- play_arrow Overview
- play_arrow Configuring Administrative Credentials and Privileges
- play_arrow Configuring Roles and Authentication Methods
- Understanding Roles and Services for Junos OS
- Understanding the Operational Environment for Junos OS in FIPS Mode
- Understanding Password Specifications and Guidelines for Junos OS in FIPS Mode
- Downloading Software Packages from Juniper Networks
- Installing Software on a Device with Single Routing Engine
- Understanding Zeroization to Clear System Data for FIPS Mode
- Zeroizing the System
- Enabling FIPS Mode
- Configuring Crypto Officer and FIPS User Identification and Access
- play_arrow Configuring SSH and Console Connection
- play_arrow Configuring MACsec
- play_arrow Configuring Event Logging
- play_arrow Configuring IPsec VPN
- play_arrow Operational Commands
Understanding FIPS Self-Tests
The cryptographic module enforces security rules to ensure that the Juniper Networks Junos operating system (Junos OS) in FIPS mode meets the security requirements of FIPS 140-2 Level 1. To validate the output of cryptographic algorithms approved for FIPS and test the integrity of some system modules, the device performs the following series of known answer test (KAT) self-tests:
kernel_kats—KAT for kernel cryptographic routinesmd_kats—KAT for libmd and libcopenssl_kats—KAT for OpenSSL cryptographic implementationquicksec_kats—KAT for QuickSec Toolkit cryptographic implementationmacsec_kats—KAT for MACsec cryptographic implementation
The KAT self-tests are performed automatically at startup. Conditional self-tests are also performed automatically to verify digitally signed software packages, generated random numbers, RSA and ECDSA key pairs, and manually entered keys.
If the KATs are completed successfully, the system log (syslog) file is updated to display the tests that were executed.
If one of the KATs fail, the device panics and reboot continuously. The device can be recovered using USB install.
The file show /var/log/messages command displays
the system log.
