Coexistence (ACC) minimizes the impact of interference from cellular networks, distributed antenna systems (DAS), and commercial small cell or femtocell equipment, plus Dynamic Frequency Selection (DFS) maximizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-580 Series APs offer centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.3.1 Physical Description The HPE Aruba Networking AP-584, AP-585 and AP-587 Outdoor Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support both external antennas (AP-584) and internal integrated omni-directional antennas (AP-585 and AP-587). The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The AP-580 Series Access Points configurations validated during the cryptographic modules testing included:

• 2.3.3.2 AP-584 HW: AP-584-US TAA (HPE SKU R7T14A) AP-584 HW: AP-584-RW TAA (HPE SKU R7T15A) AP-585 HW: AP-585-US TAA (HPE SKU R7T19A) AP-585 HW: AP-585-RW TAA (HPE SKU R7T20A) AP-587 HW: AP-587-US TAA (HPE SKU R7T24A) AP-587 HW: AP-587-RW TAA (HPE SKU R7T25A) Dimensions / Weight The AP-580s have the following physical dimensions (with aesthetic cover):
• 20| Dimensions/weight (AP-584 unit, excluding mount bracket):
• 324mm (W) x 312mm (D) x 244mm (H) / 12.6” (W) x 12.3” (D) x 9.6” (H)
• 5.52 kg / 11.5 lbs Dimensions/weight (AP-585 unit, excluding mount bracket):
• 324mm (W) x 313mm (D) x 320mm (H) / 12.6” (W) x 12.3” (D) x 12.7” (H)
• 5.24 kg / 11.5 lbs Dimensions/weight (AP-587 unit, excluding mount bracket):
• 302mm (W) x 300mm (D) x 174mm (H) / 11.9” (W) x 11.8” (D) x 6.9” (H)
• 4.51 kg / 9.9 lbs HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary 2.3.3.3

• 2.3.3.4 Environmental Operating:
• Temperature: -40° C to +65° C (-40° F to +149° F)
• Humidity: 5% to 93% non-condensing Storage and transportation:
• Temperature: -40° C to +70° C (-40° F to +158° F)
• Humidity: 5% to 93% non-condensing Interfaces Each module provides the following wired network interfaces:
• E0/POE+: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX)
• 5Gbps Smart Rate: NBase-T and 802.3bz
• 802.3az Energy Efficient Ethernet (EEE)
• Support for jumbo frames (MTU up to 9,216 bytes) Uplink
• PoE-PD: 802.3bt class 6/5, 802.3af/at class 4 POE E1/SFP+: SFP+ port (10GBASE-R SFP+)
• 802.3az Energy Efficient Ethernet (EEE)
• Support for jumbo frames (MTU up to 9,216 bytes) Uplink/Downlink E2/PSE: Ethernet port (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
• 802.3az Energy Efficient Ethernet (EEE)
• Support for jumbo frames (MTU up to 9,216 bytes) Downlink
• PoE-PSE: 802.3af/at POE AC power interface:
• 100-240V 50/60Hz AC (power cord or power connector kit sold separately) Antenna interfaces:
• 802.11a/b/g/n/ac/ax five external antenna (AP-584) or four (AP-585 and AP-587) internal antenna USB-C console port Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio:
• Bluetooth 5.0: up to 8dBm transmit power (class 2) and -98dBm receive sensitivity Zigbee: up to 8dBm transmit power and -96dBm receive sensitivity Other Interfaces:
• Visual indicator (one multi-color LED on front): for System and Radio status Reset button: factory reset (during device power up) or LED Toggle On/Off (during normal operation) Serial console interface (proprietary; adapter cable included in package; disabled in Approved mode) Grounding Point Figure 15 - AP-584 Outdoor Access Point
• Interfaces (with aesthetic cover) 21| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Figure 16 - AP-585 Outdoor Access Point

• Interfaces (with aesthetic cover) Figure 17 - AP-587 Outdoor Access Point
• Interfaces (with aesthetic cover) Table 8 - AP-580 Series Status Indicator LEDs 22| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

This section introduces the HPE Aruba Networking AP-630 Series Campus Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-635 APs, their physical attributes, and their interfaces. Figure 18 - AP-635 Campus Access Point

• Front Figure 19 - AP-635 Campus Access Point
• Back With a maximum concurrent data rate of 1.2 Gbps in the 5 GHz band, 574 Mbps in the 2.4 GHz band, and

2.4 Gbps in the 6 GHz band (for an aggregate peak data rate of 3.9 Gbps), the 630 Series Access Points

deliver more wireless capacity and/or wider channels with less interference in indoor environments for any enterprise environment. The 630 Series Access Points with Wi-Fi 6E can better support low-latency, bandwidth hungry applications like high-definition video and artificial reality/virtual reality applications while using comprehensive tri-band coverage to meet the growing demands of Wi-Fi from increased use of video, growth in client and IoT devices, and expanded use of cloud. The AP-635 APs support 802.11ax features which include Orthogonal Frequency Division Multiple Access (OFDMA) with up to 37 resource units for increased user data rates and reduced latency, Multi-User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, 2x2 MIMO with up to two spatial streams (2SS) in all three bands, channel bandwidths up to 160 MHz (in 6 GHz; 80 MHz in 5GHz, and 20 MHz in 2.4 GHz), and up to 1024-QAM modulation. Each AP supports up to 512 associated client devices per radio and has a total of four dual band antennas. In addition to 802.11ax standard capabilities, the Wi-Fi 6E 630 Series supports unique features like Aruba ClientMatch radio management and an additional radio (for Bluetooth 5 and Zigbee) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS features like Air Slice and AirMatch with machine learning technology to automatically optimize the wireless network performance. The AP-635 has four integrated dual-band downtilt omni-directional antennas for 2x2 MIMO with peak antenna gain of 4.6 dBi in 2.4 GHz, 7.0 dBi in 5 GHz, and 6.3 dBi in 5 GHz. Built-in antennas are optimized for horizontal ceiling mounted orientation of the AP. The downtilt angle for maximum gain is roughly 30 to 40 degrees. Also, the BLE5.0 / Zigbee radio uses an integrated omnidirectional antenna with roughly 30 to 40 degrees downtilt and peak gain of 3.0 dBi. 23| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Additionally, Advanced Cellular Coexistence (ACC) minimizes the impact of interference from cellular networks, Dynamic Frequency Selection (DFS) optimizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-635 offers centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.4.1 Physical Description The HPE Aruba Networking AP-635 Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain

802.11 a/b/g/n/ac/ax transceivers and support four integrated omni-directional downtilt antennas.

The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The Access Point configuration validated during the cryptographic module testing included:

• 2.3.4.2 AP-635 HW: AP-635-US TAA (HPE SKU R7J33A) AP-635 HW: AP-635-RW TAA (HPE SKU R7J32A) Dimensions / Weight The AP has the following physical dimensions:
• 2.3.4.3
• 2.3.4.4 Dimensions/weight (AP-635 unit, excluding mount bracket):
• 220mm (W) x 220mm (D) x 51mm (H) / 8.7” (W) x 8.7” (D) x 2.0” (H)
• 1,300g / 45.9oz Dimensions/weight (AP-635; shipping):
• 250mm (W) x 240mm (D) x 85mm (H) / 9.8” (W) x 9.4” (D) x 3.3” (H)
• 1,650g / 58.2oz Environmental Operating:
• Temperature: 0° C to +50° C (+32° F to +122° F)
• Humidity: 5% to 95% non-condensing Storage and transportation:
• Temperature: -40° C to +70° C (-40° F to +158° F)
• Humidity: 5% to 95% non-condensing Interfaces The module provides the following network interfaces:
• E0: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500BASE-T and MDI/MDX)
• 2.5Gbps speeds comply with NBase-T and 802.3bz
• 802.3az Energy Efficient Ethernet (EEE)
• PoE-PD: 48 Vdc (nominal) 802.3at/bt POE (class 4 or higher) E1: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500BASE-T and MDI/MDX)
• Link Aggregation (LACP) support between both network ports for redundancy and capacity
• 2.5Gbps speeds comply with NBase-T and 802.3bz
• 802.3az Energy Efficient Ethernet (EEE)
• PoE-PD: 48 Vdc (nominal) 802.3at/bt POE (class 4 or higher) Antenna interfaces:
• 802.11a/b/g/n/ac/ax four internal antenna (AP-635) DC power interface:
• 12Vdc nominal, +/- 5% 2.1mm/5.5mm center-positive circular plug with 9.5-mm length USB 2.0 host interface (Type A connector) 24| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio:

• Bluetooth 5.0: up to 5dBm transmit power (class 1) and -100dBm receive sensitivity Zigbee: up to 5dBm transmit power and -97dBm receive sensitivity Other Interfaces:
• Visual indicators (four multi-color LEDs): for System (1) and Radio (3) status Reset button: factory reset (during device power up) or LED Toggle On/Off (during normal operation) Serial console interface (proprietary; optional adapter cable available; disabled in Approved mode) Figure 20 - AP-630 Series Campus Access Point
• Interfaces Table 9 - AP-630 Series Status Indicator LEDs 25| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

This section introduces the HPE Aruba Networking AP-650 Series Campus Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-655 APs, their physical attributes, and their interfaces. Figure 21 - AP-655 Campus Access Point

• Front Figure 22 - AP-655 Campus Access Point
• Back With a maximum concurrent data rate of 2.4 Gbps in the 5 GHz band, 574 Mbps in the 2.4 GHz band, and 4.8 Gbps in the 6 GHz band (for an aggregate peak data rate of 7.8 Gbps), the 650 Series Access Points deliver comprehensive tri-band coverage to meet the growing demands of Wi-Fi due to increased use of video, growth in client and IoT devices, and expanded use of cloud in indoor environments for any growing enterprise environment. The very high performance and extreme density 802.11ax 650 Series Access Points support 802.11ax features, which include up- and downlink Orthogonal Frequency Division Multiple Access (OFDMA) with up to 37 resource units for increased user data rates and reduced latency, up- and downlink Multi-User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, 4x4 MIMO with up to four spatial streams (4SS) in each of the 2.4, 5 and 6 GHz bands, channel bandwidths up to 160 MHz (in 6 GHz, 80 MHz in 5 GHz, and 20 MHz in 2.4 GHz), and up to 1024-QAM modulation. Each AP supports up to 1,024 associated client devices per radio and has eight internal dual band antennas. In addition to 802.11ax standard capabilities, the Wi-Fi 6E 650 Series supports unique features like Aruba ClientMatch radio management and additional radios (Bluetooth 5 and Zigbee) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS features like Aruba Air Slice and AirMatch with machine learning technology to automatically optimize the wireless network performance. The AP-655 has eight integrated dual-band downtilt omni-directional antennas for 4x4 MIMO with peak antenna gain of 4.8 dBi in 2.4 GHz, 5.3 dBi in 5GHz, and 5.4 dBi in 6GHz. Built-in antennas are optimized for horizontal ceiling mounted orientation of the AP. The downtilt angle for maximum gain is roughly 30 to 40 degrees. Also, the BLE5.0 / Zigbee radio uses an integrated omnidirectional antenna with roughly 30 to 40 degrees downtilt and peak gain of 3.6 dBi. 26| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Additionally, Advanced Cellular Coexistence (ACC) minimizes the impact of interference from cellular networks, Dynamic Frequency Selection (DFS) optimizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-650 Series APs offer centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.5.1 Physical Description The HPE Aruba Networking AP-655 Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support eight integrated omni-directional downtilt antennas. The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The Access Point configuration validated during the cryptographic module testing included:

• 2.3.5.2 AP-655 HW: AP-555-US TAA (HPE SKU R7J44A) AP-655 HW: AP-555-RW TAA (HPE SKU R7J43A) Dimensions / Weight The AP has the following physical dimensions:
• 2.3.5.3
• 2.3.5.4 Dimensions/weight (AP-655 unit, excluding mount bracket):
• 260mm (W) x 260mm (D) x 60mm (H) / 10.2” (W) x 10.2” (D) x 2.4” (H)
• 1,800g / 63.5oz Dimensions/weight (AP-655; shipping):
• 285mm (W) x 285mm (D) x 95mm (H) / 11.2” (W) x 11.2” (D) x 3.7” (H)
• 2,300g / 81.1oz Environmental Operating:
• Temperature: 0° C to +50° C (+32° F to +122° F)
• Humidity: 5% to 95% non-condensing Storage and transportation:
• Temperature: -40° C to +70° C (-40° F to +158° F)
• Humidity: 5% to 95% non-condensing Interfaces The module provides the following network interfaces:
• E0: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX)
• 2.5Gbps and 5Gbps speeds comply with NBase-T and 802.3bz
• 802.3az Energy Efficient Ethernet (EEE)
• PoE-PD: 48 Vdc (nominal) 802.3af/at/bt POE (class 3 or higher) E1: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX)
• Link Aggregation (LACP) support between both network ports for redundancy and capacity
• 2.5Gbps and 5Gbps speeds comply with NBase-T and 802.3bz
• 802.3az Energy Efficient Ethernet (EEE)
• PoE-PD: 48 Vdc (nominal) 802.3af/at/bt POE (class 3 or higher) Antenna interfaces:
• 802.11a/b/g/n/ac/ax eight internal antenna (AP-655) DC power interface:
• 12Vdc nominal, +/- 5% 2.1mm/5.5mm center-positive circular plug with 9.5-mm length USB 2.0 host interface (Type A connector) 27| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio:

• Bluetooth 5.0: up to 6dBm transmit power (class 1) and -101dBm receive sensitivity Zigbee: up to 6dBm transmit power and -99dBm receive sensitivity Other Interfaces:
• Visual indicators (four multi-color LEDs): for System (1) and Radio (3) status Reset button: factory reset (during device power up) or LED Toggle On/Off (during normal operation) Serial console interface (proprietary; optional adapter cable available; disabled in Approved mode) Figure 23 - AP-650 Series Campus Access Point
• Interfaces Table 10 - AP-650 Series Status Indicator LEDs

There are no excluded components for the module. 28| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Table 11

• Modes List and Description NonApproved Notes:
• Mode Disabled) requires the operator of the module to zeroize and reboot the module.
• The module does not support a degraded mode of operation.
• An un-provisioned AP, which by default does not serve any wireless clients, is out of scope of this validation. The Crypto Officer must ensure that the Wireless Access Point is kept in the Approved mode of operation. The firmware in each module contains the following cryptographic algorithm implementations that will be
• ArubaOS OpenSSL Module algorithm implementation Aruba Jitterentropy algorithm implementation ArubaOS Crypto Module algorithm implementation ArubaOS Bootloader Module algorithm implementation Table 12
• Approved Algorithms - ArubaOS OpenSSL Module N/A Affirmed 1 Resulting symmetric keys and seeds used for asymmetric key generation are unmodified output from SP 800-90A Rev1 DRBG. 29| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary N/A (2)) No parts of the IKEv1 protocol, other than the approved cryptographic algorithms and KDF, have been tested by the CAVP and CMVP. 30| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary AES-GCM 6 Table 13 - Approved Algorithms - Aruba CPU Jitter Entropy Source Table 14 - Approved Algorithms - ArubaOS Crypto Module CBC, GCM 8 AES-GCM is an authenticated encryption algorithm that is approved for use in key transport per FIPS 140-3 IG D.G. This key establishment methodology provides 128 or 256 bits of encryption strength. AES-CBC combined with HMAC is approved for use in key transport per FIPS 140-3 IG D.G. This key establishment methodology provides between 128 and 256 bits of encryption strength. AES GCM IV generation is performed in compliance with IG C.H, Scenario 2. The IV is generated internally and randomly using the Approved DRBG that is internal to the module’s boundary and has a length of 96 bits. No parts of the IKEv2 protocol, other than the approved cryptographic algorithms and KDF, have been tested by the 31| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary AES-GCM 12 AES-CBC 13 Table 15 - Approved Algorithms - ArubaOS Bootloader Module AES-GCM is an authenticated encryption algorithm that is approved for use in key transport per FIPS 140-3 IG D.G. This key establishment methodology provides 128 or 256 bits of encryption strength. AES-CBC combined with HMAC is approved for use in key transport per FIPS 140-3 IG D.G. This key establishment methodology provides between 128 and 256 bits of encryption strength. 32| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Operation The cryptographic module implements no non-Approved algorithms allowed for use in the Approved The cryptographic module implements the following non-Approved algorithms allowed in the Approved Table 16

• Non-Approved Algorithms Allowed in the Approved Mode of Operation The cryptographic module implements the following non-Approved algorithms that are not permitted for Table 17
• Non-Approved Algorithms Not Allowed in the Approved Mode of Operation 33| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary passing over the five (5) logical interfaces defined by FIPS 140-3. Notes:

• The module distinguishes between different forms of data, control, and status traffic over the network ports by analyzing the packets header information and contents.
• The Console port is disabled when operating in Approved mode by a Tamper-Evident Label (TEL) or seal.
• The reset button resets the AP to factory default settings. Figure 24 –AP Physical and Cryptographic Boundaries with Interfaces and Components Block Diagram 34| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The following section lists the roles supported by the module, authentication mechanisms used by the module, and

The module supports the role-based authentication of Crypto Officer, User, and Wireless Client; no additional roles (e.g. Maintenance) are supported. Administrative operations carried out by the HPE Aruba Networking Mobility Controller or Mobility Conductor map to the Crypto Officer role. The Crypto Officer has the ability to configure, manage, and monitor the module, including the configuration, loading, and zeroization of SSPs. Configuration can be performed through a standalone Mobility Controller or by a Mobility Conductor if deployed in the environment. The Mobility Conductor also acts as a CO for the APs. The module supports multiple concurrent operators and internally maintains the separation of the roles assumed by each operator and the corresponding services. Refer to the section 4.2, Authentication below for details on the roles’ sessions authentication. Mobility Controller 14 APs must be deployed in a controller-based network running ArubaOS. For APs to be deployed in a controllerless network, refer to the most recent Aruba Instant NIST CMVP validation for guidance on Approved modes. 35| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary The defining characteristics of the roles depend on whether the module is configured in one of the four (4) AP configurations listed in the table below. If the AP is configured via corresponding HPE Aruba Networking Mobility Controllers that are in Approved mode and have been validated against FIPS 140-3 requirements, then the 36| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary

• To change AP configurations requires the module to be zeroized and rebooted before the module is in the new AP configuration in Approved mode.

The CO must follow the guidance below in section 11.6, Secure Operation, and in the ArubaOS 8.10 User Guide section titled Controller-based AP with AP Console Access to ensure the configured HPE Aruba operation, and is running the Approved version of ArubaOS (see the following subsections for details on the Once the AP is provisioned to be managed by the Controller, during any subsequent reboots of the AP, the AP boot process will continue automatically to boot the Approved version of ArubaOS (with the appropriate self-tests run) and the AP will be placed in the provisioned AP configuration by the Controller.

configurations, the HPE Aruba Networking Mobility Controller or Mobility Conductor implements the Crypto Crypto Officer’s authentication is accomplished via either Pre-shared secret (IKEv1), RSA digital certificate (IKEv1/IKEv2) or ECDSA digital certificate (IKEv2). The Mobility Conductor interacts with the APs through the Mobility Controller through provisioning of configurations.

the same IKEv1 pre-shared key or RSA/ECDSA certificate that is used by the Crypto Officer. With the module in the Approved mode of operation, the wireless client role (defined in each of the four (4) configurations are not permitted in Approved mode. When a Remote AP cannot communicate with the 37| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary The following table describes the relative strength of each supported authentication mechanism. Each authentication mechanism has been designed such that:

• Table 21
• Roles and Authentication As per SP 800-63B, in Approved mode the module checks and enforces a minimum password length of eight (8). 38| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The module provides various services depending on role. These are described in the sections below.

• G
• Generate The module generates or derives the SSP.
• R
• Read The Key/SSP is read from the module (e.g. the Key/SSP is output).
• W
• Write
• E
• Execute The module uses the Key/SSP in performing a cryptographic operation.
• Z
• Zeroize

All Crypto Officer role services are the same for the module in the Approved mode of operation and the AP in any of the four (4) AP configurations - Remote AP configuration, CPSec protected AP configuration, Mesh Portal AP configuration, and Mesh Point AP configuration. The User role for Remote AP configuration and Control Plane Security (CPSec) Protected AP configuration supports the same services as the Crypto Officer role services. The User role for Mesh Portal AP configuration and Mesh Point AP configuration supports the same services as the Wireless Client role services. All Wireless Client role services are the same for the module in the Approved mode of operation and the AP in any of the four (4) AP configurations - Remote AP configuration, CPSec protected AP configuration, Mesh Portal AP configuration, and Mesh Point AP configuration. Table 22

• Approved Services firmware 16 User 17 E Any firmware loaded into this module that is not shown on the module certificate is out of the scope of this validation and requires a separate FIPS 140-3 validation. Remote AP and Control Plane Security (CPSec) Protected AP configurations only. 39| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary User 18 User 20 W W E E W W W E E G/E G/E G/E G/E E E G/E G/E G/E G/E ). Remote AP and Control Plane Security (CPSec) Protected AP configurations only. This service is only applicable in the Mesh Portal AP and Mesh Point AP configurations. It is not applicable in Remote AP and Control Plane Security (CPSec) Protected AP configurations. Mesh Portal AP configuration and Mesh Point AP configuration only. 40| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary User 22 User 23, E G/E G/E G/E G/E G/R/W/E G/E G/E G/R/W/E G/E W/E G/E G/E G/E G/E G/E G/E G/E E R/W/E E R/W/E E will be between the Mesh Portal and the controller, not the Mesh Point and the controller. 41| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary User 24 Remote AP and Control Plane Security (CPSec) Protected AP configurations only. 42| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary User 25, User 26 Z

The following table lists non-Approved services available in non-Approved mode (FIPS Settings: Mode Disabled). To indicate if the module is in Approved mode or non-Approved mode, issue the CLI command show fips (see Modes of Operation section above). To change from Approved mode (FIPS Settings: Mode Enabled) to non-Approved mode (FIPS Settings: Mode Disabled) requires the operator of the module to zeroize and reboot the module. The module does not support a degraded mode of operation. An un-provisioned AP, which by default does not serve any wireless clients, is out of scope of this validation. The Crypto Officer must ensure that the Wireless Access Point is kept in the Approved mode of operation. All of the Approved services (see Table 22 and Table 23 above) that are available in Approved mode are also available in non-Approved mode. Mesh Portal AP configuration and Mesh Point AP configuration only. Remote AP and Control Plane Security (CPSec) Protected AP configurations only. 43| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Table 24

• Non-Approved Services User 27 Note:
• For additional information on services offered by the module, please refer to the ArubaOS 8.10 User Guide. Remote AP and Control Plane Security (CPSec) Protected AP configurations only. 44| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The module only allows the loading of trusted and verified firmware that is signed by HPE Aruba Networking within the module’s defined cryptographic boundary. Any firmware loaded into this module that is not shown on the module certificate is out of the scope of this validation and requires a separate FIPS 140-3 validation. HPE Aruba Networking firmware in electronic form is installed by HPE Aruba Networking technical support personnel or downloaded from the HPE Networking Support Portal (NSP) by authenticated licensed customer personnel. ArubaOS (in executable binary format) is the operating system for the HPE Aruba Networking hardware-based HPE Aruba Networking Mobility Conductors, Mobility Controllers, Gateways, and controller-managed Access Points (APs). ArubaOS (in OVA File format) is also the operating system for the HPE Aruba Networking virtual-based HPE Aruba Networking Mobility Controller Virtual Appliances and Mobility Conductor Virtual Appliances. Within the same version of ArubaOS (e.g. ArubaOS version 8.10), all features are the same, but there are components of ArubaOS that are appropriate for different hardware-based or virtual-based HPE Aruba Networking devices, which is why there are different ArubaOS executable binary formats for the same ArubaOS version available. The HPE Aruba Networking ArubaOS Bootloader Module is preloaded and shipped with each HPE Aruba Networking AP device and is executed to boot the ArubaOS operating system from the image partition after performing the firmware integrity test. Rebooting also zeroizes all SSPs prior to execution of the newly loaded firmware. The operator can initiate the firmware integrity test on demand by rebooting the module. The module performs a firmware integrity test when powered on and conditionally whenever a firmware load request is received (refer below to section 10, Self-Tests for details). Both the Firmware Integrity Test and Firmware Load Test use RSA PKCS#1 v1.5 (2048 bits) signature verification with SHA2-256. All data output via the data output interface is inhibited until the software/firmware loading and load test has completed successfully. If the firmware integrity test fails, the module enters the error state (while in this state, the module provides no functionality). The temporary values generated during the firmware integrity test are zeroized upon completion of the integrity test. The operator can determine the version of the loaded firmware through reviewing the log after the firmware upgrade and by using the show status CLI command (use the link in section 1.8, Full Documentation to refer to ArubaOS 8.10 Command-Line Interface Reference Guide and ArubaOS 8.10 User Guide).

The module operates in a non-modifiable operational environment. The control plane Operating System (OS) is Linux, a real-time, multi-threaded operating system that supports memory protection between processes. Access to the underlying Linux implementation is not provided directly. Only HPE Aruba Networking provided interfaces are used, and the Command Line Interface (CLI) is a restricted command set. These operating control mechanisms protect against unauthorized execution, unauthorized modification, and unauthorized reading of SSPs, control and status data. The module only allows the loading of trusted and verified firmware that is signed by HPE Aruba Networking. Any firmware loaded into this module that is not shown on the module certificate is out of the scope of this validation and requires a separate FIPS 140-3 validation. The module was tested on the platforms listed above in section 2.3, Table 5, Cryptographic Module Tested Configurations. 45| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The HPE Aruba Networking Wireless Access Point is a scalable, multiple-chip standalone network device and is enclosed in a hard, opaque plastic case. The AP enclosure is resistant to probing (please note that this feature has not been validated as part of the FIPS 140-3 validation) and is opaque within the visible spectrum. The enclosure of the AP has been designed to satisfy FIPS 140-3 Level 2 physical security requirements. The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points require Tamper-Evident Labels (TELs) (also known as seals) to allow the detection of the opening of the device and to block the Serial console port. To protect the Access Points (APs) from any tampering with the product, TELs should be applied by the Crypto Officer as covered in the sections below. When applied properly, the TELs allow the Crypto Officer to detect the opening of the device, or physical access to restricted ports like the serial console port (on the bottom of the device). HPE Aruba Networking provides FIPS 140-3 designated TELs which have met the physical security testing requirements for tamper evident labels under the FIPS 140-3 Standard. TELs are not endorsed by the Cryptographic Module Validation Program (CMVP). The tamper-evident labels shall be installed for the module to operate in the Approved mode of operation. HPE Aruba Networking provides double the required amount of TELs. If a customer requires replacement TELs, please call customer support and HPE Aruba Networking will provide the TELs. The Crypto officer shall be responsible for securing the extra TELs at a safe location and managing the use of the TELs.

Once applied, the TELs included with the Wireless Access Point cannot be surreptitiously broken, removed, or reapplied without an obvious change in appearance: Figure 25 - Tamper-Evident Labels If evidence of tampering is found with the TELs, the module must immediately be powered down and the Crypto Officer must be made aware of a physical security breach. Each TEL also has a unique serial number to prevent replacement with similar labels. To protect the device from tampering, TELs should be applied by the Crypto Officer as pictured below. 46| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The Crypto Officer should employ Tamper-Evident Labels (TELs) (also known as seals) by referencing the following general application guidance and the device specific guidance in section 7.3, Required TEL Locations:

• Before applying a TEL, make sure the target surfaces are clean and dry. Clean with alcohol and let dry before TEL application.
• Do not cut, trim, punch, or otherwise alter the TEL.
• Apply the wholly intact TEL firmly and completely to the target surfaces.
• Press down firmly across the entire label surface, making several back-and-forth passes to ensure that the label securely adheres to the device.
• Record the position and serial number of each applied TEL in a security log immediately after application.
• Allow 24 hours for the TEL adhesive seal to completely cure.
• To obtain additional or replacement TELS, please call HPE Aruba Networking customer support and request a FIPS Kit. The Crypto Officer (CO) should perform initial setup and configuration of the device(s) as described in section 11, Life-Cycle Assurance before the TELs are applied.

This section displays the locations of all TELs on each module (AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points). 47| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The AP-514 and AP-515 are the same device in all areas except that the AP-514 uses external antennas and the AP-515 uses internal antennas (see above section 2.3.1, AP-510 Series). The AP-514 and AP-515 each require 3 TELs placed in the same locations on each: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 26 and 27 for placement (only AP-514 is shown). TELs 1 and 2 shall be placed on opposite sides of the enclosure along a segment that manifests the least curvature (as shown below). These TELs shall be applied such that between one-quarter and one-third of the TEL is adhered to the white cover of the AP enclosure. The remaining portion shall be wrapped around the side of the cover and the chassis. TELs must be firmly pressed down, removing any air bubbles or creases, to ensure proper adhesion. Figure 26

• Top View of AP-514 with TELs Figure 27
• Bottom View of Aruba AP-514 with TELs 48| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The AP-534 and AP-535 are the same device in all areas except that the AP-534 uses external antennas and the AP-535 uses internal antennas (see above section 2.3.2, AP-530 Series). The AP-534 and AP-535 each require 3 TELs placed in the same locations on each: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 28 and 29 for placement (only AP-535 is shown). TELs 1 and 2 shall be placed on opposite sides of the enclosure along a segment that manifests the least curvature (as shown below). These TELs shall be applied such that between one-quarter and one-third of the TEL is adhered to the white cover of the AP enclosure. The remaining portion shall be wrapped around the side of the cover and the chassis. TELs must be firmly pressed down, removing any air bubbles or creases, to ensure proper adhesion. Figure 28

• Top View of AP-535 with TELs Figure 29
• Bottom View of Aruba AP-535 with TELs 49| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The AP-584, AP-585, and AP-587 are all outdoor APs of different sizes (see above section 2.3.3, AP-580 Series). Each of the AP-580 Series APs (AP-584, AP-585 and AP-587) requires 3 TELs, one on each side to detect opening the device (label 1 and 2) and one covering the console port to detect access to a restricted port (label 3). The subsequent three sections illustrate the placement of each TEL by device. For all three models, TELs must be applied as described below, with the aesthetic cover removed. Once the TELs have been applied and their serial numbers recorded, the aesthetic cover should be reinstalled. Figure 30

• Placement of TELs 1 and 2 on AP-580 Series APs TELs 1 and 2 shall be applied such that approximately two-thirds of the TEL is adhered to the white chassis casting as shown above. Each TEL shall be located such that it contacts two adjacent ribs. (Wrapping the TEL around a single rib is non-compliant). Wrap the remaining length of TEL around the lip of the enclosure and affix to the plastic antenna cover. Firmly press the TEL against the chassis casing to ensure proper adhesion. Figure 31
• Placement of TEL 3 on AP-580 Series APs TEL 3 shall be placed vertically such that it completely covers the console port plug and additional length shall extends downwards. Wrap the remaining length of TEL around the lip of the enclosure and affix to the plastic antenna cover. Firmly press the TEL against the chassis casing and the console port plug to ensure proper adhesion. 50| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The AP-584 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 32, 33, and 34 for placement. Figure 32

• Right Side View of AP-584 with TEL Figure 33
• Front View of AP-584 with TEL Figure 34
• Left Side View of AP-584 with TELs 51| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The AP-585 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 35, 36, and 37 for placement. Figure 35

• Right Side View of AP-585 with TEL Figure 36
• Front View of AP-585 with TEL Figure 37
• Left Side View of AP-585 with TELs 52| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The AP-587 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 38, 39, and 40 for placement. Figure 38

• Right Side View of AP-587 with TEL Figure 39
• Front View of AP-587 with TEL Figure 40
• Left Side View of AP-587 with TELs 53| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The AP-635 is a campus AP (see above section 2.3.4, AP-630 Series). The AP-635 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 41 and

TELs 1 and 2 shall be placed on opposite sides of the enclosure (as shown below). These TELs shall be applied such that between one-quarter and one-third of the TEL is adhered to the white cover of the enclosure. The remaining portion shall be wrapped around the side of the cover and the chassis. TEL 1 shall be located such that it lands on the flat surface of the chassis. TEL 2 shall be placed approximately opposite TEL 1. TELs must be firmly pressed down, removing any air bubbles or creases, to ensure proper adhesion. It is especially important that TELs 2 and 3 be firmly adhered to the chassis. Figure 41

• Top View of AP-635 with TELs Figure 42
• Bottom View of Aruba AP-635 with TELs 54| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The AP-655 is a campus AP (see above section 2.3.5, AP-650 Series). The AP-655 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 43 and

TELs 1 and 2 shall be placed on opposite sides of the enclosure (as shown below). These TELs shall be applied such that between one-quarter and one-third of the TEL is adhered to the white cover of the enclosure. The remaining portion shall be wrapped around the side of the cover and the chassis. TEL 2 shall be located such that it lands on the flat surface of the chassis. TEL 1 shall be placed approximately opposite TEL 2. TELs must be firmly pressed down, removing any air bubbles or creases, to ensure proper adhesion. It is especially important that TEL 1 be firmly adhered to the chassis. Figure 43

• Top View of AP-655 with TELs Figure 44
• Bottom View of Aruba AP-655 with TELs 55| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary The Crypto Officer should inspect/test the physical security mechanisms according to the Table 25 - Physical Security Inspection Guidelines

Since the module has not been purposely designed, built and publicly documented to include noninvasive mitigation techniques, the Non-Invasive Security requirements are not applicable. 56| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The following are the Sensitive Security Parameters (SSPs) and Keys used in the module. The operator is responsible for zeroizing all SSPs when switching modes. As specified in the Zeroization column of the following table, the majority of SSPs/Keys used in the module are zeroized implicitly by rebooting the module, indicated via the successful completion of the module reboot service. Also as specified in the Zeroization column of the following table, there are a minority of SSPs/Keys used in the module that are zeroized by using the command ‘ap wipe out flash’, indicated via the status of the ‘ap wipe out flash’ command. # N/A N/A N/A 57| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary # N/A N/A N/A N/A during DiffieHellman N/A DiffieHellman DiffieHellman DiffieHellman 58| EC DiffieHellman EC DiffieHellman HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary # EC DiffieHellman EC DiffieHellman EC DiffieHellman EC DiffieHellman N/A N/A N/A N/A N/A IKE Preshared Key 29 Not used in Mesh Point AP configuration. Applicable only to Remote AP and Mesh Portal modes 59| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary # N/A N/A N/A 60| N/A N/A HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary # N/A HMAC-SHA1 61| N/A N/A HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary # 62| B N/A N/A HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary # B N/A N/A N/A N/A While operating in Mesh Point AP configuration or Mesh Portal AP configuration, the AP will only use PSK for WPA2/WPA3. Remote AP configuration and CPSec Protected AP configuration use both Certificate-based and PSK-based WPA2/WPA3. HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary # N/A 64| N/A N/A HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Notes:

• AES GCM IV generation is performed in compliance with the Implementation Guidance C.H scenario 1 for IKEv2. The module is compliant with RFC 4106 and 7296. Specifically, the module uses RFC 7296 compliant IKEv2 to establish the shared secret SKEYSEED from which the AES GCM encryption keys are derived. When the “nonce” (the IV in RFC 5282) for IKEv2 exhausts the maximum number of possible values for a given security association for IKEv2, either party to the security association for IKEv2 that encounters this condition triggers a rekeying with IKEv2 to establish a new encryption key.
• AES GCM IV generation is performed in compliance with the Implementation Guidance C.H scenario 4 for WPA3. The session is reauthenticated by the module after 24 hours which resets the AES GCM IV counter. The 24 hour (86400 seconds) interval is the default setting and shall not be changed while in Approved mode.
• In case the module’s power is lost and then restored, a new key for use with the AES-GCM encryption/decryption shall be established.
• For keys identified as being “Generated internally", the module implements cryptographic key generation (CKG) compliant to SP 800-133rev2 section 4: The module generates symmetric keys and seeds for asymmetric keys using an unmodified output from the Approved DRBG (Cert. #A2690).
• In Remote AP configuration, all SSPs are applicable.
• In CPSec Protected AP configuration, the IKEv1 PSK SSPs are not applicable.
• In Mesh Point AP configuration, all IPSec/IKE SSPs are not applicable.
• SSPs labeled as “Entered by CO” (as well as the RSA public and private keys) are transferred into the module from the Mobility Controller via IPSec.
• SSPs labelled as “obfuscated” are obfuscated in accordance to FIPS IG 2.4.A.
• Sensitive Security Parameters (SSPs) can be Critical Security Parameters (CSPs) or Public Security Parameters (PSPs).
• Keys established while operating in the non-Approved mode cannot be used in Approved mode, and vice versa. 65| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

The module performs Cryptographic Algorithm Self-Tests (CASTs) when powered on, regardless of which of the four (4) AP configurations is selected. The module also performs Pre-Operational Self-Tests (POSTs) automatically when the module is powered on. In addition, the module performs Conditional tests in the Approved mode of operation (refer to the Modes of Operation section). When a cryptographic algorithm self-test or pre-operational self-test fails, or when a conditional self-test fails, the module enters the Critical Error state (while in this state, the module provides no functionality including inhibition of data output), logs the error, and reboots automatically. During the process when the HPE Aruba Networking Access Point (AP) is powered on and booted, RSA and SHS Conditional Cryptographic Algorithm Self-Test are executed after ArubaOS is booted. The module transitions to the operational state only after the cryptographic algorithm and pre-operational self-tests are The module performs the following Pre-Operational Self-Tests (POSTs): Table 28

• Pre-Operational Self-Tests The module performs the following Conditional Self-Tests: Table 29
• Conditional Cryptographic Algorithm Tests 66| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary 67| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary 68| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Table 30

• Conditional Pairwise Consistency Tests 69| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Table 31

• Conditional Software/Firmware Load Tests Notes:
• KAT = Known Answer Test, RCT = Repetition Count Test for Entropy Source, APT = Adaptive Proportion Test for Entropy Source, PCT = Pairwise Consistency Test These self-tests are run for the hardware cryptographic implementation as well as for the ArubaOS OpenSSL Module and ArubaOS Crypto Module implementations. Self-test results are written to the serial console. The status can be viewed by using the CLI command: show log crypto all When all Cryptographic Algorithm Self-Tests (CASTs) run when the module is powered on pass, the module will enter the Normal state and the module logs the following message into a log file: KATS: passed In the event any self-test fails, the module will enter a Critical Error state (while in this state, the module provides no functionality and inhibits data output), logs the error, and reboots automatically. If the software/firmware load test fails when module powered on, the module enters the Critical Error state, where the invalid software/firmware file is deleted to clear the error. During the reboot sequence, all LEDs light up (reboot), then all LEDs turn off (power off/cycled), then all LEDs light up (power on), then the LEDs light indicating level of activity (refer to the Status Indicator LED tables for each hardware device listed above in Section 2.3, Table 5). In the event of a KATs failure, the AP logs error messages:
• 70| For an AP hardware ArubaOS OpenSSL Module and/or ArubaOS Crypto Module KAT failure: AP rebooted [DATE][TIME] : Restarting System, SW FIPS KAT failed HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

This section specifies the procedures for secure installation, initialization, provisioning, start-up, configuration, and operation of the module. Guidance is provided, including references to where to find more guidance documentation.

The units are shipped to the Crypto Officer in factory-sealed boxes using trusted commercial carrier shipping companies. The Crypto Officer should examine the carton for evidence of tampering. Tamper-evidence includes tears, scratches, and other irregularities in the packaging.

The product carton should include the following:

• HPE Aruba Networking AP-5XX or AP-6XX Wireless Access Point.
• Mounting kit (sold separately).
• Tamper-Evident Labels. Inform your supplier if there are any incorrect, missing, or damaged parts. If possible, retain the carton, including the original packing materials. Use these materials to repack and return the unit to the supplier if needed.

You will need the following during installation:

• HPE Aruba Networking AP-5XX and AP-6XX Access Point components.
• A mount kit compatible with the AP and mount surface (sold separately).
• A compatible Category 5 UTP Ethernet cable.
• External antennas (when using the AP-514, AP-534, or AP-584).
• Phillips or cross-head screwdriver.
• (Optional) a compatible 12V DC (AP-514, AP-515, AP-635, or AP-655) or 48V DC (AP-534 or AP-535) or 100-240V AC (AP-584, AP-585, or AP-587) AC-to-DC power adapter with power cord.
• (Optional) a compatible PoE midspan injector with power cord.
• One USB 2.0 host interface Type A connector (AP-514, AP-515, AP-534, AP-535, AP-635, or AP-655) or USB Type C connector (AP-584, AP-585, or AP-587) console cable
• Adequate power supplies and electrical power.
• Management Station (PC) with 10/100 Mbps Ethernet port and SSHv2 client software. Also make sure that (at least) one of the following network services is supported:
• Aruba Discovery Protocol (ADP) - see the Aruba AP Software Quick Start Guide.
• DNS server with an “A” record.
• DHCP Server with vendor-specific options.

For detailed instructions on identifying AP installation locations, refer to the specific HPE Aruba Networking 5XX or 6XX Series Wireless Access Points Installation Guide, and the section, Identifying Specific Installation Locations. 71| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

• All HPE Aruba Networking access points should be professionally installed by an HPE Aruba Networking-Certified Mobility Professional (ACMP).
• Electrical power is always present while the device is plugged into an electrical outlet. Remove all rings, jewellery, and other potentially conductive material before working with this product.
• Never insert foreign objects into the device, or any other component, even when the power cords have been unplugged or removed.
• Main power is fully disconnected from the Wireless Access Point only by unplugging all power cords from their power outlets. For safety reasons, make sure the power outlets and plugs are within easy reach of the operator.
• Do not handle electrical cables that are not insulated. This includes any network cables.
• Keep water and other fluids away from the inside of the product.
• Comply with electrical grounding standards during all phases of installation and operation of the product. Do not allow the Wireless Access Point chassis, network ports, power cables, or mounting brackets to contact any device, cable, object, or person attached to a different electrical ground. Also, never connect the device to external storm grounding sources.
• Installation or removal of the device or any module must be performed in a static-free environment. The proper use of anti-static body straps and mats is strongly recommended.
• Keep modules in anti-static packaging when not installed in the chassis.
• Do not ship or store this product near strong electromagnetic, electrostatic, magnetic or radioactive fields.
• Do not disassemble chassis or modules. They have no internal user-serviceable parts. When service or repair is needed, contact HPE Aruba Networking.

The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points meet FIPS 140-3 Level 2 requirements. The information below describes how to keep the Wireless Access Point in the Approved mode of operation. The module can be configured to be in one of four (4) AP configurations and in the Approved mode of operation (see section 2.5, Modes of Operation) via corresponding HPE Aruba Networking Mobility Controllers that are in Approved mode and that have been validated against FIPS 140-3 requirements, provided that the guidelines on services, algorithms, physical security and key management found in this Security Policy are followed.

The Crypto Officer must ensure that the Wireless Access Point is always operating in the Approved mode of operation. This can be achieved by ensuring the following:

• The Crypto Officer must first enable and then provision the AP into the Approved mode of operation before Users are permitted to use the Wireless Access Point (see the sub-section below named, Enabling Approved Mode on the Staging Controller).
• Only HPE Aruba Networking firmware updates signed with SHA2-256/RSA 2048 are permitted.
• Passwords must be at least eight (8) characters long.
• The Wireless Access Point logs must be monitored. If a strange activity is found, the Crypto Officer should take the Wireless Access Point offline and investigate. 72| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary

• The Tamper-Evident Labels (TELs) must be regularly examined for signs of tampering. Refer to the table in the above Physical Security section named, Inspection/Testing of Physical Security Mechanisms, for the recommended frequency.
• When installing expansion or replacement modules for the HPE Aruba Networking AP-514, AP515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points, use only Approved modules, replace TELs affected by the change, and record the reason for the change, along with the new TEL locations and serial numbers, in the security log.
• All configuration performed through the HPE Aruba Networking Mobility Conductor when configured as a managed device must ensure that only the Approved algorithms and services are enabled on the Wireless Access Point in Approved mode.
• Refer to the sub-section below named, Non-Approved Approved Mode Configurations, for nonApproved configurations that shall not to be used in the Approved mode.
• The operator is responsible for zeroizing all SSPs when switching modes. Keys established while operating in the non-Approved mode cannot be used in the Approved mode, and vice versa.
• The guidelines in the above sub-section 2.9 table named, Non-Approved Algorithms Not Allowed in the Approved Mode of Operation, and this sub-section 11.6 named, Secure Operation, must be adhered to.

Although outside the boundary of the Wireless Access Point, the operator should be directed to be careful not to provide authentication information and session keys to other parties. Note that the module does not possess persistent storage of SSPs. Any SSP value only exists in volatile memory and that value vanishes when the module is powered off. In the case when the module’s power is lost and then restored, a new key for use with the AES-GCM encryption/decryption shall be established. HPE Aruba Networking generally recommends that the communication between the Controller/Gateways and Access Points be restricted either by having a dedicated layer 2 segment/VLAN or, if Controller/Gateways and Access Points cross layer 3 boundaries, to have firewall policies restricting the communication of these authorized devices.

The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP655 Access Points meet FIPS 140-3 Security Level 2 requirements. The sections below describe how to place and keep the Wireless Access Point in the Approved mode of operation. The Crypto Officer (CO) must ensure that the Wireless Access Point is kept in the Approved mode of operation. The Wireless Access Point can be configured to be in one of four (4) AP configurations: Control Plane Security (CPSec) Protected AP, Remote AP and the two (2) Mesh AP configurations, Mesh Portal AP and Mesh Point AP. The module must operate in Approved mode (see Modes of Operation section above). By default, the Wireless Access Point operates in the standard non-Approved mode. The Access Point is managed by an HPE Aruba Networking Mobility Controller in Approved mode, and access to the Mobility Controller’s administrative interface via a non-networked general purpose computer is required to assist in placing the module in Approved mode. The Controller used to provision the AP is referred to as the “staging controller”. The staging controller must be provisioned with the appropriate HPE Aruba Networking firmware image for the module, which has been validated to FIPS 140-3, prior to initiating AP provisioning. Additionally, if a Mobility Conductor appliance is deployed in the environment, provisioning of the APs can be performed by passing policies down from the Mobility Conductor to the Mobility Controller which then provisions the AP.

The Crypto Officer shall perform the following steps to ensure the APs are placed in the secure operational state:

1. Review the Aruba AP Software Quick Start Guide. Select the deployment scenario that best fits your installation and follow the scenario’s deployment procedures.
2. Apply TELs according to the directions in the above Physical Security section 7.2, Applying TELs. 73| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary

3. Enable Approved mode on the staging controller: Log into the staging controller via an SSH client and enter the commands shown in the sub-section below named, Enabling Approved Mode on the Staging Controller.
4. Connect the module via an Ethernet cable to the staging controller - note that this should be a direct connection, with no intervening network or devices. If PoE is being supplied by an injector, this represents the only exception; that is, nothing other than a PoE injector should be present between the module and the staging controller.
5. Provision the AP into one of four (4) AP configurations following the guidance in the ArubaOS

8.10 User Guide: Remote AP configuration, CPSec protected AP configuration, Mesh Portal AP

configuration, or Mesh Point AP configuration.

6. Via the logging facility of the staging controller, ensure that the module (the AP) is successfully provisioned with firmware and configuration and in Approved mode. To verify that the image is being run, the CO can enter ‘show ap image’ on the controller to verify the correct image is present on the device. To verify that Approved mode is enabled, enter ‘show fips’.
7. Terminate the administrative session.
8. Disconnect the module from the staging controller and install it on the deployment network. When power is applied, the module (the AP) will attempt to discover and connect to an HPE Aruba Networking Mobility Controller on the network. Once the AP has been provisioned, it is considered to be in Approved mode, provided that the guidelines on services, algorithms, physical security and key management found in this Security Policy are followed.

For FIPS 140-3 compliance, users cannot be allowed to access the Wireless Access Point until the CO changes the mode of operation on the staging controller to the Approved mode. There is only one way to enable Approved mode on the staging controller:

• Use the CLI via an SSHv2 client to enter the commands in the following sub-section.
• For more information on using the CLI, refer to the ArubaOS 8.10 Command-Line Interface Reference Guide.

Login to the staging controller using an SSHv2 client. Enable Approved mode using the following commands: #configure terminal Enter Configuration commands, one per line. End with CNTL/Z (config) #fips enable (config) #exit #write memory Saving Configuration... Configuration Saved. To verify that Approved mode has been enabled, issue the command: show fips to see: FIPS Settings: Mode Enabled If logging in to the staging controller via the Mobility Conductor, please reference the ArubaOS 8.10 User Guide on how to access a managed device. Once connected to the staging controller, the above commands will successfully execute. 74| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Non-Proprietary Please abide by the sub-section above in this section named, Crypto Officer Management, and subsection below named, Non-Approved Approved Mode Configurations.

When operating in the Approved mode, the following configuration options are non-Approved:

• The following configurations are forcibly disabled by the module: o o o o o o o o o o o o
• All WEP features. WPA. TKIP mixed mode. Any combination of DES, MD5, and PPTP. Firmware images signed with SHA- 1. Enhanced PAPI Security. Null Encryption. USB CSR-Key Storage. Certificates with less than 112 bits security strength as used with IKEv2, IPSec, and/or user authentication. Telnet. Extensible Authentication Protocol (EAP)-TLS Termination. bSec. IPSec/IKE using Triple-DES.

Documentation for any HPE Aruba Networking product can be found on the HPE Networking Support Portal (NSP). Filters can be used to limit the displayed results by Product(s), Product Series, Version(s), and File Category. For example,

• Full ArubaOS version 8.10 documentation for HPE Aruba Networking Mobility Controllers, Virtual Mobility Controllers, Gateways, Mobility Conductors, and Access Points can be found at the link provided below after authentication. https://networkingsupport.hpe.com/downloads;pageSize=100;fileTypes=DOCUMENT;products=Aruba%20A ccess%20Points,Aruba%20Mobility%20Gateways;softwareGroups=ArubaOS;softwareMajorVersions=8.10

The following HPE Aruba Networking documents can be referenced to ensure that ArubaOS and the HPE Aruba Networking hardware-based equipment or HPE Aruba Networking virtual appliances that run ArubaOS are installed and operated correctly in Approved mode:

• 75| Aruba Access Points Installation Guides ArubaOS 8.10.0.x AP Software Quick Start Guide ArubaOS 8.10.0.0 Virtual Appliance Installation Guide ArubaOS 8.10.0.0 User Guide ArubaOS 8.10.0.x CLI Reference Guide ArubaOS 8.10.0.0 API Guide ArubaOS 8.10.0.0 Getting Started Guide ArubaOS 8.10.0.0 Syslog Reference Guide HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

To determine if an HPE Aruba Networking product is considered end of life, refer to the HPE Aruba Networking end-of life information at https://networkingsupport.hpe.com/end-of-life. If an HPE Aruba Networking product is deemed end-of-life, the CO should work with their HPE Aruba Networking representative to determine the appropriate HPE Aruba Networking product upgrade path to use a newer Approved version. Note that any firmware loaded into this module that is not shown on the module certificate is out of the scope of this validation and requires a separate FIPS 140-3 validation. The module does not possess persistent storage of SSPs. Any SSP value only exists in volatile memory and that value vanishes when the module is powered off. For secure sanitization, firstly the module shall be powered off. Then, if the module is deprecated, the module will be replaced with a newer Approved version with the help of an HPE Aruba Networking-Certified Mobility Professional (ACMP).

As per IG 12.A, since the module has not been purposely designed, built and publicly documented to mitigate one or more specific attacks, the Mitigation of Other Attacks requirements are not applicable. 76| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy

Referenced URLs

• www.arubanetworks.com
• https://www.arubanetworks.com/open_source
• https://csrc.nist.gov/projects/cryptographic-module-validation-program
• https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search
• https://networkingsupport.hpe.com/downloads;pageSize=100;fileTypes=DOCUMENT;products=Aruba%20A
• https://networkingsupport.hpe.com/end-of-life