Boot Strict Mode - Lenovo RackSwitch G8264 Application Manual

Boot Strict Mode

58
G8264 Application Guide for ENOS 8.4
The implementations specified in this section are compliant with National Institute
of Standards and Technology (NIST) Special Publication (SP) 800‐131A.
The RackSwitch G8264 can operate in two boot modes:
 Compatibility mode (default): This is the default switch boot mode. This mode
may use algorithms and key lengths that may not be allowed/acceptable by
NIST SP 800‐131A specification. This mode is useful in maintaining
compatibility with previous releases and in environments that have lesser data
security requirements.
 Strict mode: Encryption algorithms, protocols, and key lengths in strict mode
are compliant with NIST SP 800‐131A specification.
When in boot strict mode, the switch uses Secure Sockets Layer (SSL)/Transport
Layer Security (TLS) 1.2 protocols to ensure confidentiality of the data to and from
the switch.
Before enabling strict mode, ensure the following:
 The software version on all connected switches is Enterprise NOS 8.4.
The supported protocol versions and cryptographic cipher suites between

clients and servers are compatible. For example: if using SSH to connect to the
switch, ensure that the SSH client supports SSHv2 and a strong cipher suite that
is compliant with the NIST standard.
 Compliant Web server certificate is installed on the switch, if using BBI.
A new self‐signed certificate is generated for the switch

(RS G8264(config)# access https generate­certificate). The
new certificate is generated using 2048‐bit RSA key and SHA‐256 digest.
 Protocols that are not NIST SP 800‐131A compliant must be disabled or not
used.
 Only SSHv2 or higher is used.
 The current configuration, if any, is saved in a location external to the switch.
When the switch reboots, both the startup and running configuration are lost.
 Only protocols/algorithms compliant with NIST SP 800‐131A specification are
used/enabled on the switch. Please see the NIST SP 800‐131A publication for
details. The following table lists the acceptable protocols and algorithms:
Table 3.
Acceptable Protocols and Algorithms
Protocol/Function Strict Mode Algorithm
BGP BGP does not comply with NIST SP
800‐131A specification. When in
strict mode, BGP is disabled. How‐
ever, it can be enabled, if required.
Certificate RSA‐2048
Generation SHA‐256
Certificate RSA 2048 or higher
Acceptance
SHA 224 or higher
Compatibility Mode Algorithm
Acceptable
RSA 2048
SHA 256
RSA
SHA, SHA2