Users Guide
Level 1, Level 2, Level 3, and Level 4. The FIPS 140–2 series stipulate that all communicative interfaces must have the following security
properties:
• authentication
• condentiality
• message integrity
• non-repudiation
• availability
• access control
If any of the properties depend on cryptographic algorithms, then FIPS must approve these algorithms.
By default, the FIPS mode is disabled. When FIPS is enabled, the minimum key size for OpenSSL FIPS is SSH-2 RSA 2048 bits.
NOTE: PSU rmware update is not supported when the FIPS mode is enabled in the chassis.
For more information, see CMC Online Help.
The following features/applications support FIPS.
• Web GUI
• RACADM
• WSMan
• SSH v2
• SMTP
• Kerberos
• NTP Client
• NFS
NOTE
: SNMP is not FIPS-compliant. In FIPS mode, all SNMP features except Message Digest algorithm version 5 (MD5)
authentication work.
Enabling FIPS Mode Using CMC Web Interface
To enable FIPS:
1 In the left pane, click Chassis Overview.
The Chassis Health page is displayed.
2 On the menu bar, click Network.
The Network Conguration page is displayed.
3 Under the Federal Information Processing Standards (FIPS) section, from the FIPS Mode drop-down menu, select Enabled.
A message is displayed that enabling FIPS resets CMC to the default settings.
4 Click OK to proceed.
Enabling FIPS Mode Using RACADM
To enable FIPS mode, run the following command:
racadm config –g cfgRacTuning –o cfgRacTuneFipsModeEnable 1
.
Conguring
CMC 69