Fips Cryptography; Configuration Tasks; Preparing The System; Enabling Fips Mode - Dell S4048–ON Configuration Manual

S-series 10gbe switches

Hide thumbs Also See for S4048–ON:

Table of Contents

FIPS Cryptography

Federal information processing standard (FIPS) cryptography provides cryptographic algorithms conforming to various FIPS

standards published by the National Institute of Standards and Technology (NIST), a non-regulatory agency of the US Department

of Commerce. FIPS mode is also validated for numerous platforms to meet the FIPS-140-2 standard for a software-based

cryptographic module.

This chapter describes how to enable FIPS cryptography requirements on Dell Networking platforms.

NOTE: The Dell Networking OS uses an embedded FIPS 140-2-validated cryptography module (Certificate #1747)

running on NetBSD 5.1 per FIPS 140-2 Implementation Guidance section G.5 guidelines.

NOTE: Only the following features use the embedded FIPS 140-2-validated cryptography module:

RSA Host Key Generation

SCP File Transfers

Currently, other features using cryptography do not use the embedded FIPS 140-2-validated cryptography module.

To enable FIPS cryptography, complete the following configuration tasks.

Generating Host-Keys

Monitoring FIPS Mode Status

Disabling FIPS Mode

Preparing the System

Before you enable FIPS mode, Dell Networking recommends making the following changes to your system.

Disable the Telnet server (only use secure shell [SSH] to access the system).

Disable the FTP server (only use secure copy [SCP] to transfer files to and from the system).

Attach a secure, standalone host to the console port for the FIPS configuration to use.

Enabling FIPS Mode

To enable or disable FIPS mode, use the console port.

Secure the host attached to the console port against unauthorized access. Any attempts to enable or disable FIPS mode from a

virtual terminal session are denied.

When you enable FIPS mode, the following actions are taken:

If enabled, the SSH server is disabled.

FIPS Cryptography