Module Name
Juniper Networks EX4600, QFX5100 and QFX5200 Ethernet Switches
Validation Dates
07/30/2019;09/19/2019
Caveat
When operated in FIPS mode
Security Level Exceptions
- Roles, Services, and Authentication: Level 3
- Design Assurance: Level 3
- Mitigation of Other Attacks: N/A
Embodiment
Multi-Chip Stand Alone
Description
QFX and EX Series switches provide the universal building blocks for multiple data center fabric architectures, including Junos Fusion, Virtual Chassis Fabric (VCF), Ethernet VPN (EVPN)-Virtual Extensible LAN (VXLAN), and IP Fabric. With throughput of up to 6 Tbps per slot, QFX Series switches provide sustained wire-speed switching with low latency and jitter for virtualized data center environments. Redundant fabrics, power, and cooling, combined with separate control and data planes, ensure maximum system availability
FIPS Algorithms
| AES |
Certs. #5388, #5389, #5518 and #5520 |
| CKG |
vendor affirmed |
| CVL |
Certs. #1852 and #1965 |
| DRBG |
Certs. #2086, #2087, #2182 and #2184 |
| ECDSA |
Certs. #1424 and #1484 |
| HMAC |
Certs. #3569, #3571, #3575, #3670, #3674 and #3677 |
| KTS |
AES Certs. #5389 and #5520 and HMAC Certs. #3571 and #3677, Key establishment methodology provides between 128 and 256 bits of encryption strength |
| KTS |
Triple-DES Certs. #2716 and #2782 and HMAC Certs. #3571 and #3677, Key establishment methodology provides 112 bits of encryption strength |
| RSA |
Certs. #2882 and #2961 |
| SHS |
Certs. #4322, #4323, #4324, #4429, 4430 and #4432 |
| Triple-DES |
Certs. #2715, #2716, #2780 and #2782 |
Allowed Algorithms
Diffie-Hellman (CVL Certs. #1852 and #1965, key agreement; key establishment methodology provides 112 bits of encryption strength); EC Diffie-Hellman (CVL Certs. #1852 and #1965, key agreement; key establishment methodology provides 128 or 192 bits of encryption strength); NDRNG
Hardware Versions
EX4600-40F, QFX5100-24Q, QFX5100-48S, QFX5100-48SH, QFX5100-48T, QFX5100-48TH, QFX5100-96S, QFX5200-32C, QFX5200-48Y
Firmware Versions
JUNOS 18.1R1
) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)
