- play_arrow Junos OS in FIPS Mode of Operation for SRX Series Security Devices
- Understanding Junos OS in FIPS Mode of Operation
- Identifying Secure Delivery
- Understanding FIPS Mode of Operation Terminology and Supported Cryptographic Algorithms
- Understanding Zeroization to Clear System Data for FIPS Mode of Operation
- Understanding FIPS Self-Tests
- Applying Tamper-Evident Seals to the Cryptographic Module
- play_arrow Configuring Roles and Authentication Methods
- Downloading Software Packages from Juniper Networks (FIPS Mode)
- Downloading and Installing Junos Software Packages (FIPS Mode)
- Understanding Roles and Services for Junos OS in FIPS Mode of Operation
- Understanding the Associated Password Rules for an Authorized Administrator
- Understanding FIPS Authentication Methods
- Understanding Services for Junos OS in FIPS Mode of Operation
- play_arrow Configuring SSH and Console Connection
- play_arrow Configuring Junos OS in FIPS Mode of Operation
Understanding Configuration Limitations and Restrictions on Junos OS in FIPS Mode
In FIPS mode, a device operates as a nonmodifiable operational environment in which only files shipped as part of Junos OS can be executed.
In contrast to non-FIPS mode, Junos OS in FIPS mode:
Conforms to FIPS 140-2.
Requires special installation procedures.
Mandates the use of internal, manual IPsec tunnels with specific requirements.
Limits services used for remote access.
Allows only the use of approved ciphers.
Requires user logout on disconnect at the console.
Sets strict requirements for passwords.
Requires special system logging considerations.
Disables the following Junos OS protocols and services so that you cannot configure them. Attempts to configure these services or to load configurations with these services configured result in a configuration syntax error.
finger
FTP
rlogin
rsh
Telnet
Trivial File Transfer Protocol (TFTP)
Transport Layer Security (TLS) protocol
xnm-clear-text
If you try to load a configuration that includes statements not supported by Junos OS in FIPS mode, you see a warning message. For example, suppose you attempt to configure Telnet for remote access:
content_copy zoom_out_map[edit] crypto-officer:fips# set system services telnet ^ syntax error.
You receive the above syntax error and cannot add the
system services telnetstatement to the loaded configuration.
