Fips Mode Configuration; Table 88 Table; Table 103 Fips Mode Restrictions - Brocade Communications Systems 53-1001763-02 Administrator's Manual

The results of all self-tests, for both power-up and conditional, are recorded in the system log or are
output to the local console. This includes logging both passing and failing results. Refer to the
Fabric OS Troubleshooting and Diagnostics Guide for instructions on how to recover if your system
cannot get out of the conditional test mode.

FIPS mode configuration

By default, the switch comes up in non-FIPS mode. You can run the fipsCfg
to enable FIPS mode, but you need to configure the switch first. Self-tests mode must be enabled
before FIPS mode can be enabled. A set of prerequisites as mentioned in the table below must be
satisfied for the system to enter FIPS mode. To be FIPS-compliant, the switch must be rebooted.
KATs are run on the reboot. If the KATs are successful, the switch enters FIPS mode. If KATs fail,
then the switch reboots until the KATs succeed. If the switch cannot enter FIPS mode and
continues to reboot, you must access the switch in single-user mode to break the reboot cycle. For
more information on how to fix this issue, refer to the Fabric OS Troubleshooting and Diagnostics
Guide
Only FIPS-compliant algorithms are run at this stage.
behavior in FIPS and non-FIPS mode.
TABLE 103
Features
Configupload/ download/
supportsave/
firmwaredownload
DH-CHAP/FCAP hashing
algorithms
HTTP/HTTPS access
HTTPS protocol/algorithms
IPsec
Radius auth protocols
Root account
RPC/secure RPC access
Secure RPC protocols
Signed firmware
SNMP
SSH algorithms
Telnet/SSH access
Fabric OS Administrator's Guide
53-1001763-02
FIPS mode restrictions
FIPS mode
SCP only
SHA-1
HTTPS only
TLS/AES128 cipher suite
For FCIP IPSec the DH group 1 is
FIPS-compliant and is not blocked. Usage of
AES-XCBC, MD5 and DH group 0 and 1 are
blocked.
For IPSec (Ethernet), only MD5 is blocked in
FIPS mode.
PEAP-MSCHAPv2
Disabled
Secure RPC only
TLS - AES128 cipher suite
Mandatory firmware signature validation.
Read-only operations
HMAC-SHA1 (mac)
3DES-CBC, AES128-CBC, AES192-CBC,
AES256-CBC (cipher suites)
Only SSH
FIPS mode configuration
enable fips command
--
Table 103 lists the Fabric OS feature and their
Non-FIPS mode
FTP and SCP
MD5 and SHA-1
HTTP and HTTPS
TLS/AES128 cipher suite
(SSL will no longer be
supported)
No restrictions
CHAP, PAP, PEAP-MSCHAPv2
Enabled
RPC and secure RPC
SSL and TLS – all cipher suites
Optional firmware signature
validation
Read and write operations
No restrictions
Telnet and SSH
D
523