Enabling Fips Mode - Brocade Communications Systems 53-1001763-02 Administrator's Manual

D
Preparing the switch for FIPS

Enabling FIPS mode

1. Log in to the switch using an account assigned the admin or securityAdmin role.
2. Optional: Select the appropriate method based on your needs:
3. Optional: Set the authentication protocols.
4. Install the LDAP CA certificate on the switch and Microsoft Active Directory server. Refer to the
5. Block Telnet, HTTP, and RPC using the ipfilter policy command.
6. Type the following command to block access to the boot PROM:
7.
528
•
If the switch is set for RADIUS, modify each server to use only peap-mschapv2 as the
authentication protocol using the aaaConfig
•
If the switch is set for LDAP, refer to the instructions in
page 524.
a. Type the following command to set the hash type for MD5 which is used in authentication
protocols DHCHAP and FCAP:
authutil --set -h sha1
b. Set the DH group to 1 or 2 or 3 or 4 using authUtil --set -g <n>, where the DH group is
represented by <n>.
instructions "LDAP certificates for FIPS mode"
You will need to create an IPFilter policy for each protocol.
a. Create an IP filter rule for each protocol, see
b. Add a rule to the IP filter policy, see
can use the following modifications to the rule:
ipfilter --addrule <policyname> -rule <rule_number> -sip <source_IP> -dp
<dest_port> -proto <protocol> -act <deny>
•
option can be given as any
-sip
•
option for the port numbers for Telnet, HTTP, and RPC are 23, 80, and 898
-dp
respectively
•
option should be set to tcp
-proto
c. Activate the IP filter policy, see
d. Save the IP filter policy, see
Example
ipfilter --createrule http_block_v4 --type ipv4
ipfilter --addrule http_block_v4 -rule 2 -sip any -dp 80 -proto tcp -act deny
ipfilter --activate http_block_v4
ipfilter --save http_block_v4
fipscfg –-disable bootprom
Block boot PROM access before disabling root account.
Enable signed firmware by typing the configure command and respond to the prompts as
follows:
System services
cfgload attributes
change or aaaConfig
--
on page 526.
"Creating an IP Filter policy"
"Adding a rule to an IP Filter policy"
"Activating an IP Filter policy"
"Saving an IP Filter policy"
No
Yes
remove command.
--
"Setting up LDAP for FIPS mode"
on page 153.
on page 157. You
on page 154.
on page 154.
Fabric OS Administrator's Guide
53-1001763-02
on