Power-On Self Tests; Conditional Tests; Fips Mode Configuration; Table 87 Fips Mode Restrictions - HP StoreFabric SN6500B Administrator's Manual

Power-on self tests

A power-on self-test (POST) is invoked by powering on the switch in FIPS mode and does not require
any operator intervention. If any KATs fail, the switch goes into a FIPS Error state, which reboots the
system to start the test again. If the switch continues to fail the FIPS POST, you will need to return
your switch to your switch service provider for repair. Refer to the Fabric OS Troubleshooting and
Diagnostics Guide for information about preparing a case for your service provider.

Conditional tests

These tests are for the random number generators and are executed to verify the randomness of
the random number generator. The conditional tests are executed each time prior to using the
random number provided by the random number generator.
The results of the POST and conditional tests are recorded in the system log or are output to the
local console. This action includes logging both passing and failing results. Refer to the Fabric OS
Troubleshooting and Diagnostics Guide for instructions on how to recover if your system cannot get
out of the conditional test mode.

FIPS mode configuration

By default, the switch comes up in non-FIPS mode. You can run the fipsCfg --enable fips command
to enable FIPS mode, but you must configure the switch first. Self-test mode must be enabled
before FIPS mode can be enabled. A set of prerequisites (as shown in
for the system to enter FIPS mode. To be FIPS-compliant, the switch must be rebooted. For
directors, either reboot both CPs, or power the chassis down and then up again. KATs are run on
the reboot. If the KATs are successful, the switch enters FIPS mode. If the KATs fail, then the switch
reboots until the KATs succeed. If the switch cannot enter FIPS mode and continues to reboot, you
must return the switch to your switch service provider. For information about how to prepare a
service provider case, refer to the Fabric OS Troubleshooting and Diagnostics Guide.
When the switch successfully reboots in FIPS mode, only FIPS-compliant algorithms are run.
NOTE
RPC is not supported in FIPS mode.
Table 87
TABLE 87
Features
Configupload/ download/
supportsave/ firmwaredownload
DH-CHAP/FCAP
hashing algorithms
DH-CHAP Shared Secret
HTTP/HTTPS access
HTTPS protocol/algorithms
Fabric OS Administrator's Guide
53-1002745-02
lists Fabric OS features and their behaviors in FIPS and non-FIPS mode.
FIPS mode restrictions
FIPS mode
SCP only
SHA-1
Minimum length of 32 bytes for secret used
in in-flight encryption
HTTPS only
TLS/AES128 cipher suite
FIPS mode configuration
Table 87) must be satisfied
Non-FIPS mode
FTP and SCP
MD5 and SHA-1
Minimum length of 8 bytes for
secret
HTTP and HTTPS
TLS AES 128 cipher suite
SSL is not supported.
B
617