Service Manual

15
FIPS Cryptography
This chapter describes how to enable FIPS cryptography requirements on Dell Networking platforms. This feature provides
cryptographic algorithms conforming to various FIPS standards published by the National Institute of Standards and Technology
(NIST), a non-regulatory agency of the US Department of Commerce. FIPS mode is also validated for numerous platforms to meet
the FIPS-140-2 standard for a software-based cryptographic module.
NOTE: The Dell Networking OS uses an embedded FIPS 140-2-validated cryptography module (Certicate #1747)
running on NetBSD 5.1 per FIPS 140-2 Implementation Guidance section G.5 guidelines.
NOTE: Only the following features use the embedded FIPS 140-2-validated cryptography module:
• SSH Client
• SSH Server
• RSA Host Key Generation
• SCP File Transfers
Currently, other features using cryptography do not use the embedded FIPS 140-2-validated cryptography module.
Conguration Tasks
To enable FIPS cryptography, complete the following conguration tasks.
• Preparing the System
• Enabling FIPS Mode
• Generating Host-Keys
• Monitoring FIPS Mode Status
• Disabling FIPS Mode
Preparing the System
Before you enable FIPS mode, Dell Networking recommends making the following changes to your system.
1. Disable the Telnet server (only use secure shell [SSH] to access the system).
2. Disable the FTP server (only use secure copy [SCP] to transfer les to and from the system).
3. Attach a secure, standalone host to the console port for the FIPS conguration to use.
Enabling FIPS Mode
To enable or disable FIPS mode, use the console port.
Secure the host attached to the console port against unauthorized access. Any attempts to enable or disable FIPS mode from a
virtual terminal session are denied.
When you enable FIPS mode, the following actions are taken:
• If enabled, the SSH server is disabled.
• All open SSH and Telnet sessions, as well as all SCP and FTP le transfers, are closed.
260
FIPS Cryptography