NetApp AltaVault AVA400, Administration Manual

Page: 105 / 276

NetApp AltaVault Cloud Integrated Storage Administration Guide 105
Beta Draft
Configuring AltaVault for FIPS compliance Configuring AltaVault appliances for FIPS-compliant cryptography
Features That Use Cryptographic Libraries Outside the NetApp Cryptographic
Security Module Boundary

Kerberos

SSH with unapproved ciphers
Features with Protocol Specifications That Can Use Noncompliant Hash Algorithms

Some cloud providers (that you use with the AltaVault) are not fully supported in FIPS mode
– AT&T Synaptic and EMC Atmos clouds are supported in FIPS mode only in service versions 2.1 and later.
Older versions use noncompliant hash algorithms.
– Not all cloud providers use FIPS 140-2 validated cryptography. It is your responsibility to ensure that the
configured cloud provider meets regulatory requirements.

Local user passwords and local authentication with MD5-based hash

NTP with MD5 authentication

RADIUS

SNMP with users configured with MD5 or DES protocols

Configuring AltaVault for FIPS compliance
To achieve FIPS compliance on an AltaVault, configure the system to run in FIPS operation mode and adjust the
configuration of any features that are not FIPS compliant.
With FIPS mode enabled, the system monitors configuration changes and provides warnings if you configure a feature
to be noncompliant with FIPS. These warning messages appear when you try to change a configuration setting to an
unsupported option. You can also view these warnings using the
show fips status
command.
Configuring AltaVault appliances for FIPS-compliant
cryptography
This section includes the following information:

“Enabling FIPS mode” on page 106

“Verifying that your system uses FIPS-compliant encryption” on page 106

“Working with features to maintain FIPS compliance” on page 107

“Account passwords” on page 107

“Cipher requirements” on page 108

“Key size requirements” on page 108

“NTP” on page 109

“RADIUS and ” on page 109

“SNMP” on page 109