Configuring Fips; Configuration Procedure; Prerequisites; Enabling Fips Mode - HP A6600 Configuration Manual

Configuring FIPS

FIPS, developed by the NIST of the United States, specifies the security requirements for cryptographic
modules. FIPS 140-2 defines four levels of security, simply named "Level 1" to "Level 4" from low to
high. The device supports Level 2.
Unless otherwise noted, in this document, FIPS refers to FIPS 140-2.

Configuration procedure

Prerequisites

Before enabling FIPS mode, complete the following tasks:
Configure the login username and password. The password must comprise no less than 6
•
characters and must contain uppercase and lowercase letters, digits, and special characters.
Delete all MD5-based digital certificates.
•
Delete the DSA key pairs that have a modulus length of less than 1024 bits and all RSA key pairs.
•

Enabling FIPS mode

After enabling FIPS mode, you must restart the device to validate the configuration.
To do...
1. Enter system view.
Enable FIPS mode.
2.

Settings changed by enabling FIPS mode

After you enable FIPS mode and restart the device, the following changes occur:
The FTP/TFTP server is disabled.
•
The Telnet server is disabled.
•
The HTTP server is disabled.
•
SNMP v1 and SNMP v2c are disabled. Only SNMP v3 is available.
•
The SSL server only supports TLS1.0.
•
The SSH server does not support SSHv1 clients.
•
Generated RSA/DSA key pairs have a modulus length from 1024 to 2048 bits.
•
SSH, SNMPv3, IPsec, and SSL do not support DES, RC4, or MD5.
•
Command...
system-view
fips mode enable
440
Remarks
—
Required
Not enabled by default