Users Guide

NOTE: CMC supports enabling FIPS mode, but the feature is not validated.

By default, the FIPS mode is disabled. When you enable FIPS, the CMC is reset to the default settings. When FIPS is enabled, the

minimum key size for OpenSSL FIPS is SSH-2 RSA 2048 bits.

NOTE: You cannot update the PSU firmware when a chassis is FIPS enabled.

For more information, see CMC Online Help.

The following features/applications support FIPS.

• Web GUI

• RACADM

• WSMan

• SSH v2

• SMTP

• Kerberos

• NTP Client

• NFS

NOTE: SNMP is not FIPS-compliant. In FIPS mode, all SNMP features except Message Digest algorithm version 5

(MD5) authentication work.

Enabling FIPS Mode Using CMC Web Interface

To enable FIPS:

1. In the left pane, click Chassis Overview.

The Chassis Health page is displayed.

2. On the menu bar, click Network.

The Network Configuration page is displayed.

3. Under the Federal Information Processing Standards (FIPS) section, from the FIPS Mode drop-down menu, select Enabled.

A message is displayed that enabling FIPS resets CMC to the default settings.

4. Click OK to proceed.

Enabling FIPS Mode Using RACADM

To enable FIPS mode, run the following command:

racadm config –g cfgRacTuning –o cfgRacTuneFipsModeEnable 1

Disabling FIPS Mode

To disable FIPS mode, reset CMC to the default factory settings.

Configuring Services

You can configure and enable the following services on CMC:

• CMC Serial console — Enable access to CMC using the serial console.

• Web Server — Enable access to CMC Web interface. If you disable the option, use local RACADM to re-enable the Web Server,

since disabling the Web Server also disables remote RACADM.

• SSH — Enable access to CMC through firmware RACADM.

• Telnet — Enable access to CMC through firmware RACADM

• RACADM — Enable access to CMC using RACADM.