Attachment 7 - NARAS Architecture RMF.pdf

Architecture/System Description for the

USAFCENT Navigational Aids Remote Access System

(NARAS)

April 6, 2020

Prepared For:

HQ AFFSA

BLDG 4, ROOM 240

6500 S MACARTHUR BLVD

OKLAHOMA CITY, OK 73169

DISTRIBUTION STATEMENT D: Distribution authorized to DoD and U.S. DoD contractors only for administrative or operational use (February 2020). Other requests shall be referred to

USAFCENT/A3AY.

DESTRUCTION NOTICE – For unclassified, limited documents, destroy by any method that will prevent disclosure of contents or reconstruction of the documents.

USAFCENT Navigational Aids Remote Access Systems

NARAS Architecture/System Description FOR OFFICIAL USE ONLY i

DOCUMENT REVISION HISTORY

Revision Date Description

1.0 April 17, 2015 Initial Release

2.0 April 6, 2020 Template and RMF updates.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 2

TABLE OF CONTENTS

Section Page

1.0 SYSTEM INFORMATION

1.1. Description

1.2. Scope

1.3. System Concept of Operations (CONOPS) Summary

2.0 ENVIRONMENT

2.1. Operating and Computing Environment

2.2. Physical Security Measures / Facilities

3.0 SYSTEM ARCHITECTURE

3.1. Remote Access and Updates

3.2. Remote Control Status Unit

3.3. Navigational Aids

3.4. System Architecture

3.5. Accreditation Boundary

3.6. Test Bed Architecture

3.7. Operational Data Flows

3.8. Management Data Flows

4.0 USER DESCRIPTIONS AND ROLES

5.0 HARDWARE LIST

6.0 SOFTWARE LIST

7.0 PORTS, PROTOCOLS, AND SERVICES (PPS)

APPENDIX A: ACRONYM LIST

APPENDIX B: DETAILED COMPLIANCE MATRIX

8.0 SIGNATURES

LIST OF TABLES

Table Page Table 1-1 SP-800-53v4 Compliance Matrix Table 4-1 User Type, Description / Qualifications, Geographical Location Table 4-2 Security Roles Table 5-1 Remote Access Hardware List Table 5-2 Path Loss Measurements in an Open Rural Environment Table 5-3 RCSU Hardware List Table 5-4 NAVAIDs Hardware List Table 5-5 ILS Localizer and Glideslope Hardware List Table 5-6 DME Hardware List Table 5-7 TACAN/D-TACAN Hardware List Table 5-8 VOR Hardware List Table 6-1 RMC Software List

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 3

Table 6-2 RCSU Software List Table 6-3 RSDU Software List Table 7-1 Internal Ports, Protocols, and Services List Table 7-2 External Ports, Protocols, and Services List Table B-3 Detailed Compliance Matrix

LIST OF FIGURES

Figure Page Figure 3-1: NARAS System Detail Architecture Figure 3-2: NARAS Multiple Airfield Figure 3-3: NARAS Accreditation Boundary Figure 3-4: NARAS Test Bed Figure 3-5: NARAS Operational Data Flow Figure 3-6: NARAS Management Data Flow

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 4

1.0 SYSTEM INFORMATION

1.1. Description

The Navigational Aids Remote Access System (NARAS) network consists of Commercial Off The Shelf (COTS) systems that enable remote connectivity to airfield navigational aids (NAVAIDs) systems.

NAVAIDs systems are a form of marker, signal, or device that assists an aircraft pilot by guiding it to the destination using various methods. Common NAVAIDs systems include the Tactical Air Navigation (TACAN), Mobile TACAN, Distance Measuring Equipment (DME), Instrument Landing System (ILS), Very High Frequency (VHF) Omnidirectional Radio Range (VOR), and VOR plus TACAN combinations (VORTAC). Connectivity and status alerts for these systems is accomplished via connection with a Remote Control Status Unit (RCSU). The RCSU and associated equipment connects to each individual NAVAID station using fiber, twisted pair copper, and/or RF (Radio Frequency) transmission. The RCSU and associated equipment allows a remote Portable Maintenance Data Terminal (PMDT) or Remote Maintenance Monitor (RMM) user to connect to the RCSU to view the status of associated NAVAID stations at the runway, airfield, or multiple airfields depending on the system configuration.

Monitoring and maintenance operations for NARAS and NAVAIDs is managed by technicians located at the Regional Maintenance Center (RMC) on Al Udeid Air Base, Qatar. In addition to control and monitoring capabilities, the NARAS network is configured with a fully functional testbed to encompass testing and evaluation of hardware and software updates or modifications prior to applying to live NARAS equipment. This testbed is located at the Booz Allen Hamilton Operation Support Laboratory (BAHOSL) in Charleston, South Carolina. Encrypted Virtual Private Networks (VPNs) allow for remote patching and updating of NARAS computers and network devices from the BAHOSL.

1.2. Scope

The provisions in this plan are applicable to all staff, including contractors, Air Force personnel, and vendors that provide daily support to NARAS operations. The Contingency Plan is comprehensive enough so that it can be applied to every NAVAID location that supports the operation of the system.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations. A detailed compliance matrix can be found in Appendix B: “Detailed Compliance Matrix”.

Table 1-1 SP-800-53v4 Compliance Matrix

CNTL NO. CONTROL NAME PRIORITY LOW MOD HIGH

PL-1 Security Planning Policy and Procedures

P1 PL-1 PL-1 PL-1

PL-2 System Security Plan P1 PL-2 PL-2 (3) PL-2 (3)

PL-3 Withdrawn --- --- --- ---

PL-4 Rules of Behavior P2 PL-4 PL-4 (1) PL-4 (1)

PL-5 Withdrawn --- --- --- ---

PL-6 Withdrawn --- --- --- ---

PL-7 Security Concept of Operations P0 Not Selected Not Selected Not Selected

PL-8 Information Security Architecture P1 Not Selected PL-8 PL-8

PL-9 Central Management P0 Not Selected Not Selected Not Selected

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 5

1.3. System Concept of Operations (CONOPS) Summary

Regionalized Monitoring and Maintenance of NAVAID systems replaces previous decentralized monitoring systems, redefines maintenance procedures, and centralizes management of these systems.

This regionalized concept will meet the requirements and perform required functions in a more efficient and effective manner. All required maintenance activities, to include preventative maintenance, equipment repair and restoration, flight inspection, and periodic recertification, is accomplished by fully qualified technicians based at the RMC.

The System Concept of Operations (CONOPs) is described in a separate document: Air Force Forces (AFFOR)/A3A Regional Maintenance Center (RMC): Air Traffic Control and Landing Systems (ATCALS) Equipment CONCEPT OF OPERATIONS (CONOPS).

2.0 ENVIRONMENT

2.1. Operating and Computing Environment

Formal Command/Site Name AFCENT AFFOR A3A CAOC/ATCALS

Address (City, State, Zip, Country if not U.S.) AFFOR A3A CAOC/ATCALS APO AE 09309

System/Application/Enclave/Network (or component) Building Room Number OSS Accreditation

Date Physical

Certification Letter

RMC 3703 1 N/A N/A

Bagram Airfield ATC Tower CAB N/A N/A

Al Udeid Airfield ATC Tower CAB N/A N/A

Deployable TACAN Systems N/A N/A N/A N/A

2.2. Physical Security Measures / Facilities

2.2.1. Air Traffic Control (ATC) Towers and RMC

The RMC and Air Traffic Control (ATC) towers are secure facilities on a U.S. Forces secure base. Access to the RMC and ATC towers are restricted via Military installation access points, secure building access, and restricted area identification.

2.2.2. Booz Allen Hamilton Operational Support Laboratory

The NARAS testbed and all supporting equipment (test ASAs, update, syslog, security scanning, and active directory servers) located in the BAHOSL are in a cipher locked restricted access lab inside an access-controlled facility with armed security guards on duty during non-working hours. The testbed is further secured inside a locking equipment cabinet.

2.2.3. NAVAIDS

The Deployable TACAN system and all airfield NAVAIDs are located on secure access-controlled airfields with other high value assets that are physically locked and constantly monitored to prevent unescorted or unauthorized entry.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 6

2.2.4. Airfield

The NAVAIDs and remote equipment are housed on highly secure Military installations in access-controlled areas, such as control towers and locked shelters on the airfield.

3.0 SYSTEM ARCHITECTURE

3.1. Remote Access and Updates

The remote access equipment consists of Cisco Adaptive Security Appliance (ASA) 5506-X firewalls and the Cisco 4321 Integrated Services Routers (ISR). These devices provide IPSec site-to-site VPNs over Non- Secure Internet Protocol Router (NIPR) networks using Advanced Encryption Standard (AES) encryption.

VPN tunnels are configured to allow remote maintenance and status monitoring of all remote airfield sites from the RMC hub. Connectivity to and from any other networks, including NIPR, is blocked by access-control lists (ACLs) within the ASAs. Behind each individual airfield site ASA is a private local area network (LAN) connected in a hub-and-spoke configuration to the RMC and the BAHOSL, with airfield-to-airfield connectivity unsupported. The RMC and BAHOSL connections are one-to-many connections.

3.2. Remote Control Status Unit

The RCSU includes the equipment required to provide a NAVAID status display inside local air traffic control towers and remotely at the RMC. The 2238 RCSU is not a typical Information Technology (IT) system designed to store data, rather it is used to monitor real-time NAVAID operational status and allow for remote adjustment of system parameters. No classified data is stored on the system and it has no other IT capabilities or functions. This RCSU is used solely for NAVAID equipment status monitoring and controlling.

The RCSU system is capable of monitoring overall status and individual parameters for multiple NAVAID systems simultaneously. The RCSU is typically located in a control tower equipment room, tower cab, or other environmentally controlled facility with WAN connections readily available. In addition to remote status monitoring, the RCSU also allows for remote adjustment of many navigational system parameters normally required to be performed by local technicians to support flight check operations. The RCSU provides visual indications of the status of the configured systems (locally and for remotely connected status display units), and an audible alarm when fault or alert conditions exist. Additionally, the equipment provides Radio over Internet Protocol (RoIP) and control signals connectivity to the flight check radio. The connections between the RCSU and the NAVAID systems are established by a leased line, serial line, radio frequency, or Ethernet connection.

3.2.1. 2238 RCSU Components A) RCSU: Windows 10 operating system which hosts a custom-developed application. Static

Network Address Translation (NAT) is used to connect the RCSU to the RMC and BAHOSL. The RSCU has direct connections to multiple NAVAID systems by means of leased lines, serial lines, radio frequency (RF), or Transmission Control Protocol/Internet Protocol (TCP/IP) via a bridged network on the SSG-5 gateway device.

B) RSDU: Displays the status of the connected NAVAID equipment. This is a Windows based system with a custom-developed application. It is directly connected to the RCSU via a bridged network on the SSG-5 gateway device and communicates using TCP/IP.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 7

3.3. Navigational Aids

In addition to navigational aids, each airfield site includes the specialized equipment required to transmit status information to the RCSU and RMC equipment. NAVAID sites include remote Flight Check Radio equipment with a Deployable Tactical Air Navigation (D-TACAN) or Glideslope. The native data transfer protocol for NAVAID device communications is serial. Connections between RCSUs and NAVAIDs can be serial or encapsulated serial over Ethernet, and transported point-to-point leased line modem, spread spectrum RF link, twisted-pair Ethernet extension, or fiber. Additionally, communications and control of the flight check radio from the RMC to the NAVAID locations are RoIP and encapsulated serial using the same transport methods as with NAVAID status monitoring.

RMC personnel monitor the status of individual Navigational Aids systems through connections initiated by equipment associated with the 2238 RCSU, located in the ATC tower/RMC and the NAVAID microprocessors.

3.3.1. Common NAVAID Systems

C) D-TACAN

D) Fixed Tactical Air Navigation (F-TACAN)

E) DME

F) ILS including Glideslope and Localizer equipment

G) Conventional VHF Omnidirectional Range (CVOR)/Doppler VHF Omnidirectional Range (DVOR)

3.4. System Architecture

Remote connectivity between the Booz Allen Hamilton Operational Support Lab, the Regional Maintenance Center, and the Airfield Sites is accomplished with IPsec VPN tunnels between Cisco 5506- X ASA firewall devices. In the Booz Allen Hamilton Lab, virtual machines connected to a dedicated Booz Allen Hamilton Client Services Network provide Windows updates and a security scanning service, while other virtual machines on the NARAS network provide Active Directory, Syslog, and update testing capabilities. A Cisco 4321 Integrated Services Router (ISR) at the Booz Allen Hamilton Lab allows for remote. Multiple airfield sites are connected to the RMC and Booz Allen Hamilton Lab through a dual hub-and-spoke arrangement. The ASA hub devices are located at the RMC site in the Expeditionary Communications Squadron Network Control Center (ECS/NCC) on Al Udeid Air Base and at the Booz Allen Hamilton Lab in Charleston, SC. The loss of network connectivity to either of the hub sites, or any one of the airfield sites, will not result in a full loss of remote access or management capabilities. ASA devices are located as close as possible to the RCSU equipment at the airfield site, where it connects to the Juniper SSG-5 firewall to bridge the internal airfield site network.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 8

Figure 3-1 and Figure 3-2 depict the architecture of a typical NARAS system for reference.

Architecture Diagram

Figure 3-1: NARAS System Detail Architecture

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 9

Figure 3-2: NARAS Multiple Airfield

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 10

3.5. Accreditation Boundary

Figure 3-3 depicts the accreditation boundary of the NARAS system. All equipment depicted within the red dotted lines in Figure 3-3 is subject to the certification and accreditation standards set forth for the NARAS system. All testing and evaluation is to be performed in accordance with DoD and industry standards.

Figure 3-3: NARAS Accreditation Boundary

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 11

3.6. Test Bed Architecture

A comprehensive test bed is maintained in the Booz Allen Hamilton Operational Support Lab for hardware, software, and patch testing, as well as for verification of all changes to the system prior to applying to the operational NARAS sites. The test bed is entirely within the accreditation boundary.

Figure 3-4 details the test bed configuration.

Figure 3-4: NARAS Test Bed

3.7. Operational Data Flows

The NARAS Operational Data Flow (Figure 3-5 on page 12) depicts data transfer pathways between the various hardware systems. Data encryption is employed only between 5506-X ASA devices, all other data is in its native format on private internal networks. Section 6.0 details the software that is noted in this section. Section 7.0 contains more details of the various interfaces shown in Error! Reference source not found..

3.7.1. ILS Localizer, Glideslope, CVOR/DVOR

These three data interfaces are low level control and status type data contained in a two-dimensional matrix that is updated in both push and pull data modes.

3.7.2. NXU-2A – Flight Check Radio

The data path from the NXU-2A server to local and external networked devices consists of User Datagram Protocol (UDP) RoIP data. The NXU-2A provides a RoIP link, which includes radio control signals (PTT, COR, RS-232) along with a VoIP audio path, which interfaces to the IDA telephone interface.

During flight certification of the TACAN, the maintenance crew utilizes this radio communications system to discuss issues with the flight check aircraft. This device is typically used only during re-certification of the TACAN system, not for everyday functions.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 12

3.7.3. TACAN - DME

The TACAN and DME supply status data to the RMM. Various parameters may be controlled locally or remotely by the RMM software.

3.7.4. Portable Maintenance Data Terminal

The PMDT data path allows remote maintenance of the ILS and VOR equipment.

3.7.5. Remote Status Monitor System

The RSMS is software installed on a laptop or accessed directly from the 2238 RCSU where it comes preinstalled. Status and fault data from the ILS, VOR, DME, TACAN, and VORTAC is available via the RSMS software. Data formats are serial that is converted to Ethernet and vice versa.

Note: All external interfaces are directly connected to Platform IT (PIT) systems. All data is unclassified.

All Passwords are encrypted both at rest and in transit.

Error! Reference source not found. represents the NARAS operational data flows.

Figure 3-5: NARAS Operational Data Flow

3.8. Management Data Flows

The native data format used by all standalone NAVAID systems is serial, which is either sent in serial format to the 2238 and converted to Ethernet or, for the TACAN/VORTAC and DME, are converted as part of their system. Section 7.0 contains more details of the various interfaces shown in Figure 3-6 on page 13.

Note: The RSMS, PMDT, and RMM software programs do not process any NARAS management data.

Note: All data exchanged between geographically separated sites is encrypted/decrypted by dedicated 5506-X ASAs and routed to the appropriate remote device. All data exchanged between devices on the internal network segments of individual airfields is not encrypted.

Note: NARAS NXU-2A management access is limited to a local serial connection.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 13

Figure 3-6: NARAS Management Data Flow

4.0 USER DESCRIPTIONS AND ROLES

The following sections discuss NARAS users, user responsibilities, and recommended security clearance levels for different user roles.

4.1.1. Configuration Management Board

The Configuration Management Board is responsible for managing and maintaining the configuration of the entire NARAS system and acts as the final authority for all NARAS related decisions and changes.

4.1.2. Regional Maintenance Center

RMC technicians are available 24 hours a day and are ultimately responsible for maintaining everyday NARAS functions. They have the immediate authority to implement repairs and secure hardware to limit and reduce the impact of an outage or prevent potential downtime. They are responsible for recording the initial problem assessment, documenting and tracking restoration progress and alerting the Configuration Management Board (CMB) when necessary. RMC technicians maintain a locally available inventory containing major repair parts and items that may be considered single point of failure.

Records detailing any significant or notable changes to NARAS are maintained by RMC technicians. RMC technicians are responsible for providing technical assistance during installation and activation of NARAS at new sites, as well as the deactivation and removal from existing sites.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 14

4.1.3. Engineering and Logistics Support Team

The Engineering and Logistical Support Team is responsible for providing logistical support, remote technical support, and troubleshooting assistance to the RMC technicians for major repairs/changes/upgrades to NARAS.

Table 4-1 User Type, Description / Qualifications, Geographical Location

User Type Description: Qualifications Estimated Number of Users

Foreign National (Y/N/ Possible)

Location

Configuration Management Board (CMB)

NARAS Subject Matter Experts – Secret Clearance. CMB will consist of at least one member from the program office (AFFSA to include the Information Assurance Manager (IAM) along with the RMC and AFCENT A3A.

5 N Shaw AFB

On-site Maintainers

Standard Maintenance Team – Secret Clearance for access to work in the AOR, experience with NAVAIDs systems, and the ability to travel to remote airfields. Five personnel is the minimum recommendation.

5 N Al Udeid AFB, Qatar

Remote Management and Logistics

Remote Support Team- An understanding of the NARAS architecture and equipment, and experience with cybersecurity tools required to maintain the system within security standards.

2 N Charleston, SC

4.1.4. Security Roles

Details of each security role and minimum required security clearance are specified in Table 4-1 below.

Table 4-2 Security Roles

User Type / Title Description of Security Role Required Clearance Level

Information Assurance Manager

The IAM is part of Headquarters Air Force Flight Standards Agency (HQ AFFSA) designated in writing by the commanding officer with the authority to execute the command IA program and ensure compliance with the service IA program requirements. The IAM is responsible to the local IA authority for ensuring the security of each IT system, and ensuring that it is approved, operated, and maintained throughout its life cycle per the Authorizing Official (AO) approved Risk Management Framework (RMF) documentation. The IAM is responsible for

Secret

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 15 assisting in creating and maintaining accreditation packages. IAM will require IA certification under Department of Defense (DoD) 8570.

System Administrator

Responsible for ensuring all computing and network equipment is properly installed, configured, maintained, and functioning as intended. The responsibilities of this role include system user account administration, installation of system updates and patches, software and hardware, performance of system backups, performance of audit reviews, and installation and maintenance of VPN keys. RMC IAM/Information Assurance Officer (IAO) and system administrator will require IA certification under DoD 8570.

Secret

RMC

Administrator

Access and manage the RSMS, RMM, PMDT, Multi-Access Remote Control (MARC), and HSComm programs. The RMC Administrator is responsible for management and remote restoration of NAVAID equipment outages. RMC administrators’ computer and device access are via personal account only.

Secret

RMC User Access and monitor the RSMS, RMM, PMDT, Multi-Access Remote Control (MARC), and HSComm programs. The RMC User is responsible for monitoring the NAVAID equipment and remote restoration of outages. RMC computer and device access are via personal account only.

Secret

ATC Controller Access to the RSDU in the control tower to monitor and control airfield NAVAIDs through standard user accounts. Note: Will not always be an ATC controller, but will be military, contractor or DoD (Department of Defense) civilian.

Secret

5.0 HARDWARE LIST

5.1.1. RMC Remote Access Equipment

All hardware devices are within the accreditation boundary.

RMC Maintenance Laptop: The RMC uses a single maintenance laptop to connect to the remote airfield sites via VPN tunnel to monitor and maintain the NAVAID equipment (Remote Maintenance Monitor / Portable Maintenance Data Terminal).

The laptop uses a specialized Windows 10 Secure Host Baseline (SHB) operating system and is secured with Windows-native password encryption capabilities (MD4 hashing). The laptop’s hard drive is AES encrypted using Microsoft BitLocker.

Support Lab Router: The Cisco 4321 Integrated Systems Router is used to provide switching for equipment and routing capabilities between the BAHOSL, remote airfields, and the RMC via NIPRNet or Black Core networks.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 16

The Cisco 4321 router is configured to only allow Maintenance through a Secure Socket Shell (SSH) client or via serial port. This device is hardened with the latest Security Technical Implementation Guide (STIG) and all unnecessary services and ports are disabled. Access Control Lists are utilized to permit only authorized networks and IP addresses to connect.

RMC Adaptive Security Appliance: The Cisco 5506-X ASAs are used to provide IPSec VPN connection from the BAHOSL and/or the RMC site to each of the airfield/D-TACAN sites. The RMC has a one-to-many connection. The Cisco ASDM client can be used to log in to and view the ASA at each airfield site from the RMC. Enable passwords are encrypted using MD5 hashing.

Configuration of the ASAs is accomplished by BAHOSL Engineers and all changes are executed remotely after being first verified in a lab environment.

Network Extension Unit: The Raytheon NXU-2A Network Extension Unit connects communications equipment to an Ethernet network using RoIP technology. The NXU-2A multiplexes voice audio and digital data over an Ethernet network. The NUX-2A also eliminates any pilot tones or in-band signaling that might otherwise be required.

Although NXU-2A maintenance can be via serial port, telnet, or Web browser client, the NARAS NXU-2A security level is set to 248 which limits management access to a local serial connection.

IDA Handset: The IDA handset produces tones that are unique to the various commands being sent to the T6TR flight check radio via the NXU-2A in the D-TACAN or Glideslope shelter. It also sends the analog voice to the NXU-2A which converts it to RoIP and sends it to the FC radio via the network where it is received by the NXU-2A. The NXU-2A unpacks the RoIP data from the network and routes the audio directly to the T6TR flight check radio via the MARC Audio input.

Maintenance is local configuration only. The IDA handsets are specific to radio use only and the Ethernet port is not connected to the RMC network.

UPS: The Tripp Lite Smart Online UPS system is an online, double-conversion Uninterruptible Power Supply (UPS) providing sine wave power regulated to ±2% of the selected output voltage.

Output power is supplied from the UPS battery system continuously, whether being powered from commercial power or the UPS battery storage system. The UPS protects against brownouts and power surges and provides a limited amount of backup runtime during complete loss of commercial power. Maintenance is performed via front panel menus or via a serial port. No network management is configured for the UPS which requires an optional Simple Network Management Protocol (SNMP)/Web card for network connectivity.

Table 5-1 Remote Access Hardware List

Device Name Manufacturer Model Firmware

IA

Enabled (Yes/No)

Purpose

RMC

Maintenance Laptop

Toshiba C70 v8.7.1 Y Windows-based laptop for remote monitoring, configuration, and troubleshooting of NAVAIDs

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 17

RMC Router Cisco 4321/K9 Cisco ONE ISR

(2GE,2NIM,4G

FLASH,4G

DRAM,IPB)

Y RMC Routing, Blackcore and NIPRNet connections, switching for local RMC devices

Adaptive Security Appliance

Cisco ASA- 5506-X- K9

ASA 5506-X

with FirePOWER services, 8GE, AC, 3DES/AES

Y VPN Connection between airfield sites and RMC, and between RMC and Test Bed

Network Extension Unit

Raytheon NXU- 2A N/A Y Flight Check Radio control (serial over Ethernet) and Radio Over IP capability

IDA Handset IDA Corporation 24-66 N/A N

Flight Check Radio handset interface, voice/microphone interface with NXU-2A

UPS

TrippLite

SU100

0RTXL

CD2U

N/A N Uninterruptible Power Supply for NARAS equipment

5.1.2. RCSU

All hardware devices are within the accreditation boundary.

Airfield Adaptive Security Appliance: The Cisco 5506-X ASA located at remote airfields are the same model as those installed at the RMC and the BAHOSL. Likewise, they are used to provide IPSec VPN connection from the airfield/D-TACAN sites to the BAHOSL and/or the RMC.

Maintenance and management is performed remotely by Booz Allen Hamilton and/or RMC technicians. The ASA can be accessed locally via password protected console port in the event of an emergency.

Configuration of the ASAs is accomplished by BAHOSL Engineers and all changes are executed remotely after being first verified in a lab environment.

Juniper SSG-5: The Juniper SSG-5 acts as a bridge for RCSU equipment that is geographically separated from the Cisco ASA. Where possible, the Cisco ASA is installed in close proximity to the RCSU equipment and the bridge group is configured on the ASA, preventing the need for the

SSG-5

Maintenance is via an SSH client, serial port, or HTTPS Juniper browser client.

2238: The Small Form Factor RCSU is also normally installed in a maintenance room, but due to its small size, it can easily be located in an ATC tower cab, as a replacement for older equipment.

D-TACANs utilize a ruggedized version of the Small Form Factor RCSU part number 002238-0412 which is housed in a shock-mounted enclosure. The Small Form Factor RCSU consists of the following equipment, integrated into the 5U chassis:

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 18

Embedded Personal Computer (PC), running Microsoft Windows 10 SHB.

Six slot card cage containing any of the following:

• Modem and tone-based NAVAIDs interface cards

• Surge Suppression cards

• I/O Controller card

• Card-cage power supply card

• UPS, consisting of a battery and Battery Charging Power Supply card

• 10.4” LCD/Touchscreen Monitor

The 2238 is also available as a full-sized industrial unit capable of interfacing a greater complement of NAVAIDs. Maintenance is via a local Windows 10 administrative configuration account. Security Policy settings are in accordance with the most current STIGs.

RF Modem: Presently, the RF modems are supplied with the D-TACAN system. The Microhard IP320n Ethernet RF Modem, in pairs, provides the Ethernet RF link or bridge between the NAVAIDs shelter and the RCSU. The second modem is installed in each individual NAVAIDs. The modems are configured as a simple point-to-point wireless network. The transceiver in the RCSU is configured as the master and the NAVAID transceiver is configured as the slave. The transceivers operate in the 310 Mega-Hertz (MHz) to 390 MHz frequency range. The IP Series employs Frequency Hopping Spread Spectrum (FHSS). The transceiver is programmable from 300mW to 1W with the RF power being delivered via a directional Yagi antenna. The sensitivity of the receiver is - 104dBm @ 345kbps data rate. This rate supports a 10/100Base-T IEEE 802.3 transparent Ethernet data stream. The primary radio configuration frequency tables include up to 50 separate frequencies for FHSS.

There is significant security inherent in the IP Series’ proprietary design and technology implementation. Due to the frequency and encryption capabilities, the RF modem is restricted for US military use only. All configuration of the IP Series is accomplished with a PC. Although Telnet, Hypertext Transfer Protocol (HTTP), SSH, and HTTPS are supported by the RF Modem, User Interface access via Telnet, and HTTP are disabled. WPA Encryption is configured for master/slave communications. The RF Modem on the 2238 side must have WPA keys matched to the RF Modem on the NAVAIDs side.

Transmission power levels are adjustable, and the modems are configured in the field to use the minimum required power levels required for reliable communications and minimum fade margin. Assuming adequate antenna heights, a basic formula to determine if an adequate radio signal path exists (i.e. there is a reasonable fade margin to ensure reliability) is:

Fade Margin = System Gain - Path Loss

Where all values are expressed in dB.

Minimum desired fade margin is 20dB.

System gain is calculated as follows:

System Gain = Transmitter Power + (Transmitter Antenna Gain - Transmitter Cable and Connector Losses) + (Receiver Antenna Gain - Receiver Cable and Connector Losses) + | Receiver Sensitivity |.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 19

Where all values are expressed in dB, dBi, or dBm, as applicable.

Assuming a path loss of 113dB for this example, the fade margin = 143-113 = 30dB.

30dB exceeds the desired fade margin of 20dB, therefore this radio communications link would be very reliable and robust.

For example, the following gain and loss list would result in a system gain of 140dB:

Tx power = 30dBm

Tx antenna gain = 6dBi

Tx cable/connector loss = 2dB

Rx antenna gain = 3dBi

Rx cable/connector loss = 2dB

Rx sensitivity = -105dBm

The following table presents examples of actual path loss measurements taken in an open rural environment; the path loss numbers do not apply to urban or non-LOS environments.

Table 5-2 Path Loss Measurements in an Open Rural Environment

Distance (km)

Base Height (m)

Mobile Height (m)

Path Loss (dB)

5 15 2.5 116.5

5 30 2.5 110.9

8 15 2.5 124.1

8 15 5 117.7

8 15 10 105

16 15 2.5 135.3

16 15 5 128.9

16 15 10 116.2

16 30 10 109.6

16 30 5 122.4

16 30 2.5 128.8

Once the equipment is deployed, average receive signal strength may be viewed in the System Information, Radio Information display.

TP-Ethernet: The Patton Electronics CopperLink 1314 Ethernet Twisted Pair (TP) Extender offers a wired Ethernet connection from the NAVAID to the RCSU as an alternative to the RF wireless Ethernet link.

The RCSU Site has a CopperLink Twisted Pair Extender which provides an Ethernet Bridge between the NAVAIDs and RCSU site.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 20

There is no configuration required to enable the CopperLink to operate correctly. The units are Plug-N-Play. There is a requirement for one to be a local unit and the opposite end to be a remote unit. The label on the bottom side of each unit will indicate either local or remote. Both ends CANNOT BE THE SAME CONFIGURATION; this will not work. This is not a field programmable configuration. The units must be purchased as local AND remote units. The local unit is located in the NAVAIDs shelter; the remote unit is located in the RCSU site.

The CopperLink twisted pair system has the capability to Auto-adjust the data rate to the maximum it can sustain given the twisted pair line conditions. The CopperLink system will support Auto-Sensing 10 or 100Base-T in full duplex mode. The CopperLink devices are configured via dual in-line package (DIP) switches and remote access is not possible.

Serial-To-Ethernet Converter: The INSYS Ethernet 5.1 devices provide Serial-to-Ethernet and Ethernet-to-Serial conversions. The devices can be set up in a stand-alone mode for direct RMM to D-TACAN/TACAN/DME communication or in a leased line configuration to transport serial commands over an Ethernet connection. The HSComm software provides the capability to configure the INSYS Ethernet 5.X via serial or TCP/IP port 23.

Although the INSYS device allows remote configuration, this capability has been disabled and only local RS-232 (Serial Data Interface) configuration is allowed.

Phone Extender: The TC Communications TC1910 Ethernet Phone Extender provides the interface between an external Public Switched Telephone Network (PSTN) connection at the RCSU site and the Flight Check Radio audio at the D-TACAN shelter using the Ethernet data link between the two sites. The phone extender was supplied with the D-TACAN for non-RoIP radio access.

The TC1910 Ethernet Phone Extender link requires a different TC1910 model at each end of the data interface.

• TC1910S-1-FXO-12: This unit is located in the RCSU Site and is configured as a Foreign Exchange Office (FXO). This is the end that connects to the external PSTN.

The TC1910S requires a full duplex network data stream. The TC1910 is configurable via a Web browser user interface to view network settings and change the IP addresses as required. Once power is applied to the TC1910S units and the network connection is available they will automatically make connection and ready to process telephone traffic.

Note: All phone line connectivity is removed once the system is connected to the VPN and the TC1910 becomes a piece of standby equipment. Once the system is connected to the network, the TC1910 cannot be used (due to policy) and have the D-TACAN W47 Ethernet and W54 phone line connectors removed and secured. Likewise, the RCSU W30 Ethernet and W27 phone line connectors are removed and secured.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 21

Table 5-3 RCSU Hardware List

Device Name Manufacturer Model Firmware IA Enabled

(Yes/No) Purpose

Site Adaptive Security Appliance

Cisco ASA- 5506- X disk0:/asa861- 2-smp-k8.bin Boot microcode : CNPx-

MC- BOOT-2.00

SSL/IKE microcode :

CNPx-MC-SSL-

PLUS-0014

IPSec microcode :

CNPx-MC- IPSEC-

MAIN-0014

Y Spoke VPN connection (one per site) to Airfield or D-

TACAN

SSG-5 Juniper SSG-5 HW: 710(0) Firmware: 6.2.0r5.0

ID: 016812201300

Y Legacy Juniper Firewall device, used as Ethernet switch only

2238 Selex ES 2238 v6.1.0.1 Y NAVAIDs monitoring and maintenance

RF Modem Microhard IP320n V2.2.12 1R4 Y Provides RF Ethernet/Serial Bridge connectivity over spread spectrum 310-390 MHz

Twisted- Pair Ethernet Adapter

Patton CL1314 1.1.6 N Provides extended range Ethernet connectivity over Twisted-Pair wires

Serial-To- Ethernet Converter

INSYS Ethernet 5.1

V1.29_SRAM

28.01.2010

Y Serial-to-Ethernet and Ethernet-to- Serial conversion

FXO Phone Extender

TC

Communications

TC1910 1.10 Y Phone line extension (PSTN) over Ethernet

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 22

Device Name Manufacturer Model Firmware IA Enabled

(Yes/No) Purpose

UPS TrippLite SU1000R

TXLCD2U

N/A N Uninterruptible Power Supply for NARAS equipment

5.1.3. NAVAIDs

All hardware devices are outside of the accreditation boundary.

RF Modem: The Microhard IP320n Ethernet RF Modem, in pairs, provides the Ethernet RF link or bridge between the NAVAIDs shelter and the RCSU. The other modem is located at the RCSU site. The modems are configured as point-to-point wireless network. The transceiver in the RCSU is configured as the master and the D-TACAN transceiver is configured as the slave. The transceivers operate in the 310 MHz to 390 MHz frequency range. The transceiver is programmable from 300mW to 1W with the RF power being delivered via a directional Yagi antenna. The sensitivity of the receiver is -104dBm @ 345kbps data rate. This rate supports a 10/100Base-T IEEE 802.3 transparent Ethernet data stream.

There is significant security inherent in the IP series’ proprietary design and technology implementation. Due to the frequency and encryption capabilities, the RF modem is restricted for U.S. military use only. All configuration of the IP series is accomplished with a PC. Although Telnet, HTTP, SSH, and HTTPS are supported by the RF Modem, user interface access via Telnet, and HTTP are disabled. See section 5.0 B for RF minimum power calculations. The RF Modem on the NAVAIDs side must have WPA keys matched to the RF Modem in the 2238.

TP-Ethernet: The Patton Electronics CopperLink 1314 Ethernet TP extender offers a wired Ethernet connection from the NAVAID to the RCSU as an alternative to the RF wireless Ethernet link.

The NAVAIDs site has a CopperLink twisted pair extender which provides an Ethernet bridge between the NAVAIDs and RCSU site.

There is no configuration required to enable the CopperLink to operate correctly. The units are Plug-N-Play. There is a requirement for one to be a local unit and the opposite end to be a remote unit. The label on the bottom side of each unit will indicate either local or remote. Both ends CANNOT BE THE SAME CONFIGURATION; this will not work. This is not a field-programmable configuration. The units must be purchased as local AND remote units. The local unit is located in the NAVAIDs shelter; the remote unit is located in the RCSU site.

The CopperLink twisted pair system has the capability to Auto-adjust the data rate to the maximum it can sustain given the twisted pair line conditions. The CopperLink system will support Auto-Sensing 10 or 100Base-T in full duplex mode. The CopperLink Devices are configured via DIP switches and remote access is not possible.

Serial-To-Ethernet Converter: The INSYS Ethernet 5.1 devices provide Serial-to-Ethernet and Ethernet-to-Serial conversions. The devices can be set up in a stand-alone mode for direct RMM to D-TACAN/TACAN/DME communication or in a leased line configuration to transport serial commands over an Ethernet connection.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 23

Although the INSYS device allows remote configuration, this capability has been disabled and only local RS-232 configuration is allowed.

Phone Extender: The TC Communications TC1910 Ethernet Phone Extender provides the interface between an external PSTN connection at the RCSU site and the Flight Check Radio audio at the D-TACAN shelter using the Ethernet data link between the two sites. The phone extender was supplied with the D-TACAN for non-RoIP radio access.

The TC1910 Ethernet Phone Extender link requires a different TC1910 model at each end of the data interface.

• TC1910S-2-FXS-12: This is the FXS or Foreign Exchange Subscriber end of the link. It processes the information from the TC1910 (FXO) at the RCSU Site via the Ethernet and outputs subscriber format analog phone data to the ACG 2000 i.e. it supplies data to the ACG 2000 that is in the same format as if the ACG 2000 were connected to an external

PBX.

The TC1910S requires a full duplex network data stream. The TC1910 is configurable via a Web browser user interface to view network settings and change the IP addresses as required. Once power is applied to the TC1910S units and the network connection is available they will automatically make connection and ready to process telephone traffic.

Once the system is connected to the network, the TC1910 cannot be used due to policy. For example, the D-TACAN W47 Ethernet and W54 phone line connectors are removed and secured.

Likewise, the RCSU W30 Ethernet and W27 phone line connectors are removed and secured.

Radio Interconnect: The E1-RIC or E1 Radio Interconnect Unit provides the digital interface between the NXU-2A Network Extension Unit and the T6TR transceiver to support the MARC System. The “E1” refers to the ITU-T G.703 2.048 Mbps interface between the E1-RIC and the T6TR transceiver. e The E1- RIC receives data from the NXU-2A RS-232 interface J4 to the Facilities connector on the E1-RIC. This is the data port that carries the MARC radio control data to/from the T6TR transceiver to the external Maintenance Laptop running the MARC software.

There is no remote maintenance required for the Radio Interconnect.

Network Extension Unit: The Raytheon NXU-2A Network Extension Unit connects communications equipment to an Ethernet network using RoIP technology. The NXU-2A multiplexes voice audio and digital data over an Ethernet network. The NUX-2A also eliminates any pilot tones or in-band signaling that might otherwise be required. The NXU-2A at the NAVAID is the server system. Maintenance is via serial port, or Web browser client.

Flight Check Radio: Park Air T6TR Flight Check Radio is the radio transceiver the ground crew can use to communicate with the flight check aircraft during test and certification of the D- TACAN system. The Park Air T6TR transceiver is an amplitude modulation (AM) radio with the following specifications.

• Frequency: VHF 118 MHz to 136.975 MHz / 25 KHz channel spacing

• Power Output – 5W to 50W carrier power

• VSWR - >2.5:1 @ full power output

• Receive Sensitivity - -107dBm for >10dB (S+N)/N

• Receive Selectivity with 2.5KHz bandwidth - >80dB @± 2.5KHz

• Remote control plus Equipment Updates via the T1 / E1 port

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 24

Maintenance is via MARC software (serial over Ethernet) on the RMC Maintenance laptop.

PSTN Modem: The US Robotics Model 3453 56K external modem provides the data link between the D-TACAN/TACAN/DME RMM data from the PSTN port to an external PC platform connected to the PSTN and running the RMM software. The PSTN data protocol is 9600 baud (bits per second), 8-bits, 1-stop bit, and no parity. The modem is powered by a “wall wart” type power supply. Maintenance is via serial port.

Note 1: All phone line connectivity is removed once the system is connected to the VPN and the PSTN Modem becomes a piece of standby equipment. For example, D-TACAN Cables W21 and W50 are disconnected and secured when the system is connected to the network.

Note 2: Localizers, Glideslopes, and VORs have built-in internal modems.

D-TACAN: The D-TACAN system provides range and bearing information, relative to the location of the Beacon station, to aircraft. The D-TACAN model 2010 system is mounted on a trailer with components to operate independent of fixed resources and is capable of being remotely monitored and controlled. Additional components include diesel powered generator, backup batteries, modems, RF radio, laptop computer, and router.

D-TACAN Router: The Cisco 2800 series Integrated Systems router is used to provide switching for the D-TACAN equipment and future routing capabilities for direct-to-NAVAID connections.

The Cisco 2811 is used only in D-TACAN configurations. Also, the Cisco 2811 is at the end of life and the AN/TRN-48 systems the Cisco 2811 will be replaced with Cisco 2911 units through attrition. Maintenance of the 2811 is via an SSH client or via serial port only.

The Cisco 2811 router is configured to only allow maintenance is via an SSH client or via serial port. Additional configuration commands specify encrypted password length of 15 characters with security authentication failure rate of 3. Buffered logging is enabled with size of 51200.

Complaint DoD warning banners are specified for login, EXEC, and message of the day.

TACAN: The TACAN provides the same functionality as the D-TACAN with the exception that it is mounted in a fixed site shelter.

DME: The DME System provides approaching aircraft with a slant distance from a known location. Two or more observations can provide an aircraft with a triangulation (fix) point to enable its precise position to be calculated.

The DME System consists of an aircraft interrogator (a transmitter and receiver) which interrogates a ground-based transponder, the frequency and Morse identification of which is known. The system provides a slant range measurement, the maximum range of which can be up to 200 or 300 nautical miles subject to power output, the height of the aircraft, and the terrain surrounding the ground-based transponder.

The airborne transponder is known as an interrogator and the ground-based transponder provides replies to the interrogations. The ground-based transponder is known as Distance Measuring Equipment (DME). The DME system is capable of being monitored and controlled remotely using the RCSU.

ILS Localizer: The Model 2100 Capture-Effect Localizer is part of an ILS. The Localizer provides azimuthal (horizontal) guidance to aircraft during instrument landings.

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 25

The Model 2100 Capture-Effect Localizer is mounted on a wall, inside a shelter. The RCSU provides the ability to check ILS Localizer status and adjust parameters from the control tower, or via the RMM from other remote facilities.

The Capture-Effect Localizer is typically installed about 1,000 feet from the stop end of the runway with the antenna array located on the extended runway centerline. The equipment shelter is located off to one side, approximately 250 ft. from the centerline. The Capture-Effect Localizer utilizes a 14 element or 20 element Log Periodic Dipole (LPD) array. This array is directional and provides front course only.

ILS Glide Slope: The Model 2100 Glideslope is part of an ILS. The glideslope provides elevation, i.e. altitude above the terrain below, guidance to aircraft during instrument landings.

The Model 2100 Glideslope is mounted on a wall inside a shelter. System status can be checked, and parameters adjusted from the control tower through the RCSU or other remote facility through the RMM.

VHF Omnidirectional Radio Range (VOR): The Selex model 1150 is a short-range radio navigation system for aircraft, enabling aircraft with a receiving unit to determine their position and stay on course by receiving radio signals transmitted by the beacon. It utilizes frequencies in the VHF band from 108 to 117.95 MHz.

Very High Frequency Omni-Directional Radio Range / Tactical Air Navigation Aid (VORTAC):

The VORTAC NAVAID is the colocation of a VOR and a TACAN. NAVAIDs are independently managed.

Table 5-4 NAVAIDs Hardware List

Device Name Manufacturer Model Firmware IA Enabled (Yes/No) Purpose

RF Modem Microhard IP320n V2.2.12 1R4 Y Provides RF Ethernet/Serial Bridge connectivity over spread spectrum 310-390 MHz

Twisted-Pair Ethernet Adapter

Patton CL1314 1.1.6 N Provides extended range Ethernet connectivity over Twisted-Pair wires

Serial-To- Ethernet Converter

INSYS Ethernet 5.1

V1.29_SRAM

28.01.2010 Y

Serial-to-Ethernet and Ethernet-to- Serial conversion

FXS Phone Extender

TC

Communications TC1910 1.10 Y Phone line extension (PSTN) over Ethernet

Radio Interconnect Park Air Systems E1RIC N/A N Radio Access Point

NARAS Architecture/System Description FOR OFFICIAL USE ONLY 26

Device Name Manufacturer Model Firmware IA Enabled (Yes/No) Purpose

NXU-2A Raytheon NXU-2A 1.02 Y Flight Check Radio control (serial over Ethernet) and Radio Over IP capability

Flight Check Radio Park Air Systems T6TR N/A N

Remote Radio Communication for Flight Checks and inspections.

PSTN

Modem US Robotics 3453

SUP: 2.2.05

DSP: 2.0.32

DAA: 0013

N

RMM Dial-in PSTN modem (disconnected when configured for network connectivity)

ILS Localizer and Glideslope

Selex ES 2100 N/A Y Instrument Landing System

D-TACAN Moog Fernau 2010 N/A Y D-TACAN

D-TACAN

Router Cisco 2811 TBD Y

D-TACAN Ethernet Switching and future Direct-to-NAVAID routing

F-TACAN Moog Fernau 2010 N/A Y Fixed base TACAN

DME Moog Fernau 2020 N/A Y Distance Measurement Equipment

VOR Selex ES 1150 N/A Y VHF Omnidirectional Radio Range

Table 5-5 ILS Localizer and Glideslope Hardware List

Reference Manufacturer

IA

Enabled (Y/N)

CC Eval Status* Device Name Model

Number

MCPU Microprocessor Intel Y N/A Microcontroller

OTP-ROM

80C196KC-

PMDT Workstation Dell Y EAL 4+ Laptop D630

Main Digital Signal…