Technical Note : FortiOS and EAL certification.

[Jonathan_Body_FTNT]

Description

The Evaluation Assurance Level (EAL1 through EAL7) of an IT product or system is a numerical grade assigned following the completion of a Common Criteria security evaluation, an international standard in effect since 1999. The EAL level does not measure the security of the system itself, it simply states at what level the system has been tested.

Fortinet submitted the following products and firmware versions for EAL certification:

• FortiMail v3.0 MR5 Secure Messaging Platform (Level EAL 2+, obtained June 4th, 2010)
  
• FortiGate 50B, 200A, 300A, 310B, 500A, 800, 1000A, 3016B, 3600, 3600A, 3810A-E4, 5001SX, 5001FA2, 5001A-DW and FortiWiFi-50B Unified Threat Management Solutions and FortiOS 3.0 CC Compliant Firmware (Level EAL 4+, obtained November 28th, 2008)
  
• FortiGate 50A, 60, 100A, 200A, 300A, 800, 3000, 3600, 5001 Antivirus Firewalls and FortiOS 2.80 Firmware (Level EAL 4+, obtained February 28th, 2005)

Copies of the certification reports and certificates of evaluation are available from the Communications Security Establishment of Canada (http://www.cse-cst.gc.ca/its-sti/services/cc/cp-pc-eng.html)

The EAL certification project for FortiOS 4.0 MR2 was started in 2011.

Scope
FortiOS 3.0 MR4 and FortiOS 4.2 MR2.