Black Box ET0010A, Руководство пользователя CLI

Страница: 121 / 212

FIPS 140-2 Level 2 Operation
122 ETEP CLI User Guide
Entering FIPS Mode
To place the ETEP in FIPS mode, issue the fips-mode-enable command. To verify the state of FIPS
mode on the ETEP, issue the show running-config CLI command.
Placing the ETEP in a FIPS-compliant configuration can take several minutes. Some communications
services are reset when FIPS is enabled and disabled. Open SSH sessions are terminated, and cannot be
reestablished until FIPs mode is fully operational.
When putting the ETEP in FIPS mode, the ETEP performs the following actions and self-tests:
●
Runs self-tests during the boot process and when entering FIPS mode that include cryptographic
algorithm tests, firmware integrity tests, and critical function tests
●
Performs a software integrity test
●
Clears pre-existing polices and keys, as described in Table 66 .
●
Generates a new self-signed certificate on the management interface
●
Removes all externally signed certificates
●
Resets passwords to the factory defaults
●
Closes remote SSH client sessions
Operational Notes
Entering FIPS mode may cause some delays when communicating with the ETEP.
●
When the ETEP is rebooted with FIPS mode enabled, the ETEP does not become operational until
30-60 seconds after the login prompt is displayed. In the interim, attempts to communicate with the
ETEP from ETEMS or the CLI result in error messages (attempting to access a locked shared
resource or failure to create input stream). If you receive an error message, wait several seconds and
retry.
●
The Ethernet management interface uses FIPS-approved cipher and authentication algorithms for SSL
and SSH connections. When operating in FIPS mode, it can take 30-40 seconds to establish an SSH
session.
●
If you used SSH to manage the ETEP prior to entering FIPS mode, you may not be able to establish
an SSH session after FIPS is enabled. To correct this, clear the known host entry for your SSH client
and retry.
Table 66 Effects of clearing policies and keys when entering FIPS mode
Policy Type Action upon entering FIPS mode
Distributed key policies Traffic passes in the clear until new encryption policies are
created and deployed to the ETEP.
Point-to-point Layer 2 policies Keys are automatically renegotiated. Traffic is discarded in the
interim.
Management port policies Keys are automatically renegotiated. Traffic is discarded in the
interim.