- play_arrow Overview
- play_arrow Configure Administrative Credentials and Privileges
- play_arrow Configure Roles and Authentication Methods
- Understanding Roles and Services for Junos OS
- Understanding the Operational Environment for Junos OS in FIPS Mode
- Understanding Password Specifications and Guidelines for Junos OS in FIPS Mode
- Downloading Software Packages from Juniper Networks
- Installing Software on a Device with Single Routing Engine
- Understanding Zeroization to Clear System Data for FIPS Mode
- Zeroizing the System
- Enabling FIPS Mode
- Configuring Crypto Officer and FIPS User Identification and Access
- play_arrow Configure SSH and Console Connection
- play_arrow Configure IPsec VPN
- play_arrow Configure Event Logging
- play_arrow Operational Commands
Example: Configure FIPS Self-Tests
This example shows how to configure FIPS self-tests to run periodically.
Hardware and Software Requirements
You must have administrative privileges to configure FIPS self-tests.
The device must be running the evaluated version of Junos OS in FIPS mode software.
Overview
The FIPS self-test consists of the following suites of known answer tests (KATs):
kernel_kats—KAT for kernel cryptographic routinesmd_kats—KAT for libmd and libcopenssl_kats—KAT for OpenSSL cryptographic implementationquicksec_kats—KAT for QuickSec Toolkit cryptographic implementationXLP—A crypto library (XLP) executes on the MS-MIC and provide cryptographic services for IPsec.
In this example, the FIPS self-test is executed at 9:00 AM in New York City, USA, every Wednesday.
Instead of weekly tests, you can configure monthly tests
by including the month and day-of-month statements.
When a KAT self-test fails, a log message is written to the system log messages file with details of the test failure. Then the system panics and reboots.
Configuration
CLI Quick Configuration
To quickly configure this example, copy the
following commands into a text file, remove any line breaks, and then
paste the commands into the CLI at the [edit] hierarchy
level.
set system fips self-test periodic start-time 09:00 set system fips self-test periodic day-of-week 3
Procedure
Step-by-Step Procedure
To configure the FIPS self-test:
Configure the FIPS self-test to execute at 9:00 AM every Wednesday.
content_copy zoom_out_map[edit system fips self-test] user@host# set periodic start-time 09:00 user@host# set periodic day-of-week 3
If you are done configuring the device, commit the configuration.
content_copy zoom_out_map[edit system fips self-test] user@host# commit
Results
From configuration mode, confirm your configuration
by issuing the show system command. If the output does
not display the intended configuration, repeat the instructions in
this example to correct the configuration.
user@host# show system
fips {
self-test {
periodic {
start-time "09:00";
day-of-week 3;
}
}
}
Verification
Confirm that the configuration is working properly.
Purpose
Verify that the FIPS self-test is enabled.
Action
Run the FIPS self-test manually by issuing the request system fips
self-test command.
After issuing the request system fips self-test command, the
system log file is updated to display the KATs that are executed. To view
the system log file, issue the file show /var/log/messages
command.
user@host> file show
/var/log/messages
mgd: Running FIPS Self-tests mgd: Testing kernel KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: SHA-2-384 Known Answer Test: Passed mgd: SHA-2-512 Known Answer Test: Passed mgd: AES128-CMAC Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: Testing MACSec KATS: mgd: AES128-CMAC Known Answer Test: Passed mgd: AES256-CMAC Known Answer Test: Passed mgd: AES-ECB Known Answer Test: Passed mgd: AES-KEYWRAP Known Answer Test: Passed mgd: Testing libmd KATS: mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: SHA-2-512 Known Answer Test: Passed mgd: Testing OpenSSL KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: FIPS ECDSA Known Answer Test: Passed mgd: FIPS ECDH Known Answer Test: Passed mgd: FIPS RSA Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: ECDSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-SSH-SHA256 Known Answer Test: Passed mgd: KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed mgd: KAS-FFC-EPHEM-NOKC Known Answer Test: Passed mgd: Testing QuickSec 7.0 KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-veriexec: no fingerprint for file='/sbin/kats/cannot-exec' fsid=87 fileid=51404 gen=1 uid=0 pid=1363 SIGN Known Answer Test: Passed mgd: SSH-ECDSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-IKE-V2 Known Answer Test: Passed mgd: Testing QuickSec KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-IKE-V2 Known Answer Test: Passed mgd: Testing SSH IPsec KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: Testing file integrity: mgd: File integrity Known Answer Test: Passed mgd: Testing crypto integrity: mgd: Crypto integrity Known Answer Test: Passed mgd: Expect an exec Authentication error... mgd: /sbin/kats/run-tests: /sbin/kats/cannot-exec: Authentication error mgd: FIPS Self-tests Passed
