Aruba AP-5XX Wireless Access Points with ArubaOS FIPS Firmware FIPS 140-2 Level 2 Security Policy |51
13.1. Crypto Officer Management
The Crypto Officer must ensure that the Wireless Access Point is always operating in a FIPS-Approved mode of
operation. This can be achieved by ensuring the following:
The Crypto Officer must first enable and then provision the AP into a FIPS AP mode of operation before Users
are permitted to use the Wireless Access Point (see section 13.5,
Enabling FIPS Mode on the Staging
Controller
).
Only firmware updates signed with SHA-256/RSA 2048 are permitted.
Passwords must be at least eight (8) characters long.
Only FIPS-Approved algorithms can be used for cryptographic services. Please refer to section 8.1,
FIPS
Approved Algorithms
, for the list of Approved algorithms.
The Wireless Access Point logs must be monitored. If a strange activity is found, the Crypto Officer should take
the Wireless Access Point offline and investigate.
The Tamper-Evident Labels (TELs) must be regularly examined for signs of tampering. Refer to Table 13 in
section 12.4,
Inspection/Testing of Physical Security Mechanisms,
for the recommended frequency.
When installing expansion or replacement modules for the Aruba AP-504, AP-505, AP-514, AP-515, AP-534,
AP-535 and AP-555 Wireless Access Points, use only FIPS-Approved modules, replace TELs affected by the
change, and record the reason for the change, along with the new TEL locations and serial numbers, in the
security log.
All configuration performed through the Mobility Master when configured as a managed device must ensure
that only the approved algorithms and services are enabled on the FIPS-enabled Wireless Access Point.
Refer to section 13.6,
Non-Approved Mode Configurations
for non-Approved configurations in a FIPS-Approved
mode.
The user is responsible for zeroizing all CSPs when switching modes.
13.2. User Guidance
Although outside the boundary of the Wireless Access Point, the User should be directed to be careful not to
provide authentication information and session keys to others parties.
13.3. Setup and Configuration
The Aruba AP-504, AP-505, AP-514, AP-515, AP-534, AP-535 and AP-555 Wireless Access Points meet FIPS
140-2 Security Level 2 requirements. The sections below describe how to place and keep the Wireless Access
Point in a FIPS-Approved mode of operation. The Crypto Officer (CO) must ensure that the Wireless Access Point
is kept in a FIPS-Approved mode of operation.
The Wireless Access Point can operate in one FIPS-Approved mode, Control Plane Security (CPSec) Protected AP
FIPS mode (see Table 16 above). By default, the Wireless Access Point operates in the standard non-FIPS mode.
The module also supports modes that are non-Approved in the FIPS approved mode of operation (see Table 17
above): Remote AP mode and the two (2) Mesh modes, Mesh Portal mode and Mesh Point mode.
The Access Point is managed by an Aruba Mobility Controller in FIPS mode, and access to the Mobility Controller’s
administrative interface via a non-networked general purpose computer is required to assist in placing the module
in FIPS mode. The Controller used to provision the AP is referred to as the “staging controller”. The staging
controller must be provisioned with the appropriate firmware image for the module, which has been validated to
FIPS 140-2, prior to initiating AP provisioning. Additionally, if a Mobility Master Appliance is deployed in the
environment, provisioning of the APs can be performed by passing policies down from the Mobility Master to the
Mobility Controller which then provisions the AP.
