Filter
Top Products
Fabric OS Administrator’s Guide 617
53-1002745-02
FIPS mode configuration
B
Power-on self tests
A power-on self-test (POST) is invoked by powering on the switch in FIPS mode and does not require
any operator intervention. If any KATs fail, the switch goes into a FIPS Error state, which reboots the
system to start the test again. If the switch continues to fail the FIPS POST, you will need to return
your switch to your switch service provider for repair. Refer to the Fabric OS Troubleshooting and
Diagnostics Guide for information about preparing a case for your service provider.
Conditional tests
These tests are for the random number generators and are executed to verify the randomness of
the random number generator. The conditional tests are executed each time prior to using the
random number provided by the random number generator.
The results of the POST and conditional tests are recorded in the system log or are output to the
local console. This action includes logging both passing and failing results. Refer to the Fabric OS
Troubleshooting and Diagnostics Guide for instructions on how to recover if your system cannot get
out of the conditional test mode.
FIPS mode configuration
By default, the switch comes up in non-FIPS mode. You can run the fipsCfg --enable fips command
to enable FIPS mode, but you must configure the switch first. Self-test mode must be enabled
before FIPS mode can be enabled. A set of prerequisites (as shown in Table 87) must be satisfied
for the system to enter FIPS mode. To be FIPS-compliant, the switch must be rebooted. For
directors, either reboot both CPs, or power the chassis down and then up again. KATs are run on
the reboot. If the KATs are successful, the switch enters FIPS mode. If the KATs fail, then the switch
reboots until the KATs succeed. If the switch cannot enter FIPS mode and continues to reboot, you
must return the switch to your switch service provider. For information about how to prepare a
service provider case, refer to the Fabric OS Troubleshooting and Diagnostics Guide.
When the switch successfully reboots in FIPS mode, only FIPS-compliant algorithms are run.
NOTE
RPC is not supported in FIPS mode.
Table 87 lists Fabric OS features and their behaviors in FIPS and non-FIPS mode.
TABLE 87 FIPS mode restrictions
Features FIPS mode Non-FIPS mode
Configupload/ download/
supportsave/ firmwaredownload
SCP only FTP and SCP
DH-CHAP/FCAP
hashing algorithms
SHA-1 MD5 and SHA-1
DH-CHAP Shared Secret Minimum length of 32 bytes for secret used
in in-flight encryption
Minimum length of 8 bytes for
secret
HTTP/HTTPS access HTTPS only HTTP and HTTPS
HTTPS protocol/algorithms TLS/AES128 cipher suite TLS AES 128 cipher suite
SSL is not supported.