440
Configuring FIPS
FIPS, developed by the NIST of the United States, specifies the security requirements for cryptographic
modules. FIPS 140-2 defines four levels of security, simply named "Level 1" to "Level 4" from low to
high. The device supports Level 2.
Unless otherwise noted, in this document, FIPS refers to FIPS 140-2.
Configuration procedure
Prerequisites
Before enabling FIPS mode, complete the following tasks:
•
Configure the login username and password. The password must comprise no less than 6
characters and must contain uppercase and lowercase letters, digits, and special characters.
•
Delete all MD5-based digital certificates.
•
Delete the DSA key pairs that have a modulus length of less than 1024 bits and all RSA key pairs.
Enabling FIPS mode
After enabling FIPS mode, you must restart the device to validate the configuration.
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enable FIPS mode.
fips mode enable
Required
Not enabled by default
Settings changed by enabling FIPS mode
After you enable FIPS mode and restart the device, the following changes occur:
•
The FTP/TFTP server is disabled.
•
The Telnet server is disabled.
•
The HTTP server is disabled.
•
SNMP v1 and SNMP v2c are disabled. Only SNMP v3 is available.
•
The SSL server only supports TLS1.0.
•
The SSH server does not support SSHv1 clients.
•
Generated RSA/DSA key pairs have a modulus length from 1024 to 2048 bits.
•
SSH, SNMPv3, IPsec, and SSL do not support DES, RC4, or MD5.
